- Freeradius-Users - lists.freeradius.org

RADIUS Session Closing
by "Ferreira, André" 09 Jun '05

09 Jun '05

Is there or which attribute is used to tell RADIUS to close all connections from the NASses? Thus something saying, close global...etc. Apart from restarting the RADIUS daemon. Thanx. André Ferreira

1 0

segmentation fault
by yuniva wati 09 Jun '05

09 Jun '05

hello freeradius users, I have configure my freeradius for accounting but when I run it using : [root@localhost raddb]# /usr/local/radius/sbin/radiusd -sfxxyz -l stdout Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/radius/etc/raddb/proxy.conf Config: including file: /usr/local/radius/etc/raddb/clients.conf Config: including file: /usr/local/radius/etc/raddb/snmp.conf Config: including file: /usr/local/radius/etc/raddb/eap.conf Config: including file: /usr/local/radius/etc/raddb/sql.conf main: prefix = "/usr/local/radius" main: localstatedir = "/usr/local/radius/var" main: logdir = "/usr/local/radius/var/log/radius" main: libdir = "/usr/local/radius/lib" main: radacctdir = "/usr/local/radius/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/usr/local/radius/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/usr/local/radius/var/run/radiusd/radiusd.pid" main: user = "nobody" main: group = "nobody" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/radius/sbin/checkrad" main: proxy_requests = no proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/radius/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/radius/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/radius/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/radius/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/radius/etc/raddb/certs/root.pem" tls: private_key_password = "telkom" tls: dh_file = "/usr/local/radius/etc/raddb/certs/dh" tls: random_file = "/usr/local/radius/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/radius/etc/raddb/huntgroups" preprocess: hints = "/usr/local/radius/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/radius/etc/raddb/users" files: acctusersfile = "/usr/local/radius/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/radius/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded SQL sql: driver = "src/radiusd/src/modules/rlm_sql/drivers/rlm_sql_mysql" sql: server = "localhost" sql: port = "3306" sql: login = "root" sql: password = "telkom" sql: radius_db = "radius" sql: acct_table = "radacct" sql: acct_table2 = "radacct" sql: authcheck_table = "radcheck" sql: authreply_table = "radreply" sql: groupcheck_table = "radgroupcheck" sql: groupreply_table = "radgroupreply" sql: usergroup_table = "usergroup" sql: nas_table = "nas" sql: dict_table = "dictionary" sql: sqltrace = yes sql: sqltracefile = "/usr/local/radius/var/log/radius/sqltrace.sql" sql: readclients = yes sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{User-Name}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" sql: authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" sql: accounting_update_query = "UPDATE radacct ? SET FramedIPAddress = '%{Framed-IP-Address}', ? AcctSessionTime = '%{Acct-Session-Time}', ? AcctInputOctets = '%{Acct-Input-Octets}', ? AcctOutputOctets = '%{Acct-Output-Octets}' ? WHERE AcctSessionId = '%{Acct-Session-Id}' ? AND UserName = '%{SQL-User-Name}' ? AND NASIPAddress= '%{NAS-IP-Address}'" sql: accounting_update_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-Use-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0')" sql: accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0')" sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time}')" sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "SELECT COUNT(*) FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: postauth_table = "radpostauth" sql: postauth_query = "INSERT into radpostauth (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" segmentation fault that I want ask is : -Why I got that message and what part is wrong?? thanks for all of you. I hope anyone can help me __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

db model
by Thomas Huber 09 Jun '05

09 Jun '05

Hi, I am building the clients list from the nas table and experienced some problems: 1) There is not nas_query prepared int the configuration file. Would it be supported? 2) select * from nas; does not return the records in the right order. I think the clients list is built from the first four fields, which are: ID (ignored) | nasname=IP | shortname=Name | secret=something With the current table structure, the fourth field is Port and not secret. How should this be solved? Thomas

1 0

RADIUS Authentication
by "Ferreira, André" 09 Jun '05

09 Jun '05

If RADIUS receives and ACCESS-REQUEST packet, but RADIUS does not authenticate against its own database but an external server, does it also send an ACCESS-REQUEST to the external server? And does the external server send and ACCESS-ACCEPT with REPLY_MESSAGE information If authentication is successful? Thanx. André Ferreira

2 1

[Freeradius 1.0.3] failed to lilnk to module 'rlm_eap'
by Pete Flynt 09 Jun '05

09 Jun '05

Hi list, I've configure freeradius to compile with --confsysdir=/etc/ --disable-shared. When running radiusd -X -A Im getting this error line: radiusd.conf[9] Failed to link to module 'rlm_eap': /usr/local/lib/rlm_eap.a: invalid ELF header What does this mean? Pete _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

1 0

RE: How to? - use/configure winbind/ntlm_auth for Windows authentication
by Pete Flynt 09 Jun '05

09 Jun '05

Thanks for your solution. I think this will be helpful for some people. I'll try this on next opportunity. But does it provide Single-Sign-On possibility with windows credentials like PEAP MSCHAPv2? I've finally managed to get the ntlm_auth working. When one knows how to do it, it is very easy: On my fedora core 3 (with samba) I ran the authconfig tool, checked the "use winbind/use winbind for authentication" options, entered the domain info, joined the windows domain via net rpc and ntlm_auth worked at once! I did not have to touch samba config files. Regards, Pete >Subject: How to? - use/configure winbind/ntlm_auth for Windows >authentication >Date: Wed, 8 Jun 2005 15:00:10 -0400 > >I use LDAP. For each OU I want to authenticate I create an entry in >radiusd.conf > > > >ldap MyFirstOU { > > server = "your.server.dns.name" > > identity = "CN=LDAP VIEW,CN=Users,DC=acs,DC=ocad,DC=ca" > > password = ldapAccountPassword > > basedn = "ou=yourOU,dc=acs,dc=ocad,dc=ca" > > filter = >"(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})" > > start_tls = no > > tls_mode = no > > groupname_attribute = cn > > groupmembership_filter = >"(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=Gr >oupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))" > > ldap_connections_number = 5 > > timeout = 4 > > timelimit = 3 > > access_attr_used_for_allow = yes > > } > > > >authorize { > > MyFirstOU > > } > > > >Auth-Type LDAP { > > MyFirstOU > >} > > > >You need a user on the AD box called "LDAP VIEW" with a password of >"ldapAccountPassword". > > > >Works great for me. > _________________________________________________________________ FREE pop-up blocking with the new MSN Toolbar - get it now! http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/

1 0

Re: Authenticate/Attributes based on NAS-IP-Address
by Mike Lampson 09 Jun '05

09 Jun '05

> That link doesn't give me anything. Page Not Found. I've done a lot of > searching through the archives though and haven't really found anything > like this. Did you add the "tml" back into the URL? >> http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg16842.h >> tml _Mike

1 0

Hanging radiusd
by Doug Hardie 09 Jun '05

09 Jun '05

I am encountering a problem on 1 of my radius servers (not any of the others). Every so often it hangs and quits responding to requests. FreeBSD 5.3. ps shows a status of TLs which means its waiting for a lock. There is no way to kill the process and ktrace shows absolutely nothing over many requests that timeout. The only way to restart it is a reboot. I do know that one of the memory boards is likely to be defective. I suspect that this is the cause of the problem. FreeBSD reports less memory on that board that is marked on the board itself. I don't recall the exact numbers but its not a multiple of 2. I won't be on site till Friday so won't be able to put in new memory till then. Does my assumption appear valid?

2 1

Problems with LDAP
by alfonso celestino 08 Jun '05

08 Jun '05

Hello, first, excuseme for my english I have freeradius running with EAP and PEAP authentication very well, but i would like use Openldap like database, but when after i do the changes, and I restart the radius appears the error: segmetation fault These are my configurations: radiusd.conf File... ldap { server = "xxx.xxx.xxx.xxx" identity = "cn=redes,ou=admins,ou=radius,dc=mydomain,dc=com" password = secretpasswd basedn = "ou=users,ou=radius,dc=mydomain,dc=com" filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}})(objectclass=radiusprofile))" ssword_attribute = userPassword start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = "userPassword" timeout = 4 timelimit = 3 net_timeout = 1 } authorize{ preprocess auth_log chap mschap suffix ldap } authenticate { Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } Auth-Type LDAP { ldap } eap unix } users file ... DEFAULT Auth-Type := LDAP Fall-Through = 1 ... Here's error /usr/local/radius/sbin/run-radius -X -A + LD_LIBRARY_PATH=/usr/local/openssl/lib + LD_PRELOAD=/usr/local/openssl/lib/libcrypto.so + export LD_LIBRARY_PATH LD_PRELOAD + /usr/local/radius/sbin/radiusd -X -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/radius/etc/raddb/proxy.conf Config: including file: /usr/local/radius/etc/raddb/clients.conf Config: including file: /usr/local/radius/etc/raddb/snmp.conf Config: including file: /usr/local/radius/etc/raddb/eap.conf Config: including file: /usr/local/radius/etc/raddb/sql.conf main: prefix = "/usr/local/radius" main: localstatedir = "/usr/local/radius/var" main: logdir = "/usr/local/radius/var/log/radius" main: libdir = "/usr/local/radius/lib" main: radacctdir = "/usr/local/radius/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/radius/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/radius/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/radius/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/radius/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/radius/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) /usr/local/radius/sbin/run-radius: line 8: 910 Segmentation fault /usr/local/radius/sbin/radiusd $@ when I comment the next: #ldap #Auth-Type LDAP { # ldap # } the Freeradius server run correctly Thanks Saludos!!!! ___________________________________________________________ Do You Yahoo!? La mejor conexión a Internet y <b >2GB</b> extra a tu correo por $100 al mes. http://net.yahoo.com.mx

1 0

Re: Authenticate/Attributes based on NAS-IP-Address
by Mike Lampson 08 Jun '05

08 Jun '05

Nick, Extend the MySQL schema and change the SQL queries in sql.conf to do what you want. You could extend by HuntGroup, NAS-IP, Client-IP, whatever. See my previous post to this list archived here: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg16842.h tml Cheers, _Mike -----Original Message----- Message: 6 Date: Tue, 07 Jun 2005 19:20:28 -0700 From: N White <nwtech(a)tele-net.net> Subject: Re: Authenticate/Attributes based on NAS-IP-Address To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <42A655EC.7050009(a)tele-net.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Actually I already have two running FreeRADIUS servers with SQL. That isn't the hard part. The problem with your instructions is that I'm not using ippool to assign dynamic IPs, our NASes are doing that (Portmaster 2/3). I don't have a problem setting up static IPs either, as we have several Dial-Up users who need those also. The problem lies in that I want to use the RADIUS server for PPPoE authentication also. But I want to allow users who log in through PPPoE to also be able to log in regularly(Dial-Up), when their PPPoE isn't logged in. BUT, when they log in through PPPoE, I want them to be assigned a static IP, when they login via Portmasters/Dial-Up, then they don't get the static IP, they get a regular dynamic one. Basically if a user logs in through NAS1, they are assigned X attributes with dynamic IP, if they log in through NAS2, they are assigned Y attributes with a static IP. And all this needs to be done in MySQL, that way my own PHP frontend(which I intend to release GPL) can work with it. Also I think MySQL scales better. -Nick -- ------------------------ | Nick White | | Network Consultant | | http://www.edge9.net | | nwtech(a)tele-net.net | ------------------------

3 4