- Freeradius-Users - lists.freeradius.org

Still with ldap error
by Sergio Belkin 22 May '09

22 May '09

Hi, Some months ago I mentioned a problem that it seems to be non-fatal but it still is there: Fri May 22 10:00:50 2009 : Error: rlm_ldap: ldap_search() failed: LDAP connection lost. Fri May 22 10:00:50 2009 : Info: rlm_ldap: Attempting reconnect This problem appears more or less every 90 seconds. on ldap logs you can see things like that: May 22 04:16:40 ldap-server slapd[27663]: conn=219 fd=14 ACCEPT from IP=127.0.0.1:56359 (IP=127.0.0.1:389) May 22 04:16:40 ldap-server slapd[27663]: conn=219 op=0 BIND dn="uid=jojo0l4,ou=people,dc=domain,dc=edu" method=128 May 22 04:16:40 ldap-server slapd[27663]: conn=219 op=0 BIND dn="uid=jojo0l4,ou=people,dc=domain,dc=edu" mech=SIMPLE ssf=0 May 22 04:16:40 ldap-server slapd[27663]: conn=219 op=0 RESULT tag=97 err=0 text= May 22 04:17:19 ldap-server slapd[27663]: conn=219 op=1 BIND anonymous mech=implicit ssf=0 May 22 04:17:19 ldap-server slapd[27663]: conn=219 op=1 BIND dn="uid=jojoi1,ou=people,dc=domain,dc=edu" method=128 May 22 04:17:19 ldap-server slapd[27663]: conn=219 op=1 BIND dn="uid=jojoi1,ou=people,dc=domain,dc=edu" mech=SIMPLE ssf=0 May 22 04:17:19 ldap-server slapd[27663]: conn=219 op=1 RESULT tag=97 err=0 text= May 22 04:18:01 ldap-server slapd[27663]: conn=219 fd=14 closed (idletimeout) May 22 09:31:50 ldap-server slapd[17574]: conn=219 fd=23 ACCEPT from IP=IPADDRESS:57845 (IP=0.0.0.0:636) May 22 09:31:50 ldap-server slapd[17574]: conn=219 fd=23 TLS established tls_ssf=256 ssf=256 May 22 09:31:50 ldap-server slapd[17574]: conn=219 op=0 BIND dn="uid=jojo2,ou=people,dc=domain,dc=edu" method=128 May 22 09:31:50 ldap-server slapd[17574]: conn=219 op=0 BIND dn="uid=jojo2,ou=people,dc=domain,dc=edu" mech=SIMPLE ssf=0 May 22 09:31:50 ldap-server slapd[17574]: conn=219 op=0 RESULT tag=97 err=0 text= May 22 09:31:50 ldap-server slapd[17574]: conn=219 op=1 UNBIND May 22 09:31:50 ldap-server slapd[17574]: conn=219 fd=23 closed May 22 10:07:45 ldap-server slapd[22236]: conn=219 fd=17 ACCEPT from IP=IPADDRESS:36313 (IP=0.0.0.0:636) May 22 10:07:45 ldap-server slapd[22236]: conn=219 fd=17 TLS established tls_ssf=256 ssf=256 I've tried modifying idletimeout y timelimit on slapd.conf, and modifying limits per ldap radius user. I was playing with timeout and timelimit and nothing changed it. Raising and lowering.... Using FreeRADIUS Version 2.1.1, for host x86_64-unknown-linux-gnu, built on Oct 21 2008 at 15:14:37 I'd thank you your help! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

2 1

Re: Freeradius and WiMAX Access Point
by Ming-Ching Tiew 22 May '09

22 May '09

--- On Fri, 5/22/09, Ivan Kalik <tnt(a)kalik.net> wrote: > > I shall not name the vendor name > here. I just got some info from the > > vendor that the WiMAX Access Point does not do > 'interim accounting', > > 'acctupdate' and so on. Only thing possible right now > is authenticate > > and start/stop accounting. > > That's pathetic. You should name them and shame them. > > Oh boy, that name isn't a small name. I hope it's the people I liased with was not knowledgible enough to tell me the truth. To put a box in front of the AP path is so ugly .... Regards.

2 1

Freeradius and WiMAX Access Point
by Ming-Ching Tiew 22 May '09

22 May '09

I shall not name the vendor name here. I just got some info from the vendor that the WiMAX Access Point does not do 'interim accounting', 'acctupdate' and so on. Only thing possible right now is authenticate and start/stop accounting. That being the case, I wonder how one implement stuff like fair-use policy on a WiMAX user ? If the radius server does not get interim accounting, the way the users is going to "cheat" is just to power off the device at the end of his usage !!! Am I missing something here ? The way I see it is that if one have to implement a more intelligent authentication and accounting, for WiMAX, one has to put a box, either as a bridge or as a router in front of the APs, where all the data path goes through the box. And that box will create session information and accounting on behalf of the APs. If one has to introduce this box, using Linux solutions, what would be the right way to do this, so that the traffic accounting can be done on each APs ? ( iptables or Coova chilli comes to my mind ). How does the commercial solutions work ? Anyone care to share his knowledge on this ? Once again thanks for reading and best regards. Ming-Ching

3 2

RE: Freeradius-Users Digest, Vol 49, Issue 100
by Marco De Magistris 22 May '09

22 May '09

Hi Ivan, >> 4. Proxying packets from a fixed source IP address (Alan DeKok) It is good idea. Thank for your help. The solution works fine. Marco -----Original Message----- From: freeradius-users-bounces+marco.de.magistris=ericsson.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+marco.de.magistris=ericsson.com@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: giovedì 21 maggio 2009 18.50 To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 49, Issue 100 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: Freeradius-Users Digest, Vol 49, Issue 95 (Alan DeKok) 2. RE: Freeradius-Users Digest, Vol 49, Issue 95 (Ivan Kalik) 3. Re: question about session resumption and reply attributes (Alan DeKok) 4. Proxying packets from a fixed source IP address (Alan DeKok) 5. Re: Rewriting User-Name in pre-proxy (William Taylor) 6. Re: current RHEL/CentOS pre-built packages (Was: freeRADIUS) (Just E. Mail) 7. Re: current RHEL/CentOS pre-built packages (Was: freeRADIUS) (A.L.M.Buxey(a)lboro.ac.uk) 8. Re: current RHEL/CentOS pre-built packages (Was: freeRADIUS) (John Dennis) 9. Re: current RHEL/CentOS pre-built packages (Was: freeRADIUS) (Just E. Mail) ---------------------------------------------------------------------- Message: 1 Date: Thu, 21 May 2009 15:00:51 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Freeradius-Users Digest, Vol 49, Issue 95 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A155083.1020604(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Marco De Magistris wrote: > In my opinion the packet (received from Radius Client) is sent towards > the default gateway. Yes. That's how neteworking works. > The following link describes the same scenario: > > http://www.opensubscriber.com/message/freeradius-users@lists.freeradius.org… > > They introduce *proxyip = 10.10.10.10* in proxy.conf. In 2.x, you can define the addresses that the server opens for proxying. See the "listen" section of radiusd.conf. That may help. Alan DeKok. ------------------------------ Message: 2 Date: Thu, 21 May 2009 14:27:51 +0100 (BST) From: "Ivan Kalik" <tnt(a)kalik.net> Subject: RE: Freeradius-Users Digest, Vol 49, Issue 95 To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <17832.194.176.105.43.1242912471.squirrel(a)webmail.kalik.net> Content-Type: text/plain;charset=utf-8 > 3. RE: Freeradius-Users Digest, Vol 49, Issue 93 (Ivan Kalik) > > ____________________________________________________________________________ > >> Radius Client --> Radius Proxy > >> 192.168.1.2 192.168.1.3 192.168.14.3 --> IPS1(192.168.14.4) > >> 192.168.24.3 --> IPS2(192.168.24.4) > > ____________________________________________________________________________ > > You say: > >>>Yes. Proxy server will change NAS-IP-Address from the original NAS >>> >>address into it's own. That is OK. > > > > It not works. In my scenario I have two different NAS-IP-Address(a > NAS-IP-Address for ISP1 and a NAS-IP-Address for ISP2). > That's because that can't work: # Note: "type = proxy" lets you control the source IP used for # proxying packets, with some limitations: # # * Only ONE proxy listener can be defined. # * A proxy listener CANNOT be used in a virtual server section. # * You should probably set "port = 0". # * Any "clients" configuration will be ignored. You can't define two IPs on which to proxy. You need two proxy servers for that: proxy1 gets requests from NAS -> if it's for isp1 proxy to 192.168.14.4 from 192.168.14.3 if it's for isp2, proxy to proxy2 (also from 192.168.14.3) proxy2 will have 192.168.24.3 configured as proxy port and proxy to 192.168.24.4 (isp2) You can even have proxy1 and proxy2 on the same machine, one listening on 1812+ ports and other on 1645+ ports. They just can't be the same radiusd process. Ivan Kalik Kalik Informatika ISP ------------------------------ Message: 3 Date: Thu, 21 May 2009 16:05:39 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: question about session resumption and reply attributes To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A155FB3.7010700(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Arran Cudbard-Bell wrote: > Yes, so have it tell the outer server... Insert the (attached) snippet > into the authorize section of the inner server. $ git format-patch ? > I believe the User-Name attribute in outer.reply is cached, and > available for use on session resumption. Yes. > Once you've got the policies moved to post-auth, then any scripts or > lookups used for authorisation will only be run once, so far greater > efficiency with complex policies. Rejects are still handled properly > even within the Post-Auth section (jumps to Post-Auth-Type reject). Documentation suggestions are always welcome. Alan DeKok. ------------------------------ Message: 4 Date: Thu, 21 May 2009 17:02:35 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Proxying packets from a fixed source IP address To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A156D0B.8010403(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Ivan Kalik wrote: > That's because that can't work: > > # Note: "type = proxy" lets you control the source IP used for > # proxying packets, with some limitations: > # > # * Only ONE proxy listener can be defined. That's actually wrong. It was true a while ago, but it's not true in 2.1.6. However... defining two proxy listeners won't do what he wants in 2.1.6. I've committed a patch to git head. See http://git.freeradius.org/pre/ for a snapshot of 2.1.7-pre that includes the fixes. See raddb/proxy.conf, and look for "src_ipaddr". Alan DeKok. ------------------------------ Message: 5 Date: Thu, 21 May 2009 08:37:41 -0700 From: William Taylor <williamt(a)corp.sonic.net> Subject: Re: Rewriting User-Name in pre-proxy To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <F5737B03-7986-4D26-994E-A4AA0875A7E8(a)corp.sonic.net> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes On May 18, 2009, at 11:16 AM, William Taylor wrote: > Im currently using freeradius 2.1.4 > I need to lookup a username in a dbm and rewrite it before sending > off the proxy request. > I have achieved this by using the below method. But I was wondering > if there was a better way. > It would seem that invoking perl with every auth request might be bad. > > Thanks in advance! > > -William > > > In: /etc/raddb/dictionary > > ATTRIBUTE My-Local-String 3000 string > > In: sites-available/default > > pre-proxy { > rewrite > update proxy-request { > User-Name := "%{proxy-request:My-Local-String}" > } > } > > In: /etc/raddb/modules/rewrite > > exec rewrite { > wait = yes > program = "/etc/raddb/rewriteusername.pl %{User-Name} %{Stripped- > User-Name} %{Realm}" > input_pairs = proxy-request > output_pairs = proxy-request > shell_escape = yes > } > > In: /etc/raddb/rewriteusername.pl > > #!/usr/bin/perl > use strict; > use DB_File; > > my %h; > tie %h, "DB_File", "/etc/raddb/rewritemap.db", O_RDONLY, 0444, > $DB_HASH > or die "Cannot open file rewritemap.db: $!\n"; > > my $fuser = $ARGV[0]; > my $suser = $ARGV[1]; > my $realm = $ARGV[2]; > > if($realm eq "foobee.net") { > > if($h{$suser}) { > print "My-Local-String=" . $h{$suser}; > } else { > print "My-Local-String=$suser"; > } > > } else { > print "My-Local-String=$suser"; > } > > exit 0; > Anyone doing something similar ? ------------------------------ Message: 6 Date: Thu, 21 May 2009 10:13:36 -0600 From: "Just E. Mail" <justemail(a)imwell-usa.com> Subject: Re: current RHEL/CentOS pre-built packages (Was: freeRADIUS) To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A157DB0.7090103(a)imwell-usa.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed John Dennis wrote: > Just E. Mail wrote: > >> I am trying to install freeRADIUS on a CentOS 5.3 machine with >> PostgreSQL-8.3.7. My plan is to first install freeRADIUS and test it >> then setup PostgreSQL as the backend to store data. >> >> Is there any freeRADIUS RPMS V#2.1.4 or newer for CentOS? >> > > No, the version in RHEL and CentOS is 1.1.3. The following link explains > why and also explains how to acquire and build a current FreeRADIUS RPM > for RHEL/CentOS (but read the rest of this email, pre-built versions are > coming). > > http://wiki.freeradius.org/Red_Hat_FAQ > I read response from John Dennis and looked at the web site URL he provided. I am ready to install FR and I have one more question! In my setup, I plan to (1) Install FR and test it and if everything works, then (2) setup PostgreSQL backend at a SQL server and test it again. I noticed that at the URL listed by John Dennis, there are two files; freradius-2.2.1.6-1.el5.i386.rpm freradius-postgresql-2.2.1.6-1.el5.i386.rpm I am pretty new to FR so please advice; do I need to install both of these RPMs or just the second for my setup to work? ------------------------------ Message: 7 Date: Thu, 21 May 2009 17:16:52 +0100 From: A.L.M.Buxey(a)lboro.ac.uk Subject: Re: current RHEL/CentOS pre-built packages (Was: freeRADIUS) To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20090521161652.GB10004(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii Hi, > freradius-2.2.1.6-1.el5.i386.rpm > freradius-postgresql-2.2.1.6-1.el5.i386.rpm > > I am pretty new to FR so please advice; do I need to install both of > these RPMs or just the second for my setup to work? both. the second one adds the postgres support. alan ------------------------------ Message: 8 Date: Thu, 21 May 2009 12:29:02 -0400 From: John Dennis <jdennis(a)redhat.com> Subject: Re: current RHEL/CentOS pre-built packages (Was: freeRADIUS) To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A15814E.2040908(a)redhat.com> Content-Type: text/plain; charset=us-ascii Just E. Mail wrote: > John Dennis wrote: >> >> http://wiki.freeradius.org/Red_Hat_FAQ >> > I read response from John Dennis and looked at the web site URL he > provided. I am ready to install FR and I have one more question! > > In my setup, I plan to (1) Install FR and test it and if everything > works, then (2) setup PostgreSQL backend at a SQL server and test it > again. I noticed that at the URL listed by John Dennis, there are two > files; > > freradius-2.2.1.6-1.el5.i386.rpm > freradius-postgresql-2.2.1.6-1.el5.i386.rpm > > I am pretty new to FR so please advice; do I need to install both of > these RPMs or just the second for my setup to work? Did you read the FAQ listed at the top. The section "Why are there optional subpackages instead of just one package?" should have explained it, was it not clear? If so I'll update it to make it clearer if you explain what was not clear. -- John Dennis <jdennis(a)redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/ ------------------------------ Message: 9 Date: Thu, 21 May 2009 10:50:06 -0600 From: "Just E. Mail" <justemail(a)imwell-usa.com> Subject: Re: current RHEL/CentOS pre-built packages (Was: freeRADIUS) To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A15863E.6080705(a)imwell-usa.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed John Dennis wrote: > Did you read the FAQ listed at the top. The section "Why are there > optional subpackages instead of just one package?" should have explained > it, was it not clear? If so I'll update it to make it clearer if you > explain what was not clear. > Yes I read it and read it again after receiving the above email.Missed it both times. Thank for your HELP. Jennifer ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 49, Issue 100 *************************************************

1 0

FreeRadius+wimax asn gw
by Denis K 22 May '09

22 May '09

Dear All, I'm trying to configure radius as a AAA server for WiMAX ASN GW. I've generated certs and have added them to a ASN. Auth is work ok. I've got access-accept, but after this I need to discribe a service for wimax user, parametrs such as QoS, Servic flow, static ip etc. Where should I add them? How to create a service? Is where any documentation aboute it? thanks in advance -- View this message in context: http://www.nabble.com/FreeRadius%2Bwimax-asn-gw-tp23666799p23666799.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Re: FreeRadius+wimax asn gw
by Ming-Ching Tiew 22 May '09

22 May '09

I am pretty new to this too but I think you have to send back some reply attributes which the ASN gateway can understand and can enforce it. As to what attributes the ASN gateway can understand, I suppose this is vendor specific. --- On Fri, 5/22/09, Denis K <denis(a)tojikiston.com> wrote: > From: Denis K <denis(a)tojikiston.com> > Subject: FreeRadius+wimax asn gw > To: freeradius-users(a)lists.freeradius.org > Date: Friday, May 22, 2009, 8:53 AM > > Dear All, > > I'm trying to configure radius as a AAA server for WiMAX > ASN GW. > I've generated certs and have added them to a ASN. Auth is > work ok. I've got > access-accept, but after this I need to discribe a service > for wimax user, > parametrs such as QoS, Servic flow, static ip etc. > Where should I add them? How to create a service? Is where > any documentation > aboute it? > > thanks in advance > -- > View this message in context: http://www.nabble.com/FreeRadius%2Bwimax-asn-gw-tp23666799p23666799.html > Sent from the FreeRadius - User mailing list archive at > Nabble.com. > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >

1 0

How to: freeRADIUS with PostgreSQL Backend!
by Just E. Mail 22 May '09

22 May '09

I have setup a working freeRADIUS server & now want to add PostgreSQL as backend for storage of data. I have read the freeRADIUS documentation and researched the internet on this subject. What I am looking for is any kind of Step-by-Step document detailing sequential steps needed to setup a PostgreSQL back end for freeRADIUS. Has someone written such a document? Is there such a writeup available?

3 2

Add clients into nas table
by Ming-Ching Tiew 22 May '09

22 May '09

May I ask if I am using sql to store the client list in the sql table 'nas', is there a way for me to ask freeradius to refresh the list ? Or is it that I must kill and restart freeradius ? Regards.

3 2

usr-hiper and freeradius 2.1.5 accounting problem
by haries fajar nugroho 22 May '09

22 May '09

Hi All, I wanna migrate my radius server from icradius to freeradius 2.1.5. i have two ras modem for my nas (patton and usr-hiper). When I do some migration simulation, client that connect from patton goes normally (authentication,accounting,authorization). But when they use usr-hiper (system version :V5.1.6/Non-Encr), the client could connect to the network but the accounting goes wrong. In my freeradius debugging mode, the error message was : rad_recv: Accounting-Request packet from host x.x.x.x (* encrypted ip) port 1646, id=63, length=405 Received Accounting-Request packet from x.x.x.x (* encrypted ip) with invalid signature! (Shared secret is incorrect.) Dropping packet without response. Going to the next request Waking up in 0.9 seconds. The usr-hiper accounting settings : HiPer>> sh accounting RADIUS ACCOUNTING SETTINGS The Primary Server Status is: ENABLED Primary Server is: x.x.x.x(* encrypted ip) Primary First Backup Server is: 0.0.0.0 Primary Second Backup Server is: 0.0.0.0 Primary Destination Port is: 1648 Primary First Backup Destination Port: 1646 Primary Second Backup Destination Port: 1646 Primary Preference: 1 Primary First Backup Preference: 2 Primary Second Backup Preference: 3 Max Primary Retransmissions: 0 The Secondary Server Status is: ENABLED Secondary Server is: 0.0.0.0 Secondary First Backup Server is: 0.0.0.0 Secondary Second Backup Server is: 0.0.0.0 Secondary Destination Port is: 1646 Secondary First Backup Destination Port: 1646 Secondary Second Backup Destination Port: 1646 Secondary Preference : 1 Secondary First Backup Preference: 2 Secondary Second Backup Preference: 3 What I have tried to solve it : 1. I've tried to make multi port for accounting packet (1646 & 1648), because i thought that the error message refer to wrong accounting port. But the accounting still wrong. 2. I've tried to use default freeradius secret at the freeradius side with testing123 without changing the secret at the ras modem. But still failed. Do you have another solution ? Thanks before :)

2 1

accounting with 802.1X: some clients trigger multiple starts at a time
by Sam Hooker 22 May '09

22 May '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi folks, We're running SQL accounting for the FR servers authenticating our 802.1X users, now. I'm seeing some annoying duplicate entries, and am wondering if anyone else has had this experience: mysql> SELECT acctsessionid, username, nasipaddress, acctstarttime, callingstationid FROM radacct WHERE acctstoptime IS NULL ORDER BY acctstarttime; +-----------------------------------+------------+-----------------+---------------------+------------------+ | acctsessionid | username | nasipaddress | acctstarttime | callingstationid | +-----------------------------------+------------+-----------------+---------------------+------------------+ ... | 4a15bfef/00:23:12:07:e9:c4/74507 | [redacted] | 10.246.207.234 | 2009-05-21 16:56:15 | 192.168.2.17 | | 4a15bfef/00:23:12:07:e9:c4/74505 | [redacted] | 10.246.207.234 | 2009-05-21 16:56:15 | w.x.38.213 | | 4a15bfef/00:23:12:07:e9:c4/74514 | [redacted] | 10.246.207.234 | 2009-05-21 16:56:15 | 10.250.61.133 | | 4a15bfef/00:23:12:07:e9:c4/74516 | [redacted] | 10.246.207.234 | 2009-05-21 16:56:15 | 192.168.1.25 | | 4a15bfef/00:23:12:07:e9:c4/74513 | [redacted] | 10.246.207.234 | 2009-05-21 16:56:15 | w.x.38.213 | ... I would think this to be pretty normal-looking, except: 1) in this particular group, all the usernames and MAC components of the acctsessionid are the same (i.e., this is one node causing multiple accounting starts to be sent); and 2) our 802.1X wireless clients would not have IP addresses in RFC1918 space. Ever. Most of the time, a group like this will include an address in our real wireless address range (that's what I've replaced with "w.x.38.213"), but sometimes not. If the callingstationid weren't different for each entry, I'd think "retries" or "EAP-FAST". (I think I see EAP-FAST activity going on elsewhere; or, at least, that's what I assume it is.) As far as I can tell, this occurs pretty infrequently, given the number of users we have, but it does occur consistently for a given set of users in a given day, which makes me think it's something about their location on the network. Reducing all the accounting detail to a spreadsheet, I see that this is a flurry of start and stop messages (and one Interim-Update!), and will comb through that closely tomorrow morning. Seems odd, though, that there would be a stop logged to the detail, but not to SQL, in this case. I have little- to no visibility into the networking configuration (our systems and network groups bristle at each other; a situation I'm trying to remedy), but I do know this: One department is located across the street from our main campus. It connects to the Internet by way of a commodity ISP. It is, however, close enough to pick up one of our APs, and the enterprising IT guy for that department has set up a Windows box as a wireless client, and bridged that into their LAN for access to institutional resources. (He has been duly chastised for this.) In at least that case, I've seen their LAN IPs (in a reasonably-unusual RFC1918 subnet) as the callingstationid. (Oddly, though, this is sometimes the LAN IP of their print server, or default gateway -- some artifact of bridging?) This makes me think that there are more clients out there that can see more than one subnet at a time, and just report in with whatever IP they feel like. I suppose my real question is this: Is there anything I can do, from the FR server end, to winnow out one reliable accounting entry per event? Sure, I can make my reports (like 'radwho') filter WHERE callingstationid LIKE 'w.x.%', but that runs the risk of missing entries where the group fails to include one of our "legit" addresses. Alternatively, has anyone else faced this and addressed it on the client side? ("Tell the rogue departments to comply with your network policies," is a valid answer and, frankly, my favorite.) As ever, pointers to pre-existing threads answering this are welcome; I couldn't come up with the right combination of search terms to find them myself... Cheers, - -sth sam hooker|sth@noiseplant.com|http://www.noiseplant.com Are you satisfied? ([y]/n): -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) Comment: Use GnuPG with Firefox : http://getfiregpg.org (Version: 0.7.5) iEYEARECAAYFAkoVzbIACgkQX8KByLv3aQ3tVQCdEOfZCztHLnmvCvfiuax1Y6Qu pA0AoLhQLZCIP/0DwXWje1PY41suMq8o =JDqP -----END PGP SIGNATURE-----

2 1