- Freeradius-Users - lists.freeradius.org

FreeRadius 1.1.7 & Solaris 10
by Roar Pettersen 09 Mar '09

09 Mar '09

Hi ! We have a odd problem on one of our FreeRadius servers : SunOS 5.10 Generic_138888-03 sun4u sparc Mon Mar 9 13:39:26 2009 : Error: Discarding duplicate request from client hostname:1814 - ID: 179 due to unfinished request 2603 Mon Mar 9 13:39:32 2009 : Error: Discarding duplicate request from client hostname:1814 - ID: 179 due to unfinished request 2603 Mon Mar 9 13:39:52 2009 : Error: WARNING: Unresponsive child (id 96) for request 2603 (in component authenticate module rlm_pam) Mon Mar 9 13:40:01 2009 : Error: Discarding duplicate request from client hostname:1814 - ID: 143 due to unfinished request 2604 Mon Mar 9 13:40:02 2009 : Error: Discarding duplicate request from client hostname:1814 - ID: 145 due to unfinished request 2606 Mon Mar 9 13:40:03 2009 : Error: Discarding duplicate request from client hostname:1814 - ID: 144 due to unfinished request 2605 Mon Mar 9 13:40:07 2009 : Error: Discarding duplicate request from client hostname:1814 - ID: 143 due to unfinished request 2604 Mon Mar 9 13:40:07 2009 : Error: Discarding duplicate request from client hostname:1814 - ID: 145 due to unfinished request 2606 Mon Mar 9 13:40:07 2009 : Error: Discarding duplicate request from client hostname:1814 - ID: 144 due to unfinished request 2605 Mon Mar 9 13:40:09 2009 : Error: Discarding duplicate request from client hostname:1814 - ID: 146 due to unfinished request 2607 Mon Mar 9 13:40:09 2009 : Error: Discarding duplicate request from client hostname:1814 - ID: 147 due to unfinished request 2608 Mon Mar 9 13:40:15 2009 : Error: Discarding duplicate request from client hostname:1814 - ID: 146 due to unfinished request 2607 Mon Mar 9 13:40:15 2009 : Error: Discarding duplicate request from client hostname:1814 - ID: 147 due to unfinished request 2608 Mon Mar 9 13:40:30 2009 : Error: WARNING: Unresponsive child (id 104) for request 2604 (in component authenticate module rlm_pam) Mon Mar 9 13:40:30 2009 : Error: WARNING: Unresponsive child (id 99) for request 2605 (in component authenticate module rlm_pam) Mon Mar 9 13:40:30 2009 : Error: WARNING: Unresponsive child (id 103) for request 2606 (in component authenticate module rlm_pam) Mon Mar 9 13:40:35 2009 : Error: WARNING: Unresponsive child (id 97) for request 2607 (in component authenticate module rlm_pam) Mon Mar 9 13:40:35 2009 : Error: WARNING: Unresponsive child (id 102) for request 2608 (in component authenticate module rlm_pam) When this problem occur, then no radius authentication. After a few seconds radius is working as it should. We are observing this problem ca 2 or 4 times each hour. -- Regards; Roar Pettersen Universitetet i Bergen - The University of Bergen

2 1

radiusd server does not respond to radtest from another host
by mbhorner＠aol.com 09 Mar '09

09 Mar '09

[>Thanks for the response. My original email was very lengthy, but at the bottom you can see a wireshark capture showing the packet arrival. (My understanding is wireshark is a pretty GUI based on tcpdump) > Yes, it arrived but can't get through the firewall. You say you are using default freeradius configuration, so you haven't done anything strange to listen section to cause this - it has to be tha firewall.] OK, I'll investigate the firewall this morning - I am new to openSUSE so I don't know where that is but hopefully google will point me in the right direction. FYI - I uninstalled both installations, removed all the files under /etc/raddb and reinstalled only editing "users and clients.conf" What I found is on the 10.10.10.11 machine which has a full 32 bit version of openSUSE 11.1 installed that radiusd did not respond from other host. It did respond to radtest from another terminal window on the same machine I then started Linux using a openSUSE 64 bit "live CD" on my 10.10.10.10 machine (because its hard drive has windows). In installed the basic packages needed to get freeradius running (C/C++ dev, gnu make etc) - I used an identical "users and client.conf file" with 24 bit mask for clients in 10.10.10.0 On the liveCD host the freeradius server works! - so perhaps it is a lack of firewall? Note: I alsotraied changing the NAS-ID as suggested in another thread - that did not seem to make any difference 10.10.10.11 did not work with either NAS ID while 10.10.10.10 worked with either Thanks for the tips - I will cross my fingers it is a firewall setting that is installed by default in openSUSE 11.1

2 2

TLS Session Cache
by Fernando 09 Mar '09

09 Mar '09

Hi all, Does anybody know how to enable TLS Session Cache? To use the EAP-TLS fast re-authentication. Thanks, Fernando.

3 5

eap-tls configuration not running...
by fabien.crettaz＠novelis.com 09 Mar '09

09 Mar '09

Hello I've got a problem with my eap-tls configuration : the server is accepting the device ( rad_check_password: Auth-Type = Accept, accepting the user), but it doesn't connect to the to access-point (HP Procurve). The server is a virtual Suse linux enterprise and the client is windows XP sp 3. Any help would be great.... Here is the output on the server: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients Using deprecated clients file. Support for this will go away soon. read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/sslcert/CAkey.pem" tls: certificate_file = "/sslcert/sierrerad10.pem" tls: CA_file = "/sslcert/CAcrt.pem" tls: private_key_password = "novelis" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "/etc/passwd" unix: shadow = "(null)" unix: group = "/etc/group" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.166.42.30:1024, id=1, length=159 User-Name = "sierre08015" NAS-IP-Address = 10.166.42.30 NAS-Port = 1 Called-Station-Id = "00-14-C2-BB-FF-70:test" Calling-Station-Id = "00-1F-3C-13-1A-1F" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11g" EAP-Message = 0x02010010017369657272653038303135 Message-Authenticator = 0x4cc4a961e5aae9b990d400eab9ec0a8e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_eap: EAP packet type response id 1 length 16 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry sierre08015 at line 97 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user Sending Access-Accept of id 1 to 10.166.42.30 port 1024 Finished request 0 Going to the next request The eap.conf file : # -*- text -*- # # Whatever you do, do NOT set 'Auth-Type := EAP'. The server # is smart enough to figure this out on its own. The most # common side effect of setting 'Auth-Type := EAP' is that the # users then cannot use ANY other authentication method. # # $Id: eap.conf,v 1.4.4.1 2006/01/04 14:29:29 nbk Exp $ # eap { # Invoke the default supported EAP type when # EAP-Identity response is received. # # The incoming EAP messages DO NOT specify which EAP # type they will be using, so it MUST be set here. # # For now, only one default EAP type may be used at a time. # # If the EAP-Type attribute is set by another module, # then that EAP type takes precedence over the # default type configured here. # # default_eap_type = md5 default_eap_type = tls # A list is maintained to correlate EAP-Response # packets with EAP-Request packets. After a # configurable length of time, entries in the list # expire, and are deleted. # timer_expire = 60 # There are many EAP types, but the server has support # for only a limited subset. If the server receives # a request for an EAP type it does not support, then # it normally rejects the request. By setting this # configuration to "yes", you can tell the server to # instead keep processing the request. Another module # MUST then be configured to proxy the request to # another RADIUS server which supports that EAP type. # # If another module is NOT configured to handle the # request, then the request will still end up being # rejected. ignore_unknown_eap_types = no # Cisco AP1230B firmware 12.2(13)JA1 has a bug. When given # a User-Name attribute in an Access-Accept, it copies one # more byte than it should. # # We can work around it by configurably adding an extra # zero byte. cisco_accounting_username_bug = no # Supported EAP-types # # We do NOT recommend using EAP-MD5 authentication # for wireless connections. It is insecure, and does # not provide for dynamic WEP keys. # md5 { } # Cisco LEAP # # We do not recommend using LEAP in new deployments. See: # http://www.securiteam.com/tools/5TP012ACKE.html # # Cisco LEAP uses the MS-CHAP algorithm (but not # the MS-CHAP attributes) to perform it's authentication. # # As a result, LEAP *requires* access to the plain-text # User-Password, or the NT-Password attributes. # 'System' authentication is impossible with LEAP. # leap { } # Generic Token Card. # # Currently, this is only permitted inside of EAP-TTLS, # or EAP-PEAP. The module "challenges" the user with # text, and the response from the user is taken to be # the User-Password. # # Proxying the tunneled EAP-GTC session is a bad idea, # the users password will go over the wire in plain-text, # for anyone to see. # gtc { # The default challenge, which many clients # ignore.. #challenge = "Password: " # The plain-text response which comes back # is put into a User-Password attribute, # and passed to another module for # authentication. This allows the EAP-GTC # response to be checked against plain-text, # or crypt'd passwords. # # If you say "Local" instead of "PAP", then # the module will look for a User-Password # configured for the request, and do the # authentication itself. # auth_type = PAP } ## EAP-TLS # # To generate ctest certificates, run the script # # ../scripts/certs.sh # # The documents on http://www.freeradius.org/doc # are old, but may be helpful. # # See also: # # http://www.dslreports.com/forum/remark,9286052~mode=flat # tls { private_key_password = novelis # private_key_file = ${raddbdir}/certs/cert-srv.pem private_key_file = /sslcert/CAkey.pem # If Private key & Certificate are located in # the same file, then private_key_file & # certificate_file must contain the same file # name. # certificate_file = ${raddbdir}/certs/cert-srv.pem certificate_file = /sslcert/sierrerad10.pem # Trusted Root CA list # CA_file = ${raddbdir}/certs/demoCA/cacert.pem CA_file = /sslcert/CAcrt.pem # CA_path = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random # # This can never exceed the size of a RADIUS # packet (4096 bytes), and is preferably half # that, to accomodate other attributes in # RADIUS packet. On most APs the MAX packet # length is configured between 1500 - 1600 # In these cases, fragment size should be # 1024 or less. # fragment_size = 1024 # include_length is a flag which is # by default set to yes If set to # yes, Total Length of the message is # included in EVERY packet we send. # If set to no, Total Length of the # message is included ONLY in the # First packet of a fragment series. # include_length = yes # Check the Certificate Revocation List # # 1) Copy CA certificates and CRLs to same directory. # 2) Execute 'c_rehash <CA certs&CRLs Directory>'. # 'c_rehash' is OpenSSL's command. # 3) Add 'CA_path=<CA certs&CRLs directory>' # to radiusd.conf's tls section. # 4) uncomment the line below. # 5) Restart radiusd # check_crl = yes # # If check_cert_cn is set, the value will # be xlat'ed and checked against the CN # in the client certificate. If the values # do not match, the certificate verification # will fail rejecting the user. # # check_cert_cn = %{User-Name} } # # This takes no configuration. # # Note that it is the EAP MS-CHAPv2 sub-module, not # the main 'mschap' module. # # Note also that in order for this sub-module to work, # the main 'mschap' module MUST ALSO be configured. # # This module is the *Microsoft* implementation of MS-CHAPv2 # in EAP. There is another (incompatible) implementation # of MS-CHAPv2 in EAP by Cisco, which FreeRADIUS does not # currently support. # mschapv2 { } } NOVELIS Fabien Crettaz IT System and Infrastructure Novelis Automotive, Painted & Specialities Novelis Switzerland SA CH - 3960 Sierre, Switzerland phone: +41 (0)27 457 7164 fax: +41 (0)27 457 7105 e-mail: fabien.crettaz(a)novelis.com http://www.novelis.ch P Please consider the environment before printing this email.

4 6

stop old open session and star new..
by Alexandre J. Correa - Onda Internet 09 Mar '09

09 Mar '09

Hello, How i can solve this problem: sometimes, some users connections stay "locked" on radius.. and with, Simutaneous-Use resulting = 1 ... Fri Mar 6 20:29:11 2009 : Auth: Multiple logins (max 1) [MPP attempt]: [alines] (from client Orbit port 256018 cli xxxxxxxxxxxxxxx) Fri Mar 6 20:29:11 2009 : Auth: Multiple logins (max 1) [MPP attempt]: [alines] (from client Orbit port 256018 cli xxxxxxxxxxxxxxx) Fri Mar 6 20:29:12 2009 : Auth: Multiple logins (max 1) [MPP attempt]: [cacildof] (from client Orbit port 256019 cli xxxxxxxxxxxxxxxx) Fri Mar 6 20:29:12 2009 : Auth: Multiple logins (max 1) [MPP attempt]: [cacildof] (from client Orbit port 256019 cli xxxxxxxxxxxxxxxx) Fri Mar 6 20:29:17 2009 : Auth: Multiple logins (max 1) [MPP attempt]: [arnaldo] (from client Orbit port 256021 cli xxxxxxxxxxxxxxx) Fri Mar 6 20:29:17 2009 : Auth: Multiple logins (max 1) [MPP attempt]: [arnaldo] (from client Orbit port 256021 cli xxxxxxxxxxxxxxxx) Fri Mar 6 20:29:17 2009 : Auth: Multiple logins (max 1) [MPP attempt]: [vanessam] (from client Orbit port 256020 cli xxxxxxxxxxxxxxx) how to disconnect previous session and create a new ? -- Sds. Alexandre Jeronimo Correa Onda Internet www.onda.net.br Linux User ID #142329 UNOTEL S/A - http://www.unotel.com.br

2 1

How to distinguish good or bad user using unlang and passwd module?
by bastardinho69 08 Mar '09

08 Mar '09

Hi, I am using a passwd module to authorize users. First passwd module checks cisco_users file (format = "*User-Name:Cleartext-Password") and then passwd module must check cisco_groups file (format = "~Cisco-Group:*,User-Name"). However when passwd module checks the cisco_user file, it returns status "ok" even when user password (in request packet) doesnt match with cisco_user file. So i am able to distinguish users only by their User-Name, but i need to check their passwords as well. I cannot figure out how to write that in my authorize section. Later, if username and password matches an entry in my cisco_user file i will call cisco_group file and find to which group that user belongs to assign the right services. currently my code looks like this: passwd cisco_user_module { #filename = /etc/group filename = /usr/local/etc/raddb/cisco_users #format = "=Etc-Group-Name:::*,User-Name" format = "*User-Name:Cleartext-Password" hashsize = 100 ignorenislike = yes allowmultiplekeys = yes delimiter = ":" } authorize { cisco_user_module if(notfound){ update control{ Auth-Type := Reject } update reply{ Reply-Message := "Access denied, sorry!" } } elseif(ok){ cisco_group_module } } I hope u guys can help me, i will appreciate ;) Thanks.

2 2

radiusd server does not respond to radtest from another host
by mbhorner＠aol.com 08 Mar '09

08 Mar '09

Hi All, I installed FreeRADIUS Version 2.1.1, for host i686-suse-linux-gnu on OpenSuse 11.1 using Yast. I am having problems testing the radius server 10.10.10.11 from an external host 10.10.10.10 using radtest. Background: I configured clients.conf, users and radiusd.conf. After changing permissions on the /etc/radb/certs directory I was able to start "radiusd -X" without any?reported errors, warnings. I then successfully tested locally using radtest in another terminal window?on the radius server (IP = 10.10.10.11) linux-au5f:/home/michael # radtest pencil richard6 10.10.10.11 0 testing123 Sending Access-Request of id 63 to 10.10.10.11 port 1812 ?User-Name = "pencil" ?User-Password = "richard6" ?NAS-IP-Address = 127.0.0.2 ?NAS-Port = 0 rad_recv: Access-Accept packet from host 10.10.10.11 port 1812, id=63, length=35 ?Reply-Message = "Hello, pencil" Next I tried testing radiusd using radtest from a 2nd host (10.10.10.10), which I had added previously added to the clients.conf (Note I can successfully ping the radius server 10.10.10.11 from this 2nd host 10.10.10.10).?But, I get no response from radius acc-request on either the radiusd terminal window or the radtest terminal window. Below is the clients.conf definitiion ?client dellM65 { ?ipaddr = 10.10.10.10 ?require_message_authenticator = no ?secret = "testing123" ?nastype = "other" ?} I did a capture with Wireshark and I can see the radius request, but no responses. Have I missed some part of the Freeradius config to recognize the external radtest host? I have attached some output to hopefully answer anything not described above. Attached is the radiusd -X output FreeRADIUS Version 2.1.1, for host i686-suse-linux-gnu, built on Dec? 3 2008 at 10:47:13 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/sql/mysql/counter.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { ?prefix = "/usr" ?localstatedir = "/var" ?logdir = "/var/log/radius" ?libdir = "/usr/lib/freeradius" ?radacctdir = "/var/log/radius/radacct" ?hostname_lookups = no ?max_request_time = 30 ?cleanup_delay = 5 ?max_requests = 1024 ?allow_core_dumps = no ?pidfile = "/var/run/radiusd/radiusd.pid" ?checkrad = "/usr/sbin/checkrad" ?debug_level = 0 ?proxy_requests = yes ?log { ?stripped_names = yes ?auth = yes ?auth_badpass = yes ?auth_goodpass = yes ?} ?security { ?max_attributes = 200 ?reject_delay = 1 ?status_server = yes ?} } ?client localhost { ?ipaddr = 127.0.0.1 ?require_message_authenticator = no ?secret = "testing123" ?nastype = "other" ?} ?client 10.10.10.11 { ?require_message_authenticator = no ?secret = "testing123" ?shortname = "liv1" ?} ?client dellM65 { ?ipaddr = 10.10.10.10 ?require_message_authenticator = no ?secret = "testing123" ?nastype = "other" ?} radiusd: #### Loading Realms and Home Servers #### ?proxy server { ?retry_delay = 5 ?retry_count = 3 ?default_fallback = no ?dead_time = 120 ?wake_all_if_all_dead = no ?} ?home_server localhost { ?ipaddr = 127.0.0.1 ?port = 1812 ?type = "auth" ?secret = "testing123" ?response_window = 20 ?max_outstanding = 65536 ?zombie_period = 40 ?status_check = "status-server" ?ping_interval = 30 ?check_interval = 30 ?num_answers_to_alive = 3 ?num_pings_to_alive = 3 ?revive_interval = 120 ?status_check_timeout = 4 ?} ?home_server_pool my_auth_failover { ?type = fail-over ?home_server = localhost ?} ?realm example.com { ?auth_pool = my_auth_failover ?} ?realm LOCAL { ?} radiusd: #### Instantiating modules #### ?instantiate { ?Module: Linked to module rlm_exec ?Module: Instantiating exec ? exec { ?wait = no ?input_pairs = "request" ?shell_escape = yes ? } ?Module: Linked to module rlm_expr ?Module: Instantiating expr ?Module: Linked to module rlm_expiration ?Module: Instantiating expiration ? expiration { ?reply-message = "Password Has Expired? " ? } ?Module: Linked to module rlm_logintime ?Module: Instantiating logintime ? logintime { ?reply-message = "You are calling outside your allowed timespan? " ?minimum-timeout = 60 ? } ?} radiusd: #### Loading Virtual Servers #### server inner-tunnel { ?modules { ?Module: Checking authenticate {...} for more modules to load ?Module: Linked to module rlm_pap ?Module: Instantiating pap ? pap { ?encryption_scheme = "auto" ?auto_header = no ? } ?Module: Linked to module rlm_chap ?Module: Instantiating chap ?Module: Linked to module rlm_mschap ?Module: Instantiating mschap ? mschap { ?use_mppe = yes ?require_encryption = no ?require_strong = no ?with_ntdomain_hack = no ? } ?Module: Linked to module rlm_unix ?Module: Instantiating unix ? unix { ?radwtmp = "/var/log/radius/radwtmp" ? } ?Module: Linked to module rlm_eap ?Module: Instantiating eap ? eap { ?default_eap_type = "md5" ?timer_expire = 60 ?ignore_unknown_eap_types = no ?cisco_accounting_username_bug = no ?max_sessions = 2048 ? } ?Module: Linked to sub-module rlm_eap_md5 ?Module: Instantiating eap-md5 ?Module: Linked to sub-module rlm_eap_leap ?Module: Instantiating eap-leap ?Module: Linked to sub-module rlm_eap_gtc ?Module: Instantiating eap-gtc ?? gtc { ?challenge = "Password: " ?auth_type = "PAP" ?? } ?Module: Linked to sub-module rlm_eap_tls ?Module: Instantiating eap-tls ?? tls { ?rsa_key_exchange = no ?dh_key_exchange = yes ?rsa_key_length = 512 ?dh_key_length = 512 ?verify_depth = 0 ?pem_file_type = yes ?private_key_file = "/etc/raddb/certs/server.pem" ?certificate_file = "/etc/raddb/certs/server.pem" ?CA_file = "/etc/raddb/certs/ca.pem" ?private_key_password = "whatever" ?dh_file = "/etc/raddb/certs/dh" ?random_file = "/etc/raddb/certs/random" ?fragment_size = 1024 ?include_length = yes ?check_crl = no ?cipher_list = "DEFAULT" ?make_cert_command = "/etc/raddb/certs/bootstrap" ??? cache { ?enable = no ?lifetime = 24 ?max_entries = 255 ??? } ?? } ?Module: Linked to sub-module rlm_eap_ttls ?Module: Instantiating eap-ttls ?? ttls { ?default_eap_type = "md5" ?copy_request_to_tunnel = no ?use_tunneled_reply = no ?virtual_server = "inner-tunnel" ?? } ?Module: Linked to sub-module rlm_eap_peap ?Module: Instantiating eap-peap ?? peap { ?default_eap_type = "mschapv2" ?copy_request_to_tunnel = no ?use_tunneled_reply = no ?proxy_tunneled_request_as_eap = yes ?virtual_server = "inner-tunnel" ?? } ?Module: Linked to sub-module rlm_eap_mschapv2 ?Module: Instantiating eap-mschapv2 ?? mschapv2 { ?with_ntdomain_hack = no ?? } ?Module: Checking authorize {...} for more modules to load ?Module: Linked to module rlm_realm ?Module: Instantiating suffix ? realm suffix { ?format = "suffix" ?delimiter = "@" ?ignore_default = no ?ignore_null = no ? } ?Module: Linked to module rlm_files ?Module: Instantiating files ? files { ?usersfile = "/etc/raddb/users" ?acctusersfile = "/etc/raddb/acct_users" ?preproxy_usersfile = "/etc/raddb/preproxy_users" ?compat = "no" ? } ?Module: Checking session {...} for more modules to load ?Module: Linked to module rlm_radutmp ?Module: Instantiating radutmp ? radutmp { ?filename = "/var/log/radius/radutmp" ?username = "%{User-Name}" ?case_sensitive = yes ?check_with_nas = yes ?perm = 384 ?callerid = yes ? } ?Module: Checking post-proxy {...} for more modules to load ?Module: Checking post-auth {...} for more modules to load ?Module: Linked to module rlm_attr_filter ?Module: Instantiating attr_filter.access_reject ? attr_filter attr_filter.access_reject { ?attrsfile = "/etc/raddb/attrs.access_reject" ?key = "%{User-Name}" ? } ?} } ?modules { ?Module: Checking authenticate {...} for more modules to load ?Module: Checking authorize {...} for more modules to load ?Module: Linked to module rlm_preprocess ?Module: Instantiating preprocess ? preprocess { ?huntgroups = "/etc/raddb/huntgroups" ?hints = "/etc/raddb/hints" ?with_ascend_hack = no ?ascend_channels_per_line = 23 ?with_ntdomain_hack = no ?with_specialix_jetstream_hack = no ?with_cisco_vsa_hack = no ?with_alvarion_vsa_hack = no ? } ?Module: Checking preacct {...} for more modules to load ?Module: Linked to module rlm_acct_unique ?Module: Instantiating acct_unique ? acct_unique { ?key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" ? } ?Module: Checking accounting {...} for more modules to load ?Module: Linked to module rlm_detail ?Module: Instantiating detail ? detail { ?detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" ?header = "%t" ?detailperm = 384 ?dirperm = 493 ?locking = no ?log_packet_header = no ? } ?Module: Instantiating attr_filter.accounting_response ? attr_filter attr_filter.accounting_response { ?attrsfile = "/etc/raddb/attrs.accounting_response" ?key = "%{User-Name}" ? } ?Module: Checking session {...} for more modules to load ?Module: Checking post-proxy {...} for more modules to load ?Module: Checking post-auth {...} for more modules to load ?} radiusd: #### Opening IP addresses and Ports #### listen { ?type = "auth" ?ipaddr = 10.10.10.11 ?port = 1812 } listen { ?type = "acct" ?ipaddr = * ?port = 0 } Listening on authentication address 10.10.10.11 port 1812 Listening on accounting address * port 1813 Listening on proxy address 10.10.10.11 port 1814 Ready to process requests. Attached is wireshark capture on the radius server (10.10.10.11) showing the packet arrives from the rad test client (10.10.10.10) No.???? Time??????? Source??????????????? Destination?????????? Protocol Info ????? 2 2.997586??? 10.10.10.10?????????? 10.10.10.11?????????? RADIUS?? Access-Request(1) (id=241, l=58), Duplicate Request ID:241 Frame 2 (100 bytes on wire, 100 bytes captured) ??? Arrival Time: Mar? 7, 2009 10:02:20.966147000 ??? [Time delta from previous captured frame: 2.997586000 seconds] ??? [Time delta from previous displayed frame: 2.997586000 seconds] ??? [Time since reference or first frame: 2.997586000 seconds] ??? Frame Number: 2 ??? Frame Length: 100 bytes ??? Capture Length: 100 bytes ??? [Frame is marked: False] ??? [Protocols in frame: eth:ip:udp:radius] ??? [Coloring Rule Name: UDP] ??? [Coloring Rule String: udp] Ethernet II, Src: 3com_ac:0a:0c (00:50:da:ac:0a:0c), Dst: DellPcba_78:86:32 (00:0d:56:78:86:32) ??? Destination: DellPcba_78:86:32 (00:0d:56:78:86:32) ??????? Address: DellPcba_78:86:32 (00:0d:56:78:86:32) ??????? .... ...0 .... .... .... .... = IG bit: Individual address (unicast) ??????? .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) ??? Source: 3com_ac:0a:0c (00:50:da:ac:0a:0c) ??????? Address: 3com_ac:0a:0c (00:50:da:ac:0a:0c) ??????? .... ...0 .... .... .... .... = IG bit: Individual address (unicast) ??????? .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) ??? Type: IP (0x0800) Internet Protocol, Src: 10.10.10.10 (10.10.10.10), Dst: 10.10.10.11 (10.10.10.11) ??? Version: 4 ??? Header length: 20 bytes ??? Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) ??????? 0000 00.. = Differentiated Services Codepoint: Default (0x00) ??????? .... ..0. = ECN-Capable Transport (ECT): 0 ??????? .... ...0 = ECN-CE: 0 ??? Total Length: 86 ??? Identification: 0x0000 (0) ??? Flags: 0x04 (Don't Fragment) ??????? 0... = Reserved bit: Not set ??????? .1.. = Don't fragment: Set ??????? ..0. = More fragments: Not set ??? Fragment offset: 0 ??? Time to live: 64 ??? Protocol: UDP (0x11) ??? Header checksum: 0x126f [correct] ??????? [Good: True] ??????? [Bad : False] ??? Source: 10.10.10.10 (10.10.10.10) ??? Destination: 10.10.10.11 (10.10.10.11) User Datagram Protocol, Src Port: 47970 (47970), Dst Port: radius (1812) ??? Source port: 47970 (47970) ??? Destination port: radius (1812) ??? Length: 66 ??? Checksum: 0xc264 [correct] ??????? [Good Checksum: True] ??????? [Bad Checksum: False] Radius Protocol ??? Code: Access-Request (1) ??? Packet identifier: 0xf1 (241) ??? Length: 58 ??? Authenticator: DF4A578FEB08708AEFEA3236CA37650C ??? [Duplicate Request: 241] ??? Attribute Value Pairs ??????? AVP: l=8? t=User-Name(1): pencil ??????????? User-Name: pencil ??????? AVP: l=18? t=User-Password(2): Encrypted ??????????? User-Password: \267\017U\227\320\216\305\y\373\314\377\306\316\350\255 ??????? AVP: l=6? t=NAS-IP-Address(4): 127.0.0.2 ??????????? NAS-IP-Address: 127.0.0.2 (127.0.0.2) ??????? AVP: l=6? t=NAS-Port(5): 0 ??????????? NAS-Port: 0

4 5

Realms and Accounting
by liran tal 08 Mar '09

08 Mar '09

Hey, Regarding realms handled in the local server (mysql) and accounting... I have defined realms in the users file such as: DEFAULT Realm == "example.com", Autz-Type := SQL_EXAMPLE and in radiusd.conf I add in authorize { } Autz-Type SQL_EXAMPLE { sql_example } and as expected authentication works just fine by looking up in the current database. To enable accounting for both realms I have done the same thing in radiusd.conf for the accounting { } module: Acct-Type SQL_EXAMPLE { sql_example } Although this is defined no accounting records are saved in the database. I am wondering if I'm missing something else like adding the Acct-Type to the users file too, such as: DEFAULT Realm == "example.com", Autz-Type := SQL_EXAMPLE, Acct-Type := SQL_HOTELNOVA Regards,

2 4

Re: failed to receive Accounting Response
by "Николай Г. Петров" 08 Mar '09

08 Mar '09

When freeradius group include in your codes support full accounting, include commands accounting, how long? Means this is would be mutch better for all IT spacialists in the world, wich implements freeradius in your net infrastrucure! Thanks!!

2 1

Re: failed to receive Accounting Response
by "Николай Г. Петров" 07 Mar '09

07 Mar '09

Now I present fully situation on a trouble process (radiusd -X; cisco debug accounting; tcpdump vvv ports 1812-1814) On radius server firewall is absent, this is the open system. On cisco like this: access-list 1 permit 192.168.255.0 0.0.0.255 access-list 1 deny any 1) User connect to the cisco 1.1) radiusd -X rad_recv: Access-Request packet from host 192.168.255.10 port 1812, id=140, length=77 NAS-IP-Address = 192.168.255.10 NAS-Port = 2 NAS-Port-Type = Virtual User-Name = "userA" Calling-Station-Id = "192.168.255.116" User-Password = "passwA" +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "userA", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [files] users: Matched entry userA at line 7 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "passwA" [pap] Using clear text password "passwA" [pap] User authenticated successfully ++[pap] returns ok Login OK: [userA/passwA] (from client csv port 2 cli 192.168.255.116) +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 140 to 192.168.255.10 port 1812 Service-Type = NAS-Prompt-User Cisco-AVPair = "shell:priv-lvl=1" Finished request 6. Going to the next request Waking up in 4.9 seconds. rad_recv: Accounting-Request packet from host 192.168.255.10 port 1813, id=141, length=93 NAS-IP-Address = 192.168.255.10 NAS-Port = 2 NAS-Port-Type = Virtual User-Name = "userA" Calling-Station-Id = "192.168.255.116" Acct-Status-Type = Start Acct-Authentic = RADIUS Service-Type = NAS-Prompt-User Acct-Session-Id = "0000012B" Acct-Delay-Time = 0 +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 2,Client-IP-Address = 192.168.255.10,NAS-IP-Address = 192.168.255.10,Acct-Session-Id = "0000012B",User-Name = "userA"' [acct_unique] Acct-Unique-Session-ID = "76873ebbdef2d2d8". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "userA", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting {...} [detail] expand: /var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/radacct/192.168.255.10/detail-20090308 [detail] /var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radacct/192.168.255.10/detail-20090308 [detail] expand: %t -> Sun Mar 8 00:20:17 2009 ++[detail] returns ok rlm_counter: We only run on Accounting-Stop packets. ++[daily] returns noop [radutmp] expand: /var/log/radutmp -> /var/log/radutmp [radutmp] expand: %{User-Name} -> userA ++[radutmp] returns ok [sradutmp] expand: /var/log/sradutmp -> /var/log/sradutmp [sradutmp] expand: %{User-Name} -> userA ++[sradutmp] returns ok [attr_filter.accounting_response] expand: %{User-Name} -> userA attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 141 to 192.168.255.10 port 1813 Finished request 7. Cleaning up request 7 ID 141 with timestamp +144 Going to the next request Waking up in 4.9 seconds. Cleaning up request 6 ID 140 with timestamp +144 Ready to process requests. 1.2) cisco debug log 002143: Mar 7 21:20:11: AAA: parse name=tty2 idb type=-1 tty=-1 002144: Mar 7 21:20:11: AAA: name=tty2 flags=0x11 type=5 shelf=0 slot=0 adapter=0 port=2 channel=0 002145: Mar 7 21:20:11: AAA/MEMORY: create_user (0x80D19744) user='' ruser='' port='tty2' rem_addr='192.168.255.116' authen_type=ASCII service=LOGIN priv=1 002146: Mar 7 21:20:19: tty2 AAA/AUTHOR/EXEC (4225439048): Port='tty2' list='' service=EXEC 002147: Mar 7 21:20:19: AAA/AUTHOR/EXEC: tty2 (4225439048) user='userA' 002148: Mar 7 21:20:19: tty2 AAA/AUTHOR/EXEC (4225439048): send AV service=shell 002149: Mar 7 21:20:19: tty2 AAA/AUTHOR/EXEC (4225439048): send AV cmd* 002150: Mar 7 21:20:19: tty2 AAA/AUTHOR/EXEC (4225439048): found list "default" 002151: Mar 7 21:20:19: tty2 AAA/AUTHOR/EXEC (4225439048): Method=radius (radius) 002152: Mar 7 21:20:19: AAA/AUTHOR (4225439048): Post authorization status = PASS_ADD 002153: Mar 7 21:20:19: AAA/AUTHOR/EXEC: Processing AV service=shell 002154: Mar 7 21:20:19: AAA/AUTHOR/EXEC: Processing AV cmd* 002155: Mar 7 21:20:19: AAA/AUTHOR/EXEC: Processing AV priv-lvl=1 1.3) tcpdump 00:20:17.595207 IP (tos 0x0, ttl 255, id 39695, offset 0, flags [none], proto UDP (17), length 105) 192.168.255.10.1812 > 192.168.255.2.1812: RADIUS, length: 77 Access Request (1), id: 0x8c, Authenticator: 61af38df3d49196d536ade8e46774faa NAS IP Address Attribute (4), length: 6, Value: 192.168.255.10 0x0000: c0a8 ff0a NAS Port Attribute (5), length: 6, Value: 2 0x0000: 0000 0002 NAS Port Type Attribute (61), length: 6, Value: Virtual 0x0000: 0000 0005 Username Attribute (1), length: 4, Value: userA 0x0000: 7532 Calling Station Attribute (31), length: 17, Value: [|radius] 0x0000: 3139 322e 3136 382e 3235 [|radius] 00:20:17.595632 IP (tos 0x0, ttl 64, id 40797, offset 0, flags [none], proto UDP (17), length 78) 192.168.255.2.1812 > 192.168.255.10.1812: [bad udp cksum 5a95!] RADIUS, length: 50 Access Accept (2), id: 0x8c, Authenticator: 32d46241a0413e2a2970fff9fbf1a010 Service Type Attribute (6), length: 6, Value: NAS Prompt 0x0000: 0000 0007 Vendor Specific Attribute (26), length: 24, Value: Vendor: Cisco (9) Vendor Attribute: 1, Length: 16, Value: shell:priv-lvl=1 0x0000: 0000 0009 0112 7368 656c 6c3a 7072 6976 0x0010: 2d6c 766c 3d31 00:20:17.613428 IP (tos 0x0, ttl 255, id 39697, offset 0, flags [none], proto UDP (17), length 121) 192.168.255.10.1813 > 192.168.255.2.1813: RADIUS, length: 93 Accounting Request (4), id: 0x8d, Authenticator: 78efee9d88e11dcafaaf188213873e56 NAS IP Address Attribute (4), length: 6, Value: 192.168.255.10 0x0000: c0a8 ff0a NAS Port Attribute (5), length: 6, Value: 2 0x0000: 0000 0002 NAS Port Type Attribute (61), length: 6, Value: Virtual 0x0000: 0000 0005 Username Attribute (1), length: 4, Value: userA 0x0000: 7532 Calling Station Attribute (31), length: 17, Value: [|radius] 0x0000: 3139 322e 3136 382e 3235 [|radius] 00:20:17.614190 IP (tos 0x0, ttl 64, id 40799, offset 0, flags [none], proto UDP (17), length 48) 192.168.255.2.1813 > 192.168.255.10.1813: [bad udp cksum 7518!] RADIUS, length: 20 Accounting Response (5), id: 0x8d, Authenticator: 59edaa59beed3b78b57a3e4c9b6146b5 2.) User run some command 2.1) radiusd -X (nothing) 2.2) cisco debug 002156: Mar 7 21:22:59: AAA/ACCT/CMD: User userA, Port tty2, Priv 1: "ping 192.168.101.147 <cr>" 002157: Mar 7 21:22:59: AAA/ACCT/CMD: Found list "default" 002158: Mar 7 21:22:59: AAA/ACCT: user userA, acct type 3 (2103679520): Method=radius (radius) 2.3) tcpdump (nothing) 3) User logoff from cisco 3.1) radiusd -X rad_recv: Accounting-Request packet from host 192.168.255.10 port 1813, id=142, length=105 NAS-IP-Address = 192.168.255.10 NAS-Port = 2 NAS-Port-Type = Virtual User-Name = "userA" Calling-Station-Id = "192.168.255.116" Acct-Status-Type = Stop Acct-Authentic = RADIUS Service-Type = NAS-Prompt-User Acct-Session-Id = "0000012B" Acct-Terminate-Cause = User-Request Acct-Session-Time = 286 Acct-Delay-Time = 0 +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 2,Client-IP-Address = 192.168.255.10,NAS-IP-Address = 192.168.255.10,Acct-Session-Id = "0000012B",User-Name = "userA"' [acct_unique] Acct-Unique-Session-ID = "76873ebbdef2d2d8". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "userA", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting {...} [detail] expand: /var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/radacct/192.168.255.10/detail-20090308 [detail] /var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radacct/192.168.255.10/detail-20090308 [detail] expand: %t -> Sun Mar 8 00:25:03 2009 ++[detail] returns ok rlm_counter: Packet Unique ID = '76873ebbdef2d2d8' rlm_counter: This Service-Type is not allowed. Returning NOOP. ++[daily] returns noop [radutmp] expand: /var/log/radutmp -> /var/log/radutmp [radutmp] expand: %{User-Name} -> userA ++[radutmp] returns ok [sradutmp] expand: /var/log/sradutmp -> /var/log/sradutmp [sradutmp] expand: %{User-Name} -> userA ++[sradutmp] returns ok [attr_filter.accounting_response] expand: %{User-Name} -> userA attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 142 to 192.168.255.10 port 1813 Finished request 8. Cleaning up request 8 ID 142 with timestamp +430 Going to the next request Ready to process requests. 3.2) cisco debug 002159: Mar 7 21:25:05: AAA/ACCT/ACCT_DISC: Found list "default" 002160: Mar 7 21:25:05: tty2 AAA/DISC: 1/"User Request" 002161: Mar 7 21:25:05: AAA/ACCT/ACCT_DISC: Found list "default" 002162: Mar 7 21:25:05: tty2 AAA/DISC/EXT: 1020/"User Request" 002163: Mar 7 21:25:05: AAA/ACCT/ACCT_DISC: Found list "default" 002164: Mar 7 21:25:05: tty2 AAA/DISC: 9/"NAS Error" 002165: Mar 7 21:25:05: AAA/ACCT/ACCT_DISC: Found list "default" 002166: Mar 7 21:25:05: tty2 AAA/DISC/EXT: 1002/"Unknown" 002167: Mar 7 21:25:05: AAA/ACCT: no attribute "elapsed_time" to replace, adding it 002168: Mar 7 21:25:05: AAA/ACCT/EXEC/STOP: cannot retrieve modem speed 3.3) tcpdump 00:25:03.354629 IP (tos 0x0, ttl 255, id 40103, offset 0, flags [none], proto UDP (17), length 133) 192.168.255.10.1813 > 192.168.255.2.1813: RADIUS, length: 105 Accounting Request (4), id: 0x8e, Authenticator: 7e7d0e10eedbb36b1c4576db6cb7ed55 NAS IP Address Attribute (4), length: 6, Value: 192.168.255.10 0x0000: c0a8 ff0a NAS Port Attribute (5), length: 6, Value: 2 0x0000: 0000 0002 NAS Port Type Attribute (61), length: 6, Value: Virtual 0x0000: 0000 0005 Username Attribute (1), length: 4, Value: userA 0x0000: 7532 Calling Station Attribute (31), length: 17, Value: [|radius] 0x0000: 3139 322e 3136 382e 3235 [|radius] 00:25:03.355476 IP (tos 0x0, ttl 64, id 40963, offset 0, flags [none], proto UDP (17), length 48) 192.168.255.2.1813 > 192.168.255.10.1813: [bad udp cksum a2ee!] RADIUS, length: 20 Accounting Response (5), id: 0x8e, Authenticator: e433717ece1d6709b80331d05e7d2b31 PS:Sorry for my bad english and thanks for a privious answers!

2 1