July 2008 - Freeradius-Users - lists.freeradius.org

Radius + EAP-TLS + LDAP
by Paweł Klisiewicz 07 Jul '08

07 Jul '08

Hello! Is it possible to setup EAP-TLS based authentication without using third part CA for signing certificates ? so basically, keep users Public key's (not certificates) in LDAP and make radius to retrieve them from there and authenticate users in this way using just pair of public and private key ? I hope I express clearly what I mean. I am newbie in radius, I did not find any similar topic. best regards Pawel

2 1

preproxy_users doesn't filter attributes
by Michael da Silva Pereira 07 Jul '08

07 Jul '08

Hi All, I am wondering if anybody has done this, I'm sure it's actually very easy to do, But I'm just not able to get it done :( I need to filter requests coming from my NAS going to my radius server being forwarded to a clients radius server. Now I am able to modify and update attributes, even add using preproxy_users. but how on earth do I drop the attribute completely? Currently in preproxy_users: DEFAULT Realm == "testrealm.com" NAS-IP-Address := 196.3.121.32, User-Name =* ANY, User-Password =* ANY Other server still recieves: 3GPP2-Correlation-Id Calling-Station-Id Framed-Protocol User-Name User-Password Service-Type NAS-IP-Address NAS-Identifier Proxy-State User-Password Client-IP-Address Kind regards, Michael da silva Pereira

4 9

Re: Certificate Error!
by Kwok Sianbin 07 Jul '08

07 Jul '08

Hi Ivan, The dates are ok (up-to-date). Here I attach the certificate ----- Original Message ---- From: Ivan Kalik <tnt(a)kalik.net> To: freeradius-users(a)lists.freeradius.org Sent: Tuesday, June 10, 2008 12:00:33 AM Subject: Re: Certificate Error! >and then copy ca.der, client.p12 then I install the certificate into Windows XP. > >When click the client certificate and it shows > >"Windows doesn't have enough information to verify this certificate" > >Server cert in Trusted Root Cert > >"This certificate has expired or is not yet valid. > And below there is a line Valid from ... to ... - what are the dates? Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 5

questions about dictionary and unlang?
by Niki G. Petrov 07 Jul '08

07 Jul '08

Hello! Plaese help me! If I create a new my attribute in raddb/dictionary with number in 3000-4000 and when I write him in attribute for user in users file, all is OK but I can't see him in Access-Request. Secondary: How can I use him (my new attribute from raddb/dictionary), in example: if it is not persist in user Access-Request, then this user is Rejected, if persist then Acept. I make do that: (in users file) .. if (My-Attribute = "somthing like") { DEFAULT Fall-Through = no} else {Fall-Through = yes} DEFAULT Auth-Type := Reject (..but is not working) radiusd -X ...( Parse error (reply) for entry userJ: expecting operator)

2 1

freeradius 2.0.5 problem
by Egi 07 Jul '08

07 Jul '08

Hello! I have a problem with my freeradius server. The schema is the following... Mikrotik Router > freeradius server > Mysql Server From time to time (Maybe once in 4-5 days) i get this error repeated for many many times: Thu Jul 3 17:39:33 2008 : Error: Discarding duplicate request from client private-network port 35005 - ID: 223 due to unfinished request 5713664 Thu Jul 3 17:39:35 2008 : Error: Discarding duplicate request from client private-network port 35005 - ID: 223 due to unfinished request 5713664 Thu Jul 3 17:39:57 2008 : Error: Discarding duplicate request from client private-network port 45713 - ID: 65 due to unfinished request 5714017 Thu Jul 3 17:39:57 2008 : Error: Discarding duplicate request from client private-network port 35070 - ID: 126 due to unfinished request 5714018 Thu Jul 3 17:39:59 2008 : Error: Discarding duplicate request from client private-network port 45713 - ID: 65 due to unfinished request 5714017 Thu Jul 3 17:39:59 2008 : Error: Discarding duplicate request from client private-network port 35070 - ID: 126 due to unfinished request 5714018 also followed by some less errors like this one: Thu Jul 3 17:41:45 2008 : Error: WARNING: Unresponsive child (id 1377945920) for request 5715136, in module exec component post-auth And then many other errors like: hu Jul 3 17:43:16 2008 : Error: Received conflicting packet from client private-network port 35977 - ID: 249 due to unfinished request 5718311. Giving up on old request. Thu Jul 3 17:43:16 2008 : Error: Received conflicting packet from client private-network port 35976 - ID: 248 due to unfinished request 5718310. Giving up on old request. Thu Jul 3 17:43:16 2008 : Error: Received conflicting packet from client private-network port 35978 - ID: 250 due to unfinished request 5718312. Giving up on old request. Thu Jul 3 17:43:16 2008 : Error: Received conflicting packet from client private-network port 46742 - ID: 247 due to unfinished request 5718313. Giving up on old request. Thu Jul 3 17:43:16 2008 : Error: Received conflicting packet from client private-network port 46729 - ID: 235 due to unfinished request 5718317. Giving up on old request. also mixed with some other: Thu Jul 3 17:42:58 2008 : Error: WARNING: Unresponsive child (id 1346476352) for request 5716367, in module exec component post-auth And after that freeradius becomes unresponsive, i get "Radius timeout" on microtik and so the clients aren't authenticating. I have around 1200 clients in total, usually there are 700-800 users online. Thank You!

4 6

Get clients virtual_server info from SQL nas table
by nf-vale 07 Jul '08

07 Jul '08

Hi all, In my deploy, freeradius is retrieving clients info from sql nas table, but this table does not have a "virtual _server" column, and need to use virtual servers. Is it possible to get "virtual_server" info from sql nas table, instead of clients.conf file. If yes, what do I need to do? Thx, Nelson Vale

3 4

rlm_chap: Attribute "CHAP-Password" is required for authentication
by Slava 06 Jul '08

06 Jul '08

Hi, everybody have been trying to solve the problem, but in vain. It is FR 2.0.2 FreeBSD 6.2-RELEASE-p1 When using radtest (or dial up access) there is no Attribute "CHAP-Password" and the user is not authenticated, however the same user is authenticated when connecting via VPN. What needs to be changed for dial-up to work? Would be grateful for any comments Thanks Slava Shkarupin Kiev, UA ++++++++++++++++++++++++++++++++++++++++++++++++++ This is -X radtest output for user Olga1 (dial-up attempt gives a similar result - user is rejected) rad_recv: Access-Request packet from host 127.0.0.1 port 59528, id=206, length=56 User-Name = "Olga1" User-Password = "akrd24bf" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 +- entering group authorize ++[preprocess] returns ok expand: %A/%{Client-IP-Address}/detail -> /opt/freeradius/2.0.2/var/log/radius/radacct/127.0.0.1/detail rlm_detail: %A/%{Client-IP-Address}/detail expands to /opt/freeradius/2.0.2/var/log/radius/radacct/127.0.0.1/detail expand: %t -> Sun Jul 6 13:07:03 2008 ++[auth_log] returns ok rlm_pam: pam_auth call. username: Olga1 username name: User-Name rlm_pam: received attribute:1. rlm_pam: received attribute:2. rlm_pam: received attribute:4. rlm_pam: received attribute:5. rlm_pam: cisco_voip_detection enabled data->chap_password=1,data->special_username=(null),user_name_buff=Olga1 rlm_pam: pam_pass: name = Olga1, passwd = (null) pam_pass: function pam_authenticate SUCCESS for <Olga1>. pam_pass: function pam_acct_mgmt SUCCESS for <Olga1>. pam_pass: received framed_ip_address <192.168.0.65/32> pam_pass: received nas_command <> pam_pass: received password for chap <akrd24bf> pam_pass: authentication result for <Olga1> is 0 rlm_pam: pam_pass return 0 (success). rlm_pam: received password for chap:akrd24bf rlm_pam: received password for chap in vp:akrd24bf ++[pam] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "Olga1", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop @@@@eap+aouthorize begin rlm_eap: No EAP-Message, not doing EAP @@@@eap+aouthorize returns NOOP ++[eap] returns noop ++[unix] returns notfound users: Matched entry DEFAULT at line 158 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type Chap !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! auth: type "CHAP" +- entering group CHAP rlm_chap: Attribute "CHAP-Password" is required for authentication. ++[chap] returns invalid auth: Failed to validate the user. Login incorrect: [Olga1/akrd24bf] (from client localhost port 1) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> Olga1 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 10 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 10 Sending Access-Reject of id 206 to 127.0.0.1 port 59528 Waking up in 4.9 seconds. Cleaning up request 10 ID 206 with timestamp +1508 Ready to process requests. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ This is the real process of connecting through VPN with Radius in -X mode for the same user - user is authenticated rad_recv: Access-Request packet from host 127.0.0.1 port 52114, id=58, length=171 NAS-Identifier = "test-server-1.net.ua" Acct-Session-Id = "5338180-L-10" NAS-Port = 10 NAS-Port-Type = Virtual Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "10.1.0.250" NAS-Port-Id = "vlan310" User-Name = "Olga1" CHAP-Challenge = 0xbb1e68637b631b2b9ab0f56a0da47704dd3d76f1babbdcabcdec77f9b1fd0559e1b9bc5c CHAP-Password = 0x019220c41b166ec97be36327f0e0253d02 +- entering group authorize ++[preprocess] returns ok expand: %A/%{Client-IP-Address}/detail -> /opt/freeradius/2.0.2/var/log/radius/radacct/127.0.0.1/detail rlm_detail: %A/%{Client-IP-Address}/detail expands to /opt/freeradius/2.0.2/var/log/radius/radacct/127.0.0.1/detail expand: %t -> Sun Jul 6 12:56:20 2008 ++[auth_log] returns ok rlm_pam: pam_auth call. username: Olga1 username name: User-Name rlm_pam: received attribute:32. rlm_pam: received attribute:44. rlm_pam: received attribute:5. rlm_pam: received attribute:61. rlm_pam: received attribute:6. rlm_pam: received attribute:7. rlm_pam: received attribute:31. rlm_pam: received attribute:87. rlm_pam: received attribute:1. rlm_pam: received attribute:60. rlm_pam: received attribute:3. rlm_pam: received attribute:4. rlm_pam: cisco_voip_detection enabled data->chap_password=1,data->special_username=(null),user_name_buff=Olga1 rlm_pam: pam_pass: name = Olga1, passwd = (null) pam_pass: function pam_authenticate SUCCESS for <Olga1>. pam_pass: function pam_acct_mgmt SUCCESS for <Olga1>. pam_pass: received framed_ip_address <192.168.0.30/32> pam_pass: received nas_command <> pam_pass: received password for chap <akrd24bf> pam_pass: authentication result for <Olga1> is 0 rlm_pam: pam_pass return 0 (success). rlm_pam: received password for chap:akrd24bf rlm_pam: received password for chap in vp:akrd24bf ++[pam] returns ok rlm_chap: Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop rlm_realm: No '@' in User-Name = "Olga1", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop @@@@eap+aouthorize begin rlm_eap: No EAP-Message, not doing EAP @@@@eap+aouthorize returns NOOP ++[eap] returns noop ++[unix] returns notfound users: Matched entry DEFAULT at line 158 users: Matched entry DEFAULT at line 179 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type Chap !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! auth: type "CHAP" +- entering group CHAP rlm_chap: login attempt by "Olga1" with CHAP password rlm_chap: Using clear text password "akrd24bf" for user Olga1 authentication. rlm_chap: chap user Olga1 authenticated succesfully ++[chap] returns ok Login OK: [Olga1/<CHAP-Password>] (from client localhost port 10 cli 10.1.0.250) +- entering group post-auth expand: /opt/freeradius/2.0.2/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /opt/freeradius/2.0.2/var/log/radius/radacct/127.0.0.1/ reply-detail-20080706 rlm_detail: /opt/freeradius/2.0.2/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /opt/freeradius/2.0.2/var/log/radius/radacct/127.0.0.1/reply-detail-20080706 expand: %t -> Sun Jul 6 12:56:20 2008 ++[reply_log] returns ok Sending Access-Accept of id 58 to 127.0.0.1 port 52114 Framed-IP-Address = 192.168.0.30 Framed-IP-Netmask = 255.255.255.255 Framed-Protocol = PPP Service-Type = Framed-User Framed-Compression = Van-Jacobson-TCP-IP Finished request 2. Going to the next request Waking up in 0.9 seconds. Waking up in 4.0 seconds. Cleaning up request 2 ID 58 with timestamp +865 Ready to process requests.

2 1

RE: freeradius-proxy + PAP works, PEAP and the rest doesn´t
by uni＠christiankraus.de 06 Jul '08

06 Jul '08

Hi, so, I did some new runs. There are no more DH error within the radiusd -X output, but as you already pointed out, the freeradius is acting as proxy. Here is my hardware setup just for clarification: 1. setup: WLAN access router => Aruba WLAN concentrators => IAS/Radius => external RADIUS server What worked: - Login through Web Redirect homepage + PAP + external servers - Login through 802.1X/MSCHAPv2/PEAP for users on the IAS/RADIUS But I couldn´t get external RADIUS server get connected to the IAS/RADIUS with given local login credentials Therefore I tried FreeRadius, which leads to the 2. setup: WLAN access router => Aruba WLAN concentrators => FreeRadius (which proxies to) => Win2003 with IAS/Radius // external RADIUS server I´m still waiting for an answer whether there´s now a succesful request from external server to my local on, What is working: - Login through 802.1X/MSCHAPv2/PEAP for users on the IAS/RADIUS, which are now procied succesfully through the FreeRadius What is not working: - Login through Web Redirect homepage + PAP + external servers So, first get that problem solved: - PAP through IAS/RADIUS to external servers was working - PAP through the FreeRADIUS server to external servers isn´t working So, how to fix this? thanks and a happy weekend

2 1

FR 2.0.5 MPPE problem - worked in 2.0.4
by John Horne 05 Jul '08

05 Jul '08

Hello, We are running Freeradius on some VPN servers using MPPE and PPTP. I have upgraded one server this afternoon from FR 2.0.4 to 2.0.5. We are now seeing the old (?!) error messages of MPPE not being available: ====================================================================== Jul 4 17:40:01 betty pppd[23739]: rcvd [CHAP Response id=0x37 <20f649170924934c aea705692a84956100000000000000005000d7a07dae438cc630dfe93a6f147c9a031d758b8cf2d300>, name = "jhorne"] Jul 4 17:40:01 betty pppd[23739]: sent [CHAP Success id=0x37 "S=2A085F4D0A91C6832D347AF4305ED84C2ACF32E0"] Jul 4 17:40:01 betty pppd[23739]: MPPE required, but keys are not available. Possible plugin problem? Jul 4 17:40:01 betty pppd[23739]: sent [LCP TermReq id=0x2 "MPPE required but not available"] Jul 4 17:40:01 betty pppd[23739]: rcvd [CCP ConfReq id=0x4 <mppe +H +M +S +L -D +C>] ====================================================================== None of the configuration files were changed. Our 'users' file contains a DEFAULT entry of: DEFAULT Service-Type == Framed-User MS-MPPE-Encryption-Policy = 0x00000002, MS-MPPE-Encryption-Types = 0x00000006 When running FR 2.0.4 using 'radiusd -X' we can see the MPPE reply items present (and FR then passes them on to the PPP daemon): ================================================================== Login OK: [jhorne/<via Auth-Type = mschap>] (from client localhost port 0 cli 141.163.60.7) Sending Access-Accept of id 141 to 127.0.0.1 port 32769 MS-CHAP2-Success = 0x9c533d43393244394538333244413042433745324241443135463241354437354233443034394544313230 Reply-Message = "Yes" MS-MPPE-Recv-Key = 0x0e7596f28778d7d71a7553aadfa57e92 MS-MPPE-Send-Key = 0x41496804da30ffb8550fa9437ee6ae5e MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000006 Finished request 0. ================================================================== However, with FR 2.0.5 the MPPE reply items are missing: ================================================================== Login OK: [jhorne] (from client localhost port 0 cli 141.163.60.7) Sending Access-Accept of id 144 to 127.0.0.1 port 32769 MS-CHAP2-Success = 0x37533d32413038354634443041393143363833324433343741463433303545443834433241434633324530 Reply-Message = "Yes" MS-MPPE-Recv-Key = 0x00fbe23240bfd5a27fa70a2e32b581b3 MS-MPPE-Send-Key = 0xff5da890119101d1c08693d65bc3fc5b Finished request 0. ================================================================== As said, none of the configuration files have changed at all. It seems that FR 2.0.5 is dropping the reply items from the 'users' file after proxying, rather than passing them on. Has anyone else noticed this? I cannot really see anything relevant in the Changelog that would explain this. I'm a little stumped as to how to proceed with this (other than going back to 2.0.4), and it's late on a Friday afternoon so I'm going home to think :-) Thanks, John. -- --------------------------------------------------------------- John Horne, University of Plymouth, UK Tel: +44 (0)1752 587287 E-mail: John.Horne(a)plymouth.ac.uk Fax: +44 (0)1752 587001

3 3

Problem with account multiplication in radacct
by tg_melo＠bol.com.br 04 Jul '08

04 Jul '08

Hi again, I solved the last trouble with ippool.db using the sqlippool instead. But I got a new shining problem. :) Now, almost everything seems to be working fine. Almost, cause I have some account multiplication in the radacct table. Only a few users are doing that. And the multiplication doesn't stop while the users remain logged on. Only a few appear in table, I'm using an unique index with acctstarttime and nasipaddress. And the numbers of radacctid jump a lot (from 1400 to 4000, for example). I'm using also the set rad_alive 40 in ppp.conf and in the radiusd.conf, cleanup_delay 8 and max_request_time 50. All that with chap authentication. Select on one of the users who get the problem: +-----------+----------------------------------+--------------+--------------------+-----------+-------+----------------+------- ----+-------------+---------------------+--------------+-----------------+---------------+-------------------+------------------ +-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+- ----------------+----------------+---------------+----------------------+ | radacctid | acctsessionid | acctuniqueid | username | groupname | realm | nasipaddress | naspor tid | nasporttype | acctstarttime | acctstoptime | acctsessiontime | acctauthentic | connectinfo_start | connectinfo_stop | acctinputoctets | acctoutputoctets | calledstationid | callingstationid | acctterminatecause | servicetype | framedprotocol | framedipaddress | acctstartdelay | acctstopdelay | xascendsessionsvrkey | +-----------+----------------------------------+--------------+--------------------+-----------+-------+----------------+------- ----+-------------+---------------------+--------------+-----------------+---------------+-------------------+------------------ +-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+- ----------------+----------------+---------------+----------------------+ | 14419 | 37142-user212151719 | | user2 | | | XXX.XXX.XXX.252 | 688 | Ethernet | 2008-07-04 08:46:31 | NULL | 0 | | | | 0 | 0 | | X | | Framed-User | PPP | XXX.XXX.XXX.182 | 0 | 0 | | | 14421 | 37142-user212151719 | | user2 | | | XXX.XXX.XXX.252 | 688 | Ethernet | 2008-07-04 08:46:34 | NULL | 40 | | | NULL | 31795 | 102873 | | X | | Framed-User | PPP | XXX.XXX.XXX.182 | 0 | NULL | | | 14424 | 37142-user212151719 | | user2 | | | XXX.XXX.XXX.252 | 688 | Ethernet | 2008-07-04 08:46:37 | NULL | 80 | | | NULL | 59226 | 215383 | | X | | Framed-User | PPP | XXX.XXX.XXX.182 | 0 | NULL | | +-----------+----------------------------------+--------------+--------------------+-----------+-------+----------------+------- ----+-------------+---------------------+--------------+-----------------+---------------+-------------------+------------------ +-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+- ----------------+----------------+---------------+----------------------+ Radius log exact when the problem starts: 74242 Fri Jul 4 03:40:25 2008 : Info: Ready to process requests. 74243 Fri Jul 4 03:41:02 2008 : Info: Allocated IP: XXX.XXX.XXX.121 from valid (did cli 0 port 678 user x) 74244 Fri Jul 4 03:41:10 2008 : Info: Allocated IP: XXX.XXX.XXX.179 from valid (did cli 0 port 679 user x) 74245 Fri Jul 4 04:40:00 2008 : Info: Allocated IP: XXX.XXX.XXX.186 from valid (did cli 0 port 680 user x) 74246 Fri Jul 4 06:37:33 2008 : Info: Allocated IP: XXX.XXX.XXX.67 from valid (did cli 0 port 681 user x) 74247 Fri Jul 4 06:57:05 2008 : Info: Released IP XXX.XXX.XXX.67 (did cli 0 user x) 74248 Fri Jul 4 07:01:50 2008 : Info: Allocated IP: XXX.XXX.XXX.153 from valid (did cli 0 port 682 user x) 74249 Fri Jul 4 07:07:34 2008 : Info: Allocated IP: XXX.XXX.XXX.105 from valid (did cli 0 port 683 user x) 74250 Fri Jul 4 07:29:44 2008 : Info: Released IP XXX.XXX.XXX.186 (did cli 0 user x) 74251 Fri Jul 4 07:33:22 2008 : Info: Allocated IP: XXX.XXX.XXX.141 from valid (did cli 0 port 684 user x) 74252 Fri Jul 4 08:06:53 2008 : Info: Allocated IP: XXX.XXX.XXX.133 from valid (did cli 0 port 685 user x) 74253 Fri Jul 4 08:07:54 2008 : Info: Allocated IP: XXX.XXX.XXX.139 from valid (did cli 0 port 686 user x) 74254 Fri Jul 4 08:34:12 2008 : Info: Allocated IP: XXX.XXX.XXX.173 from valid (did cli 0 port 687 user x) 74255 Fri Jul 4 08:35:02 2008 : Info: Released IP XXX.XXX.XXX.133 (did cli 0 user x) 74256 Fri Jul 4 08:46:31 2008 : Info: Allocated IP: XXX.XXX.XXX.182 from valid (did cli 0 port 688 user user2) 74257 Fri Jul 4 08:47:11 2008 : Error: rlm_sql (sql): Couldn't insert SQL accounting ALIVE record - Duplicate entry '2008-07-0 08:46:31-XXX.XXX.XXX.252' for key 'radacct_whoson' 74258 Fri Jul 4 08:47:11 2008 : Error: rlm_sql_mysql: Cannot store result 74259 Fri Jul 4 08:47:11 2008 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry '2008-07-04 08:46:31-XXX.XXX.XXX.252' for ke 'radacct_whoson'' 74260 Fri Jul 4 08:47:11 2008 : Error: rlm_sql_mysql: Cannot store result 74261 Fri Jul 4 08:47:11 2008 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry '2008-07-04 08:46:31-XXX.XXX.XXX.252' for ke 'radacct_whoson'' 74262 Fri Jul 4 08:47:51 2008 : Error: rlm_sql (sql): Couldn't insert SQL accounting ALIVE record - Duplicate entry '2008-07-0 08:46:31-XXX.XXX.XXX.252' for key 'radacct_whoson' 74263 Fri Jul 4 08:47:51 2008 : Error: rlm_sql_mysql: Cannot store result And a tcpdump: Accounting Response (5), id: 0xb5, Authenticator: 3cffa31d3a8dd380caf25ceb110aca6c 08:46:27.957730 IP (tos 0x0, ttl 64, id 34131, offset 0, flags [none], proto: UDP (17), length: 239) XXX.XXX.XXX.129.62577 > XXX XXX.XXX.XXX.129.1813: RADIUS, length: 211 Accounting Request (4), id: 0xce, Authenticator: 886040c74f1443cacfbed17841589bd9 Username Attribute (1), length: 14, Value: user1 0x0000: X Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Framed Protocol Attribute (7), length: 6, Value: PPP 0x0000: 0000 0001 Framed IP Address Attribute (8), length: 6, Value: XXX.XXX.XXX.141 0x0000: X Framed IP Network Attribute (9), length: 6, Value: 0.0.0.0 0x0000: 0000 0000 Calling Station Attribute (31), length: 17, Value: [|radius] 0x0000: X [|radius] 08:46:27.962438 IP (tos 0x0, ttl 64, id 34132, offset 0, flags [none], proto: UDP (17), length: 48) XXX.XXX.XXX.129.1813 > XXX. XXX.XXX.129.62577: [udp sum ok] RADIUS, length: 20 Accounting Response (5), id: 0xce, Authenticator: ffaf38da2a70212e3ce78afd032a525e 08:46:31.454218 IP (tos 0x0, ttl 64, id 34133, offset 0, flags [none], proto: UDP (17), length: 183) XXX.XXX.XXX.129.58869 > XXX .4XXX.XXX.129.1812: RADIUS, length: 155 Access Request (1), id: 0x1d, Authenticator: e44b21c5e2e38c76f6a119d317a157f5 Username Attribute (1), length: 20, Value: user2 0x0000: X 0x0010: 6e6f Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Framed Protocol Attribute (7), length: 6, Value: PPP 0x0000: 0000 0001 CHAP Password Attribute (3), length: 19, Value: 0x0000: X [|radius] 08:46:31.459805 IP (tos 0x0, ttl 64, id 34134, offset 0, flags [none], proto: UDP (17), length: 63) XXX.XXX.XXX.129.1812 > XXX. XXX.XXX.129.58869: [udp sum ok] RADIUS, length: 35 Access Accept (2), id: 0x1d, Authenticator: c824b98efd857da27fa51a00998c3524 Filter ID Attribute (11), length: 9, Value: d256u96 0x0000: 6432 3536 7539 36 Framed IP Address Attribute (8), length: 6, Value: XXX.XXX.XXX.182 0x0000: X 08:46:31.482694 IP (tos 0x0, ttl 64, id 34135, offset 0, flags [none], proto: UDP (17), length: 208) XXX.XXX.XXX.129.60184 > XXX .XXX.XXX.129.1813: RADIUS, length: 180 Accounting Request (4), id: 0xc0, Authenticator: 0b59529ee5d6890d7c8800178b3566de Username Attribute (1), length: 20, Value: user2 0x0000: X 0x0010: 6e6f Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Framed Protocol Attribute (7), length: 6, Value: PPP 0x0000: 0000 0001 Framed IP Address Attribute (8), length: 6, Value: XXX.XXX.XXX.182 0x0000: X Framed IP Network Attribute (9), length: 6, Value: 0.0.0.0 0x0000: 0000 0000 [|radius] 08:46:31.487710 IP (tos 0x0, ttl 64, id 34136, offset 0, flags [none], proto: UDP (17), length: 48) XXX.XXX.XXX.129.1813 > XXX. XXX.XXX.129.60184: [udp sum ok] RADIUS, length: 20 Accounting Response (5), id: 0xc0, Authenticator: 399a20995afe01833bba61fb036795cf 08:46:34.244683 IP (tos 0x0, ttl 64, id 34143, offset 0, flags [none], proto: UDP (17), length: 72) XXX.XXX.XXX.129.50747 > XXX. 4XXX.XXX.129.53: [udp sum ok] 46949+ A? dnl-us7.kaspersky-labs.com. (44) 08:46:34.244836 IP (tos 0x0, ttl 64, id 34144, offset 0, flags [none], proto: UDP (17), length: 88) XXX.XXX.XXX.129.53 > XXX.8. 244.129.50747: [udp sum ok] 46949 q: A? dnl-us7.kaspersky-labs.com. 1/0/0 dnl-us7.kaspersky-labs.com. A 195.200.84.5 (60) 08:46:34.955698 IP (tos 0x0, ttl 64, id 34154, offset 0, flags [none], proto: UDP (17), length: 64) XXX.XXX.XXX.129.50747 > XXX. 4XXX.XXX.129.53: [udp sum ok] 249+ A? www.aresgalaxy.org. (36) 08:46:34.955849 IP (tos 0x0, ttl 64, id 34155, offset 0, flags [none], proto: UDP (17), length: 80) XXX.XXX.XXX.129.53 > XXX.8. 244.129.50747: [udp sum ok] 249 q: A? www.aresgalaxy.org. 1/0/0 www.aresgalaxy.org. A 66.98.222.3 (52) 08:46:48.279695 IP (tos 0x0, ttl 64, id 34183, offset 0, flags [none], proto: UDP (17), length: 247) XXX.XXX.XXX.129.55465 > XXX .XXX.XXX.129.1813: RADIUS, length: 219 Accounting Request (4), id: 0x8f, Authenticator: 12a34e1ff6be327bea5bf73a03a635af Username Attribute (1), length: 18, Value: user1 0x0000: X Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Framed Protocol Attribute (7), length: 6, Value: PPP 0x0000: 0000 0001 Framed IP Address Attribute (8), length: 6, Value: XXX.XXX.XXX.139 0x0000: X Framed IP Network Attribute (9), length: 6, Value: 0.0.0.0 0x0000: 0000 0000 Calling Station Attribute (31), length: 17, Value: [|radius] [|radius] 08:46:48.284459 IP (tos 0x0, ttl 64, id 34184, offset 0, flags [none], proto: UDP (17), length: 48) XXX.XXX.XXX.129.1813 > XXX. XXX.XXX.129.55465: [udp sum ok] RADIUS, length: 20 Accounting Response (5), id: 0x8f, Authenticator: 2f2339fd34188a81f2d0a707623d217f 08:46:48.446680 IP (tos 0x0, ttl 64, id 34187, offset 0, flags [none], proto: UDP (17), length: 61) XXX.XXX.XXX.129.50747 > XXX. 4XXX.XXX.129.53: [udp sum ok] 14077+ A? lan.startvg.com. (33) 08:46:48.446823 IP (tos 0x0, ttl 64, id 34188, offset 0, flags [none], proto: UDP (17), length: 77) XXX.XXX.XXX.129.53 > XXX.8. 244.129.50747: [udp sum ok] 14077 q: A? lan.startvg.com. 1/0/0 lan.startvg.com. A 74.55.200.146 (49) 08:46:49.446681 IP (tos 0x0, ttl 64, id 34200, offset 0, flags [none], proto: UDP (17), length: 60) XXX.XXX.XXX.129.50747 > XXX. 4XXX.XXX.129.53: [udp sum ok] 12455+ A? w5.startvg.com. (32) 08:46:49.446865 IP (tos 0x0, ttl 64, id 34201, offset 0, flags [none], proto: UDP (17), length: 76) XXX.XXX.XXX.129.53 > XXX.8. 244.129.50747: [udp sum ok] 12455 q: A? w5.startvg.com. 1/0/0 w5.startvg.com. A 70.85.138.50 (48) 08:46:49.786702 IP (tos 0x0, ttl 64, id 34206, offset 0, flags [none], proto: UDP (17), length: 239) XXX.XXX.XXX.129.51839 > XXX .XXX.XXX.129.1813: RADIUS, length: 211 Accounting Request (4), id: 0xb4, Authenticator: 3c8be7fa69dbb6607353d2ee04ab65f6 Username Attribute (1), length: 14, Value: user3 0x0000: X Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Framed Protocol Attribute (7), length: 6, Value: PPP 0x0000: 0000 0001 Framed IP Address Attribute (8), length: 6, Value: XXX.XXX.XXX.105 0x0000: X Framed IP Network Attribute (9), length: 6, Value: 0.0.0.0 0x0000: 0000 0000 Calling Station Attribute (31), length: 17, Value: [|radius] 0x0000: X [|radius] 08:46:49.791404 IP (tos 0x0, ttl 64, id 34207, offset 0, flags [none], proto: UDP (17), length: 48) XXX.XXX.XXX.129.1813 > XXX. XXX.XXX.129.51839: [udp sum ok] RADIUS, length: 20 Accounting Response (5), id: 0xb4, Authenticator: 2da35067aa3748f5f755e398f15b4139 08:46:50.629687 IP (tos 0x0, ttl 64, id 34234, offset 0, flags [none], proto: UDP (17), length: 63) XXX.XXX.XXX.129.50747 > XXX. 4XXX.XXX.129.53: [udp sum ok] 20104+ A? www.google.com.br. (35) 08:46:50.629850 IP (tos 0x0, ttl 64, id 34235, offset 0, flags [none], proto: UDP (17), length: 159) XXX.XXX.XXX.129.53 > XXX.8 .244.129.50747: 20104 q: A? www.google.com.br. 5/0/0 www.google.com.br. CNAME www.google.com., [|domain] 08:46:50.874678 IP (tos 0x0, ttl 64, id 34249, offset 0, flags [none], proto: UDP (17), length: 75) XXX.XXX.XXX.129.50747 > XXX. 4XXX.XXX.129.53: [udp sum ok] 38539+ A? pagead2.googlesyndication.com. (47) 08:46:50.874849 IP (tos 0x0, ttl 64, id 34250, offset 0, flags [none], proto: UDP (17), length: 153) XXX.XXX.XXX.129.53 > XXX.8 .244.129.50747: 38539 q: A? pagead2.googlesyndication.com. 4/0/0 pagead2.googlesyndication.com. CNAME[|domain] 08:46:52.001649 IP (tos 0x0, ttl 64, id 34258, offset 0, flags [none], proto: UDP (17), length: 231) XXX.XXX.XXX.129.59355 > XXX .XXX.XXX.129.1813: RADIUS, length: 203 Accounting Request (4), id: 0xdf, Authenticator: 8e381d93036159faf44668b400403a9f Username Attribute (1), length: 10, Value: user4 0x0000: X Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Framed Protocol Attribute (7), length: 6, Value: PPP 0x0000: 0000 0001 Framed IP Address Attribute (8), length: 6, Value: XXX.XXX.XXX.121 0x0000: X Framed IP Network Attribute (9), length: 6, Value: 0.0.0.0 0x0000: 0000 0000 Calling Station Attribute (31), length: 17, Value: [|radius] 0x0000: X [|radius] 08:46:52.006180 IP (tos 0x0, ttl 64, id 34259, offset 0, flags [none], proto: UDP (17), length: 48) XXX.XXX.XXX.129.1813 > XXX. XXX.XXX.129.59355: [udp sum ok] RADIUS, length: 20 Accounting Response (5), id: 0xdf, Authenticator: 71076d45f47f02944419c017c1408092 08:46:57.031248 IP (tos 0x0, ttl 64, id 34383, offset 0, flags [none], proto: UDP (17), length: 242) XXX.XXX.XXX.129.52499 > XXX .XXX.XXX.129.1813: RADIUS, length: 214 Accounting Request (4), id: 0x8b, Authenticator: 308ab2eea576048c9a8ab051ffdb2938 Username Attribute (1), length: 15, Value: user5 0x0000: X Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Framed Protocol Attribute (7), length: 6, Value: PPP 0x0000: 0000 0001 Framed IP Address Attribute (8), length: 6, Value: XXX.XXX.XXX.173 0x0000: X Framed IP Network Attribute (9), length: 6, Value: 0.0.0.0 0x0000: 0000 0000 Calling Station Attribute (31), length: 18, Value: [|radius] 0x0000: X [|radius] 08:46:57.035743 IP (tos 0x0, ttl 64, id 34384, offset 0, flags [none], proto: UDP (17), length: 48) XXX.XXX.XXX.129.1813 > XXX. XXX.XXX.129.52499: [udp sum ok] RADIUS, length: 20 Accounting Response (5), id: 0x8b, Authenticator: b5966fd9dcda6cc7461c48b97d2bec15 08:46:59.532790 IP (tos 0x0, ttl 64, id 34395, offset 0, flags [none], proto: UDP (17), length: 243) XXX.XXX.XXX.129.58045 > XXX .XXX.XXX.129.1813: RADIUS, length: 215 Accounting Request (4), id: 0x5c, Authenticator: 4d6cb1252ea0b5762d34bbc841a3f9ed Username Attribute (1), length: 16, Value: user6 0x0000: X Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Framed Protocol Attribute (7), length: 6, Value: PPP 0x0000: 0000 0001 Framed IP Address Attribute (8), length: 6, Value: XXX.XXX.XXX.179 0x0000: X Framed IP Network Attribute (9), length: 6, Value: 0.0.0.0 0x0000: 0000 0000 Calling Station Attribute (31), length: 17, Value: [|radius] 0x0000: X [|radius] 08:46:59.554103 IP (tos 0x0, ttl 64, id 34396, offset 0, flags [none], proto: UDP (17), length: 48) XXX.XXX.XXX.129.1813 > XXX. XXX.XXX.129.58045: [udp sum ok] RADIUS, length: 20 Accounting Response (5), id: 0x5c, Authenticator: 7432260fa37dae970c78198a9e5e923a 08:47:07.580791 IP (tos 0x0, ttl 64, id 34407, offset 0, flags [none], proto: UDP (17), length: 233) XXX.XXX.XXX.129.60644 > XXX .XXX.XXX.129.1813: RADIUS, length: 205 Accounting Request (4), id: 0x4f, Authenticator: 0a9617838fba04faad448c44d06d71b6 Username Attribute (1), length: 11, Value: user7 0x0000: X Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Framed Protocol Attribute (7), length: 6, Value: PPP 0x0000: 0000 0001 Framed IP Address Attribute (8), length: 6, Value: XXX.XXX.XXX.153 0x0000: X Framed IP Network Attribute (9), length: 6, Value: 0.0.0.0 0x0000: 0000 0000 Calling Station Attribute (31), length: 17, Value: [|radius] 0x0000: X [|radius] 08:47:07.585498 IP (tos 0x0, ttl 64, id 34408, offset 0, flags [none], proto: UDP (17), length: 48) XXX.XXX.XXX.129.1813 > XXX. XXX.XXX.129.60644: [udp sum ok] RADIUS, length: 20 Accounting Response (5), id: 0x4f, Authenticator: 2fa9d8161b441a9f5336f630fe55e9fa 08:47:08.197706 IP (tos 0x0, ttl 64, id 34409, offset 0, flags [none], proto: UDP (17), length: 239) XXX.XXX.XXX.129.63164 > XXX .XXX.XXX.129.1813: RADIUS, length: 211 Accounting Request (4), id: 0xb2, Authenticator: 2fe5ce8331e665ebbea87ec953075c2d Username Attribute (1), length: 14, Value: user1 0x0000: X Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Framed Protocol Attribute (7), length: 6, Value: PPP 0x0000: 0000 0001 Framed IP Address Attribute (8), length: 6, Value: XXX.XXX.XXX.141 0x0000: X Framed IP Network Attribute (9), length: 6, Value: 0.0.0.0 0x0000: 0000 0000 Calling Station Attribute (31), length: 17, Value: [|radius] 0x0000: X [|radius] 08:47:08.202234 IP (tos 0x0, ttl 64, id 34410, offset 0, flags [none], proto: UDP (17), length: 48) XXX.XXX.XXX.129.1813 > XXX. XXX.XXX.129.63164: [udp sum ok] RADIUS, length: 20 Accounting Response (5), id: 0xb2, Authenticator: 9308c51e608c6503d0ed826ca179d817 08:47:09.428670 IP (tos 0x0, ttl 64, id 34412, offset 0, flags [none], proto: UDP (17), length: 59) XXX.XXX.XXX.129.50747 > XXX. 4XXX.XXX.129.53: [udp sum ok] 62382+ A? www.orkut.com. (31) 08:47:09.428851 IP (tos 0x0, ttl 64, id 34413, offset 0, flags [none], proto: UDP (17), length: 152) XXX.XXX.XXX.129.53 > XXX.8 .244.129.50747: 62382 q: A? www.orkut.com. 5/0/0 www.orkut.com. CNAME orkut.l.google.com., orkut.l.google.com.[|domain] 08:47:11.705737 IP (tos 0x0, ttl 64, id 34427, offset 0, flags [none], proto: UDP (17), length: 250) XXX.XXX.XXX.129.54776 > XXX .XXX.XXX.129.1813: RADIUS, length: 222 Accounting Request (4), id: 0x9e, Authenticator: f46cb516f565b2533b8f797708c04f41 Username Attribute (1), length: 20, Value: user2 0x0000: X 0x0010: 6e6f Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Framed Protocol Attribute (7), length: 6, Value: PPP 0x0000: 0000 0001 Framed IP Address Attribute (8), length: 6, Value: XXX.XXX.XXX.182 0x0000: X Framed IP Network Attribute (9), length: 6, Value: 0.0.0.0 0x0000: 0000 0000 [|radius] 08:47:14.722579 IP (tos 0x0, ttl 64, id 34462, offset 0, flags [none], proto: UDP (17), length: 250) XXX.XXX.XXX.129.54776 > XXX .XXX.XXX.129.1813: RADIUS, length: 222 Accounting Request (4), id: 0x9e, Authenticator: f46cb516f565b2533b8f797708c04f41 Username Attribute (1), length: 20, Value: user2 0x0000: X 0x0010: 6e6f Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Framed Protocol Attribute (7), length: 6, Value: PPP 0x0000: 0000 0001 Framed IP Address Attribute (8), length: 6, Value: XXX.XXX.XXX.182 0x0000: X Framed IP Network Attribute (9), length: 6, Value: 0.0.0.0 0x0000: 0000 0000 [|radius] 08:47:14.727705 IP (tos 0x0, ttl 64, id 34463, offset 0, flags [none], proto: UDP (17), length: 48) XXX.XXX.XXX.129.1813 > XXX. XXX.XXX.129.54776: [udp sum ok] RADIUS, length: 20 Accounting Response (5), id: 0x9e, Authenticator: 2b5bbecd09941fda409322375fac86f5 08:47:28.519682 IP (tos 0x0, ttl 64, id 34515, offset 0, flags [none], proto: UDP (17), length: 247) XXX.XXX.XXX.129.51199 > XXX .XXX.XXX.129.1813: RADIUS, length: 219 Accounting Request (4), id: 0xc3, Authenticator: 1eacbab964455ecd42ae9251d6eeaee0 Username Attribute (1), length: 18, Value: user3 0x0000: X Service Type Attribute (6), length: 6, Value: Framed The ppp.log keeps on "Radius: Request re-sent" for that user. I'm trying to solve that for days, without success. Anything I tried to stop that multiple accounts doesn't help. So any help, like always, will be appreciated. Thanks in advance.

1 0