July 2007 - Freeradius-Users - lists.freeradius.org

Adding a ldap.attrb Dialuppassword to radius-ldap.schema
by "Jóhann B. Guðmundsson" 20 Jul '07

20 Jul '07

RHEL5/FreeRadius freeradius-1.1.3-1.2.el5/Fedora Directory server. Scenario... Currently trying to move all our dial up user entry's from users file to ldap ( FDS ) and need to add an attribute in radius ldap schema which would contain clear text password of the dial in password for the dial up users and match the dial in password to that password instead of users login password. What needs to be done to make this possible if it is possible? ( user are already authenticated through ldap except for their adsl dial in passwords which are in clear text and even if the passwords weren't in clear text and they could use there login password to login the user ain't smart enough and or technology challenge ( or at least majority of them ) to know if they change they're login password they needed to change it in the adsl router as well ) Schema changes? Dictionary changes ldap.attrmap changes ldap changes in radiusd.conf? ( password_attribute already mapped to userPassword in the ldap section ) Best regards Johann B. -- Johann B. Gudmundsson. RHCE,CCSA Unix System Engineer. IT Management. Reiknistofnun University of Iceland. Taeknigardi, Dunhaga 5. Email: johannbg(a)hi.is IS-107 Reykjavik. Phone: +354-525-4267 Iceland. Fax: +354-552-8801

2 1

Second level authentication.
by ashish verma 20 Jul '07

20 Jul '07

Hi Stefan, I read the document and thanks for giving the link, that was helpful. Well I think i put my question in a wrong way. Let me put it in a different way. I dont want the user to go directly in priv mode. through priv level = 15 we direclty get into priv level right. what i am looking for is first the user get into user level and then with another password in level 2. (not with enable password)..it should be through RADIUS server. Ashish

5 4

Quirky question about rewriting usernames
by Cliff Cole 19 Jul '07

19 Jul '07

Hello all. Here is my issue. This is very weird and would only affect one NAS. I'm not sure freeradius is capable of this. I want a username that comes in to check for an @domainname. If the domainname is there I want it to be stripped and added back later. If the domainname is not there I'd like it to continue and have to domainname added later in the authentication process. I hope this makes sense and any help is appreciated Cliff

3 5

RadiusClient
by Sofia Silva 19 Jul '07

19 Jul '07

I'm trying to authenticate a linux client against a radius server. I've implemented the radius server with freeradius and i've tested it with a cisco client and it worked, but, unfortunately, i'm having seriuos problems to authenticate the linux client using RadiusClient. I'm running the server in debug mode and when i run <radiusclient "User-Name = testuser Password = testuser"> the password the server shows it's not plain text, it's sth like "\211pe;\336....." so i thought it could be a problem with the secret word. However, i've checket it in the "servers" file (at the client) and in the "clients.conf" file (at the server) and it's the same. Sth i found is that i don't seem to have the file radius.seq in /var/run, i would like to create it but i don't know what the sequence number is and i don't know what the format of the file should be. I'd appreciate it a lot if sb could help me Sofia _________________________________________________________________ ¿Cuánto vale tu auto? Tips para mantener tu carro. ¡De todo en MSN Latino Autos! http://latino.msn.com/autos/

1 0

New freeradius installation
by Lisa Casey 19 Jul '07

19 Jul '07

Hi, I just migrated my radius from Cistron to freeradius. It's working fine as far as authenticating our dialups goes. I do have one concern though, because this shouldn't be happening (at least I don't think so). If I were to restart the radius daemon now, all would be well: Thu Jul 19 10:53:51 2007 : Info: Using deprecated naslist file. Support for this will go away soon. Thu Jul 19 10:53:51 2007 : Info: Using deprecated realms file. Support for this will go away soon. Thu Jul 19 10:53:51 2007 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Thu Jul 19 10:53:51 2007 : Info: Ready to process requests. But if I make changes to my users file (and accidently make a mistake), I get errors regarding that of course when I restart radius, but I also get errors regarding the radiusd.conf file. For example, this morning I left off a comma at the end of a line. Thu Jul 19 10:13:10 2007 : Info: Using deprecated naslist file. Support for this will go away soon. Thu Jul 19 10:13:10 2007 : Info: Using deprecated realms file. Support for this will go away soon. Thu Jul 19 10:13:10 2007 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Thu Jul 19 10:13:10 2007 : Error: /usr/local/etc/raddb/users[4375]: Syntax error: Previous line is missing a trailing comma for entry bruce Thu Jul 19 10:13:10 2007 : Error: Errors reading /usr/local/etc/raddb/users Thu Jul 19 10:13:10 2007 : Error: radiusd.conf[1067]: files: Module instantiation failed. Thu Jul 19 10:13:10 2007 : Error: radiusd.conf[1852] Unknown module "files". Thu Jul 19 10:13:10 2007 : Error: radiusd.conf[1788] Failed to parse authorize section. I correct the error in the users file and get no more complaints regarding radiusd.conf Why? Lisa Casey

3 2

RE: 3COM sw4500 802.1x Problem
by Aydın KOÇAK 19 Jul '07

19 Jul '07

Hello; I could solve my problem with change Auth-Type attribute to EAP in LDAP an everything is ok. Thank you for your relation. Best Regards, Aydin Kocak.

2 1

Problem in EAP-TLS Authentication
by Govardhana K N 19 Jul '07

19 Jul '07

Hi, I was trying to configure EAP with TLS/TTlS. After enabling TLS/TTLS in " eap.conf", I tried sending an Radius Access-Request with EAP-Identitye response. The Server is crashing becoz of segmentation fault. The debug lod from the server is given below. ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- cheux301:/etc/freeradius# freeradius -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius:/usr/local/lib" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: bind_address = 127.0.0.1 IP address [127.0.0.1] main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius:/usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "/etc/passwd" unix: shadow = "/etc/shadow" unix: group = "/etc/group" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/freeradius/certs/cert-srv.pem" tls: certificate_file = "/etc/freeradius/certs/cert-srv.pem" tls: CA_file = "/etc/freeradius/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/freeradius/certs/dh" tls: random_file = "/etc/freeradius/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = yes tls: check_cert_cn = "%{User-Name}" tls: cipher_list = "DEFAULT" tls: check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication 127.0.0.1:1812 Listening on accounting 127.0.0.1:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32823, id=217, length=95 User-Name = "jrc" NAS-Identifier = "jrcnas" NAS-Port-Type = Ethernet CUI = "0" Service-Type = Framed-User Framed-MTU = 1400 Calling-Station-Id = "1:1:1:1:1:1" Message-Authenticator = 0x2568987af6f31763f9199f8067fafee1 EAP-Message = 0x02d20008016a7263 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 Segmentation fault cheux301:/etc/freeradius# ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- -- Thanks & Regards, Govardhana K N

2 1

1.1.7 sqlippool %{SQL-User-Name}
by Hugh Messenger 19 Jul '07

19 Jul '07

Peter . as per your postgres 1.1.7 sqlippool queries, I changed the MySQL ones to use %{SQL-User-Name} instead of %{User-Name} . only it doesn't seem to pick up a value, so the UserName is coming up blank in the radippool table. Example: sqlippool_expand: 'UPDATE radippool SET expiry_time = NOW() + INTERVAL 3600 SECOND WHERE NASIPAddress = '%{Nas-IP-Address}' AND pool_key = '%{Calling-Station-Id}' AND UserName = '%{SQL-User-Name}' AND CallingStationId = '%{Calling-Station-Id}' AND FramedIPAddress = '%{Framed-IP-Address}'' radius_xlat: 'UPDATE radippool SET expiry_time = NOW() + INTERVAL 3600 SECOND WHERE NASIPAddress = '216.108.219.36' AND pool_key = '00:14:6C:37:16:49' AND UserName = '' AND CallingStationId = '00:14:6C:37:16:49' AND FramedIPAddress = '172.168.124.120'' This happens on both 1.1.6 and 1.1.7. Should that be something like %{control:SQL-User-Name} ? My apologies - I don't know how I missed this when testing yesterday. I guess it returned an IP just fine, so I didn't actually look at what it was doing too closely! -- hugh

3 14

Re: Freeradius-Users Digest, Vol 27, Issue 121
by ashish verma 19 Jul '07

19 Jul '07

Hi, I read the document. I think i put my question in a wrong way. Let me put it in a different way. I dont want the user to go directly in priv mode. through priv level = 15 we can direclty go into priv level right. what i want is first the user get into user level and then with another password in level 2. (not with enable password)..it should be through RADIUS server. I hope it makes it easy. On 7/19/07, freeradius-users-request(a)lists.freeradius.org < freeradius-users-request(a)lists.freeradius.org> wrote: > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: mod_auth_radius (Nick Owen) > 2. Re: Quirky question about rewriting usernames (Cliff Cole) > 3. "Time-out" Problem with Huntgroups in conjunction with MYSQL > Backend (thomas(a)buddybase.at) > 4. Level 2 authentication with RADIUS. (ashish verma) > 5. Re: Level 2 authentication with RADIUS. (Stefan Winter) > 6. Re: Level 2 authentication with RADIUS. (Stefan Winter) > 7. Re: TLS cant connect ldap+freeradius+novell > (Reimer Karlsen-Masur, DFN-CERT) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 19 Jul 2007 09:14:28 -0400 > From: "Nick Owen" <nowen(a)wikidsystems.com> > Subject: Re: mod_auth_radius > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <415a28910707190614v586aceb1re81767278eb9fccf(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > On 7/19/07, Rascher, Markus <markus.mr.rascher(a)siemens.com> wrote: > > > > > > Hi All, > > > > is there a tutorial how to install mod_auth_radius on an apache 2.xxserver? > > The howto on the freeradius webpage is a little bit deprecated i guess. > > i get an error when starting the apache server after installing > > mod_auth_radius: > > > > # service httpd start > > Starting httpd: httpd: Syntax error on line 205 of > > /etc/httpd/conf/httpd.conf: Cannot load > > /usr/lib/httpd/modules/mod_auth_radius-2.0.so into server: > > /usr/lib/httpd/modules/mod_auth_radius-2.0.so: undefined > > symbol: ap_snprintf > > [FAILED] > > You might try mod_auth_xradius. I have done a couple of apache + > radius + WiKID 2FA docs that might help: > > http://www.wikidsystems.com/documentation/howtos/how-to-add-two-factor-auth… > > http://www.howtoforge.com/apache_radius_two_factor_authentication > > The latter is more recent. > > HTH, > > nick > > -- > Nick Owen > WiKID Systems, Inc. > 404.962.8983 > http://www.wikidsystems.com > Commercial/Open Source Two-Factor Authentication > > > ------------------------------ > > Message: 2 > Date: Thu, 19 Jul 2007 09:35:13 -0400 > From: "Cliff Cole" <clifflcole(a)gmail.com> > Subject: Re: Quirky question about rewriting usernames > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <5da254220707190635u50d33d86sb39bfbb7250c7a12(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Thanks for the reply. I'm new to free radius and have been > overwhelmed with documentation the past few days. Let me explain in > some logic and maybe I can make some sense as to what I'm trying to > do. > > User authentication comes from "NAS A" > > IF the username does not have @domain.com and NAS = "NAS A" > THEN append @domain.com > > IF the username has @domain.com and NAS = "NAS A" > THEN continue with username as is. > > Hope this helps to clear up what I'm trying to do. I appologize for > not being very clear. > > Thanks > > Cliff > > > > On 7/19/07, Pshem Kowalczyk <pshem.k(a)gmail.com> wrote: > > Hi > > > > On 19/07/07, Cliff Cole <clifflcole(a)gmail.com> wrote: > > > Hello all. > > > > > > Here is my issue. This is very weird and would only affect one NAS. > > > I'm not sure freeradius is capable of this. I want a username that > > > comes in to check for an @domainname. If the domainname is there I > > > want it to be stripped and added back later. If the domainname is not > > > there I'd like it to continue and have to domainname added later in > > > the authentication process. I hope this makes sense and any help is > > > appreciated > > > > What do you mean by 'later' you can definitely check for the presence > > of domain, you can strip it and add it again. you just have to define > > the flow. rlm_attr will be of help to you (for both stripping and > > adding). > > > > kind regards > > Pshem > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > > ------------------------------ > > Message: 3 > Date: Thu, 19 Jul 2007 15:38:54 +0200 > From: thomas(a)buddybase.at > Subject: "Time-out" Problem with Huntgroups in conjunction with MYSQL > Backend > To: freeradius-users(a)lists.freeradius.org > Message-ID: <20070719153854.9aj0e3hdesk04sw8(a)webmail.buddybase.at> > Content-Type: text/plain; charset=ISO-8859-1; DelSp="Yes"; > format="flowed" > > Hello FR users, > > I am running FreeRadius 1.1.3 together with MySQL 5.0.27 > I use huntgroups to allow access to specific devices only to certain users > belonging to a certain group (I use huntgroups since "I" didnt find a way > to do it via MySQL) > I have the following issue: > When for a longer period (e.g. over night) no one logs into one of the > devices (so the radius server sits idle), it happens that the first time > in > the morning someone tries to login he fails because FR rejects the Request > with "invalid user" - only after 3 or 4 tries the login-attempt is > successfull > The reason seems to be, that after such a "long" dormant period, when the > first RADIUS-request(s) arrive, FR has to re-connect to the MySQL DB to > query the user's group-membership > Since this re-connect takes "too long" the query returns "Not found" and > the user is rejected as "unknown" > > Here is what you see in the radius.log file: > Tue Jul 17 08:05:16 2007 : Info: rlm_sql_mysql: Starting connect to MySQL > server for #9 > Tue Jul 17 08:05:16 2007 : Error: rlm_sql (sql): failed after re-connect > Tue Jul 17 08:05:16 2007 : Auth: No huntgroup access: [xxx] (from client > ATWRE22e7601 port 1 cli 10.0.0.31) > Tue Jul 17 08:05:16 2007 : Auth: Invalid user: [xxx] (from client > ATWRE22e7601 port 1 cli 10.0.0.31) > Tue Jul 17 08:05:25 2007 : Info: rlm_sql_mysql: Starting connect to MySQL > server for #8 > Tue Jul 17 08:05:25 2007 : Error: rlm_sql (sql): failed after re-connect > Tue Jul 17 08:05:25 2007 : Auth: No huntgroup access: [xxx] (from client > ATWRE22e7601 port 0) > Tue Jul 17 08:05:25 2007 : Auth: Invalid user: [xxx] (from client > ATWRE22e7601 port 0) > Tue Jul 17 08:05:38 2007 : Info: rlm_sql_mysql: Starting connect to MySQL > server for #7 > Tue Jul 17 08:05:38 2007 : Error: rlm_sql (sql): failed after re-connect > Tue Jul 17 08:05:38 2007 : Auth: No huntgroup access: [xxx] (from client > ATWRE22e7601 port 0) > Tue Jul 17 08:05:38 2007 : Auth: Invalid user: [xxx] (from client > ATWRE22e7601 port 0) > Tue Jul 17 08:06:00 2007 : Info: rlm_sql_mysql: Starting connect to MySQL > server for #6 > Tue Jul 17 08:06:00 2007 : Auth: Login OK: [xxx] (from client ATWRE22b7201 > port 2 cli 10.0.0.31) > > Hope the logfile is sufficient, otherwise I would have to let FR run in > debug-mode over night.... > > The funny thing is, that this problem doesn't occure when all entries in > the huntgroups file are "commented out" > > So my question is, is there a config parameter to tell FR to "wait" a bit > longer in the preprocess module (I assume) for the MYSQL query to deliver > its answer? > > thanks alot > regards > thomas pudil > > > > > > ------------------------------ > > Message: 4 > Date: Thu, 19 Jul 2007 19:11:35 +0530 > From: "ashish verma" <ashish.scit(a)gmail.com> > Subject: Level 2 authentication with RADIUS. > To: freeradius-users(a)lists.freeradius.org > Message-ID: > <11b554120707190641g6abce7b3o2535671040dc5327(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi all, > I am new to the list and for RADIUS too so i might ask some repetitive > questions. > > Here is my question: > Can we have level 2 (enable) authentication too with Radius server as we > have for level 1(user level)? > > If yes, can someone provide me some documentation. I tried to search for > it > but couldnt find any. > > Thanks in advance, > Ashish >

2 1

"Time-out" Problem with Huntgroups in conjunction with MYSQL Backend
by thomas＠buddybase.at 19 Jul '07

19 Jul '07

Hello FR users, I am running FreeRadius 1.1.3 together with MySQL 5.0.27 I use huntgroups to allow access to specific devices only to certain users belonging to a certain group (I use huntgroups since "I" didnt find a way to do it via MySQL) I have the following issue: When for a longer period (e.g. over night) no one logs into one of the devices (so the radius server sits idle), it happens that the first time in the morning someone tries to login he fails because FR rejects the Request with "invalid user" - only after 3 or 4 tries the login-attempt is successfull The reason seems to be, that after such a "long" dormant period, when the first RADIUS-request(s) arrive, FR has to re-connect to the MySQL DB to query the user's group-membership Since this re-connect takes "too long" the query returns "Not found" and the user is rejected as "unknown" Here is what you see in the radius.log file: Tue Jul 17 08:05:16 2007 : Info: rlm_sql_mysql: Starting connect to MySQL server for #9 Tue Jul 17 08:05:16 2007 : Error: rlm_sql (sql): failed after re-connect Tue Jul 17 08:05:16 2007 : Auth: No huntgroup access: [xxx] (from client ATWRE22e7601 port 1 cli 10.0.0.31) Tue Jul 17 08:05:16 2007 : Auth: Invalid user: [xxx] (from client ATWRE22e7601 port 1 cli 10.0.0.31) Tue Jul 17 08:05:25 2007 : Info: rlm_sql_mysql: Starting connect to MySQL server for #8 Tue Jul 17 08:05:25 2007 : Error: rlm_sql (sql): failed after re-connect Tue Jul 17 08:05:25 2007 : Auth: No huntgroup access: [xxx] (from client ATWRE22e7601 port 0) Tue Jul 17 08:05:25 2007 : Auth: Invalid user: [xxx] (from client ATWRE22e7601 port 0) Tue Jul 17 08:05:38 2007 : Info: rlm_sql_mysql: Starting connect to MySQL server for #7 Tue Jul 17 08:05:38 2007 : Error: rlm_sql (sql): failed after re-connect Tue Jul 17 08:05:38 2007 : Auth: No huntgroup access: [xxx] (from client ATWRE22e7601 port 0) Tue Jul 17 08:05:38 2007 : Auth: Invalid user: [xxx] (from client ATWRE22e7601 port 0) Tue Jul 17 08:06:00 2007 : Info: rlm_sql_mysql: Starting connect to MySQL server for #6 Tue Jul 17 08:06:00 2007 : Auth: Login OK: [xxx] (from client ATWRE22b7201 port 2 cli 10.0.0.31) Hope the logfile is sufficient, otherwise I would have to let FR run in debug-mode over night.... The funny thing is, that this problem doesn't occure when all entries in the huntgroups file are "commented out" So my question is, is there a config parameter to tell FR to "wait" a bit longer in the preprocess module (I assume) for the MYSQL query to deliver its answer? thanks alot regards thomas pudil

2 1