- Freeradius-Users - lists.freeradius.org

RE: Load Balance two FreeRADIUS servers (question)
by Aldo Zavala 25 Jul '12

25 Jul '12

Many thanks for your input Jim, that really addressed my questions... I appreciate it.! Aldo Zavala

1 0

Load Balance two FreeRADIUS servers (question)
by Aldo Zavala 25 Jul '12

25 Jul '12

Hi, I have reading few posts that ask how to Load Balance Two or more FreeRADIUS servers, and usually the expert's (Alan and others) answer is to put a load balancer in front of the FreeRADIUS servers, I will trust you but I still have some questions about this: 1.- What load balancer is recommended? I would suppose that not all of them will load balance the UDP RADIUS well, I see many appliance, brands, etc.. just a thought 2.- Will this scenario cover the fail-over part? when one of my two FreeRADIUS servers stop working, or restart, or crash will the load balancer appliance start sending packets only to the live server until it gets back up? 3.- Isn't the load balancer a single point of failure itself? How is this potential problem usually addressed? Thanks!! Aldo Zavala

3 3

Re: FreeRADIUS in failover - HA setup (question)
by Aldo Zavala 25 Jul '12

25 Jul '12

Arran, thanks for your input, you are right; MySQL cluster does not offer any built-in HA module, according to what I've read there are different ways to achieve it, also I read in wiki.freeradius.org/Fail-over that there are Fail-Over and Load-Balancing modules in which we could setup more than one databases for authentication or accounting, so I didn't know that FreeRADIUS could do the load-balance part that's why I was asking if MySQL Cluster would have a floating IP address... anyway that addressed my initial question. Thanks! Aldo Zavala

1 0

RE: sql returns fail for some stop requests
by Amir Tal 24 Jul '12

24 Jul '12

After additional debugging the fault seems to be with a rouge backup process running on DB host, causing it to be slow to un-responsive for 10-20 minutes. (all unclosed sessions are within this time frame) This is easy to fix, but I'm looking for a way to make a fail-safe solution. There can always be occasions where DB connection is momentarily slow due to some other issue like network or storage, Since SQL is used here only for accounting data, is there a way to set the radius to accept all users (or reject all) in case DB is not-available, possibly keeping a buffer of accounting data to be written when DB access is restored? I am currently considering two possible solitions: Create a fail over for sql to allow login if sql is n/a, Similar to: redundant { sql ok } and/or use buffered-sql to catch these queries and update them in sql at later time. Is it possible to use buffered-sql and still perform simultaneous use checks based on same DB? Thanks for all replies, Amir.

3 3

FreeRADIUS performance information (tuning, benchmark)
by Andrei Petru Mura 24 Jul '12

24 Jul '12

I'm running FreeRADIUS on a PC with a dual CPU of 2 GHz and 2 GB of RAM. It is working with PostgreSQL database. When I perform tests with radperf, running : radperf -s -f ../users.csv -p 800 -a pap 10.3.1.1 auth radiussomething where users.csv file contains 10000 user names with password, I get this output: Total succeeded : 3811 Total failed : 6189 Total no reply : 0 Total time (s) : 10.588 Packets/s : 944 Response times: < 10 usec : 0 < 100 usec : 0 < msec : 0 < 10 msec : 1 < 0.1s : 3758 < s : 5897 < 10s : 344 < 100s : 0 (the result is a good one taking in account the packets amount processed per second - related to more tests that I did). I would need a sever able to manage a much greater amount of users ( > 50000, up to 1000000). But for now I'm interested how to get the server working well with ~(50000<->100000) users. What configuration do I need for this (I mean hardware configuration)? What are the best recommended improvements that should be done? Would JRadius module help on improving performance? (I'm not familiar about JRadius). Thanks for any suggestions. N.B. In attachment you have the important part from output of running radiusd -XXX together with with radperf.

5 7

RE: sql returns fail for some stop requests
by Amir Tal 24 Jul '12

24 Jul '12

Dialup.conf : [root@RADIUS4 radius]# cat /etc/raddb/sql/mysql/dialup.conf # -*- text -*- ## ## dialup.conf -- MySQL configuration for default schema (schema.sql) ## ## $Id$ # Safe characters list for sql queries. Everything else is replaced # with their mime-encoded equivalents. # The default list should be ok #safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" ####################################################################### # Query config: Username ####################################################################### # This is the username that will get substituted, escaped, and added # as attribute 'SQL-User-Name'. '%{SQL-User-Name}' should be used below # everywhere a username substitution is needed so you you can be sure # the username passed from the client is escaped properly. # # Uncomment the next line, if you want the sql_user_name to mean: # # Use Stripped-User-Name, if it's there. # Else use User-Name, if it's there, # Else use hard-coded string "DEFAULT" as the user name. sql_user_name = "%{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}}" # #sql_user_name = "%{User-Name}" ####################################################################### # Default profile ####################################################################### # This is the default profile. It is found in SQL by group membership. # That means that this profile must be a member of at least one group # which will contain the corresponding check and reply items. # This profile will be queried in the authorize section for every user. # The point is to assign all users a default profile without having to # manually add each one to a group that will contain the profile. # The SQL module will also honor the User-Profile attribute. This # attribute can be set anywhere in the authorize section (ie the users # file). It is found exactly as the default profile is found. # If it is set then it will *overwrite* the default profile setting. # The idea is to select profiles based on checks on the incoming packets, # not on user group membership. For example: # -- users file -- # DEFAULT Service-Type == Outbound-User, User-Profile := "outbound" # DEFAULT Service-Type == Framed-User, User-Profile := "framed" # # By default the default_user_profile is not set # #default_user_profile = "DEFAULT" ####################################################################### # NAS Query ####################################################################### # This query retrieves the radius clients # # 0. Row ID (currently unused) # 1. Name (or IP address) # 2. Shortname # 3. Type # 4. Secret ####################################################################### nas_query = "SELECT id, nasname, shortname, type, secret FROM ${nas_table}" ####################################################################### # Authorization Queries ####################################################################### # These queries compare the check items for the user # in ${authcheck_table} and setup the reply items in # ${authreply_table}. You can use any query/tables # you want, but the return data for each row MUST # be in the following order: # # 0. Row ID (currently unused) # 1. UserName/GroupName # 2. Item Attr Name # 3. Item Attr Value # 4. Item Attr Operation ####################################################################### # Use these for case sensitive usernames. #authorize_check_query = "SELECT id, username, attribute, value, op \ # FROM ${authcheck_table} \ # WHERE username = BINARY '%{SQL-User-Name}' \ # ORDER BY id" #authorize_reply_query = "SELECT id, username, attribute, value, op \ # FROM ${authreply_table} \ # WHERE username = BINARY '%{SQL-User-Name}' \ # ORDER BY id" # The default queries are case insensitive. (for compatibility with # older versions of FreeRADIUS) authorize_check_query = "SELECT id, username, attribute, value, op \ FROM ${authcheck_table} \ WHERE username = '%{SQL-User-Name}' \ ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op \ FROM ${authreply_table} \ WHERE username = '%{SQL-User-Name}' \ ORDER BY id" # Use these for case sensitive usernames. #group_membership_query = "SELECT groupname \ # FROM ${usergroup_table} \ # WHERE username = BINARY '%{SQL-User-Name}' \ # ORDER BY priority" group_membership_query = "SELECT groupname \ FROM ${usergroup_table} \ WHERE username = '%{SQL-User-Name}' \ ORDER BY priority" authorize_group_check_query = "SELECT id, groupname, attribute, \ Value, op \ FROM ${groupcheck_table} \ WHERE groupname = '%{Sql-Group}' \ ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, \ value, op \ FROM ${groupreply_table} \ WHERE groupname = '%{Sql-Group}' \ ORDER BY id" ####################################################################### # Accounting Queries ####################################################################### # accounting_onoff_query - query for Accounting On/Off packets # accounting_update_query - query for Accounting update packets # accounting_update_query_alt - query for Accounting update packets # (alternate in case first query fails) # accounting_start_query - query for Accounting start packets # accounting_start_query_alt - query for Accounting start packets # (alternate in case first query fails) # accounting_stop_query - query for Accounting stop packets # accounting_stop_query_alt - query for Accounting start packets # (alternate in case first query doesn't # affect any existing rows in the table) ####################################################################### accounting_onoff_query = "\ UPDATE ${acct_table1} \ SET \ acctstoptime = '%S', \ acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), \ acctterminatecause = '%{Acct-Terminate-Cause}', \ acctstopdelay = %{%{Acct-Delay-Time}:-0} \ WHERE acctstoptime IS NULL \ AND nasipaddress = '%{NAS-IP-Address}' \ AND acctstarttime <= '%S'" accounting_update_query = " \ UPDATE ${acct_table1} \ SET \ framedipaddress = '%{Framed-IP-Address}', \ acctsessiontime = '%{Acct-Session-Time}', \ acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', \ acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' \ WHERE acctsessionid = '%{Acct-Session-Id}' \ AND username = '%{SQL-User-Name}' \ AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " \ INSERT INTO ${acct_table1} \ (acctsessionid, acctuniqueid, username, \ realm, nasipaddress, nasportid, \ nasporttype, acctstarttime, acctsessiontime, \ acctauthentic, connectinfo_start, acctinputoctets, \ acctoutputoctets, calledstationid, callingstationid, \ servicetype, framedprotocol, framedipaddress, \ acctstartdelay, xascendsessionsvrkey) \ VALUES \ ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', \ '%{SQL-User-Name}', \ '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', \ '%{NAS-Port-Type}', \ DATE_SUB('%S', \ INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', \ '%{Acct-Authentic}', '', \ '%{%{Acct-Input-Gigawords}:-0}' << 32 | \ '%{%{Acct-Input-Octets}:-0}', \ '%{%{Acct-Output-Gigawords}:-0}' << 32 | \ '%{%{Acct-Output-Octets}:-0}', \ '%{Called-Station-Id}', '%{Calling-Station-Id}', \ '%{Service-Type}', '%{Framed-Protocol}', \ '%{Framed-IP-Address}', \ '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " \ INSERT INTO ${acct_table1} \ (acctsessionid, acctuniqueid, username, \ realm, nasipaddress, nasportid, \ nasporttype, acctstarttime, acctstoptime, \ acctsessiontime, acctauthentic, connectinfo_start, \ connectinfo_stop, acctinputoctets, acctoutputoctets, \ calledstationid, callingstationid, acctterminatecause, \ servicetype, framedprotocol, framedipaddress, \ acctstartdelay, acctstopdelay, xascendsessionsvrkey) \ VALUES \ ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', \ '%{SQL-User-Name}', \ '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', \ '%{NAS-Port-Type}', '%S', NULL, \ '0', '%{Acct-Authentic}', '%{Connect-Info}', \ '', '0', '0', \ '%{Called-Station-Id}', '%{Calling-Station-Id}', '', \ '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', \ '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " \ UPDATE ${acct_table1} SET \ acctstarttime = '%S', \ acctstartdelay = '%{%{Acct-Delay-Time}:-0}', \ connectinfo_start = '%{Connect-Info}' \ WHERE acctsessionid = '%{Acct-Session-Id}' \ AND username = '%{SQL-User-Name}' \ AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " \ UPDATE ${acct_table2} SET \ acctstoptime = '%S', \ acctsessiontime = '%{Acct-Session-Time}', \ acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', \ acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', \ acctterminatecause = '%{Acct-Terminate-Cause}', \ acctstopdelay = '%{%{Acct-Delay-Time}:-0}', \ connectinfo_stop = '%{Connect-Info}' \ WHERE acctsessionid = '%{Acct-Session-Id}' \ AND username = '%{SQL-User-Name}' \ AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " \ INSERT INTO ${acct_table2} \ (acctsessionid, acctuniqueid, username, \ realm, nasipaddress, nasportid, \ nasporttype, acctstarttime, acctstoptime, \ acctsessiontime, acctauthentic, connectinfo_start, \ connectinfo_stop, acctinputoctets, acctoutputoctets, \ calledstationid, callingstationid, acctterminatecause, \ servicetype, framedprotocol, framedipaddress, \ acctstartdelay, acctstopdelay) \ VALUES \ ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', \ '%{SQL-User-Name}', \ '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', \ '%{NAS-Port-Type}', \ DATE_SUB('%S', \ INTERVAL (%{%{Acct-Session-Time}:-0} + \ %{%{Acct-Delay-Time}:-0}) SECOND), \ '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', \ '%{Connect-Info}', \ '%{%{Acct-Input-Gigawords}:-0}' << 32 | \ '%{%{Acct-Input-Octets}:-0}', \ '%{%{Acct-Output-Gigawords}:-0}' << 32 | \ '%{%{Acct-Output-Octets}:-0}', \ '%{Called-Station-Id}', '%{Calling-Station-Id}', \ '%{Acct-Terminate-Cause}', \ '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', \ '0', '%{%{Acct-Delay-Time}:-0}')" ####################################################################### # Simultaneous Use Checking Queries ####################################################################### # simul_count_query - query for the number of current connections # - If this is not defined, no simultaneouls use checking # - will be performed by this module instance # simul_verify_query - query to return details of current connections for verification # - Leave blank or commented out to disable verification step # - Note that the returned field order should not be changed. ####################################################################### # Uncomment simul_count_query to enable simultaneous use checking #simul_count_query = "SELECT COUNT(*) FROM ${acct_table1} WHERE username = '%{SQL-User-Name}' AND acctstoptime is NULL" #simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM ${acct_table1} WHERE username = '%{SQL-User-Name}' AND acctstoptime is NULL" ####################################################################### # Authentication Logging Queries ####################################################################### # postauth_query - Insert some info after authentication ####################################################################### postauth_query = " \ INSERT INTO ${postauth_table} \ (username, pass, reply, authdate) \ VALUES ( \ '%{User-Name}', \ '%{%{User-Password}:-%{Chap-Password}}', \ '%{reply:Packet-Type}', '%S')"

2 1

[ANN][FEATURE]: Reference based accounting queries
by Arran Cudbard-Bell 24 Jul '12

24 Jul '12

The accounting section of rlm_sql has been modified to use reference based accounting queries. Accounting and post-auth now have their own subsections, and contain a config pair called reference. The value of this is expanded to give a config path, and the config pair this resolves to is used as the query value. If the query fails and the config path matches multiple pairs the next pair is used. This emulates the 'alt' behaviour that was were before but can fail between N queries. I've tested the MySQL version pretty thoroughly, but it'd be nice if people using Postgresql, Mssql, and Oracle could also test, just to make sure no query errors have crept in with the reformatting. Code is available here: https://github.com/arr2036/freeradius-server/tree/dynamic_acct_query_select… There's also a patch in that branch from Alan to strip off whitespace from the start ofline continuations if the config pair value begins with "\\n - slightly magic but seems to be pretty effective - debug output is much more readable. The MySQL schemas have also been updated with new features. If anyone fancies adding the following to the default schemas/configs it'd be much appreciated: * Calculating all times from %{integer:Event-Timestamp} (you'll have to convert from unix timestamp using an SQL function) and removing the acctstartdelay and acctstopdelay columns. * Adding an acctupdatetime column, and updating it when a new session is created or an interim-update packet is received. * Adding an acctinterval column and updating it using the delta (in seconds) between the last acctupdatetime value and the current time (this is really easy way to do stale session detection if your NAS supports interim-updates). This is difficult in some SQL dialects, because there's no guarantee that fields will be modified in the order specified in the query. * Removing the xascend column, and using a single list of fields for all insert operations. Look at the MySQL schema if the above are unclear, and please post to the devel list if you want to work on one of the schemas/databases, so we don't have duplicate effort. -Arran Note: Redundant queries are now supported in post-auth too, so it should be possible to maintain a table of just the last authentication attempt for a user if thats all the post-auth data you're interested in. Note: As part of the rewrite i've removed the Cisco session length hack. If anyone was still using this please contact me, and we'll work something out.

1 1

Setting realm from called station id regex
by Christopher Manigan 23 Jul '12

23 Jul '12

Hello, I have some devices that report to radius accounting but do not do any authentication or authorization. For these sessions in accounting, I would like to set a realm based on the called station id. The called station id ends with a colon and the SSID. I thought I could write a simple regular expression for the ssid and set the realm. Here is what I have right now, but it does not seem to be working: DEFAULT Called-Station-Id =~ "myssid" Realm = "myrealm" Any help is greatly appreciated. Chris

2 2

How to know packet-type when using perl script
by moshe levi 23 Jul '12

23 Jul '12

Hi, I have add perl script execution to recv-coa section in my coa virtual server in the script I want to do different operation if I am getting CoA-Request or Disconnect-Request How do I do that? how can I tell which packet-type arrive in the perl script.

1 0

Problems with Freeradius password encryption
by Andrei Petru Mura 23 Jul '12

23 Jul '12

I'm trying to do some performance tests with FR 2.1.10. I'm using radperf tool. I have two different machines with freeradius installed on them. In one of them the test is going well for now, but in the other (where I'm more interested on) the test fails with the following error: rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=50, length=20 rad_verify: Received Access-Reject packet from client 127.0.0.1 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.) Bellow I'll put the output from the freeradius run with -XXX with some comments on it: rad_recv: Access-Request packet from host 127.0.0.1 port 38027, id=50, length=45 User-Name = "test1" User-Password = "\340<V#\307\177\221\034\355\366M\255\364\271\340\253" /*** comment 1: the User-Password on the machine with well-working freeradius isn't encrypted. It looks simple like this: User-Password = "test1" ***/ Mon Jul 23 11:36:48 2012 : Info: # Executing section authorize from file /netnfork/radius//etc/raddb/sites-enabled/default Mon Jul 23 11:36:48 2012 : Info: +- entering group authorize {...} Mon Jul 23 11:36:48 2012 : Info: ++[preprocess] returns ok Mon Jul 23 11:36:48 2012 : Info: ++[chap] returns noop Mon Jul 23 11:36:48 2012 : Info: [suffix] No '@' in User-Name = "test1", looking up realm NULL Mon Jul 23 11:36:48 2012 : Info: [suffix] No such realm "NULL" Mon Jul 23 11:36:48 2012 : Info: ++[suffix] returns noop Mon Jul 23 11:36:48 2012 : Info: [eap] No EAP-Message, not doing EAP Mon Jul 23 11:36:48 2012 : Info: ++[eap] returns noop Mon Jul 23 11:36:48 2012 : Info: [sql] expand: %{User-Name} -> test1 Mon Jul 23 11:36:48 2012 : Info: [sql] sql_set_user escaped user --> 'test1' Mon Jul 23 11:36:48 2012 : Debug: rlm_sql (sql): Reserving sql socket id: 0 Mon Jul 23 11:36:48 2012 : Info: [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'test1' ORDER BY id Mon Jul 23 11:36:48 2012 : Debug: rlm_sql_postgresql: Status: PGRES_TUPLES_OK Mon Jul 23 11:36:48 2012 : Debug: rlm_sql_postgresql: query affected rows = 1 , fields = 5 Mon Jul 23 11:36:48 2012 : Info: [sql] User found in radcheck table Mon Jul 23 11:36:48 2012 : Info: [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'test1' ORDER BY id Mon Jul 23 11:36:48 2012 : Debug: rlm_sql_postgresql: Status: PGRES_TUPLES_OK Mon Jul 23 11:36:48 2012 : Debug: rlm_sql_postgresql: query affected rows = 0 , fields = 5 Mon Jul 23 11:36:48 2012 : Info: [sql] expand: SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority -> SELECT GroupName FROM radusergroup WHERE UserName='test1' ORDER BY priority Mon Jul 23 11:36:48 2012 : Debug: rlm_sql_postgresql: Status: PGRES_TUPLES_OK Mon Jul 23 11:36:48 2012 : Debug: rlm_sql_postgresql: query affected rows = 0 , fields = 1 Mon Jul 23 11:36:48 2012 : Debug: rlm_sql (sql): Released sql socket id: 0 Mon Jul 23 11:36:48 2012 : Info: ++[sql] returns ok Mon Jul 23 11:36:48 2012 : Info: ++[expiration] returns noop Mon Jul 23 11:36:48 2012 : Info: ++[logintime] returns noop Mon Jul 23 11:36:48 2012 : Info: ++[pap] returns updated Mon Jul 23 11:36:48 2012 : Info: Found Auth-Type = PAP Mon Jul 23 11:36:48 2012 : Info: # Executing group from file /netnfork/radius//etc/raddb/sites-enabled/default Mon Jul 23 11:36:48 2012 : Info: +- entering group PAP {...} Mon Jul 23 11:36:48 2012 : Info: [pap] login attempt with password "�<V#�??��M��" Mon Jul 23 11:36:48 2012 : Info: [pap] Using clear text password "test1" Mon Jul 23 11:36:48 2012 : Info: [pap] Passwords don't match Mon Jul 23 11:36:48 2012 : Info: ++[pap] returns reject /*** comment 2: the last four lines in the well-working server are: Mon Jul 23 11:32:15 2012 : Info: [pap] login attempt with password "test92" Mon Jul 23 11:32:15 2012 : Info: [pap] Using clear text password "test92" Mon Jul 23 11:32:15 2012 : Info: [pap] User authenticated successfully Mon Jul 23 11:32:15 2012 : Info: ++[pap] returns ok ***/ Mon Jul 23 11:36:48 2012 : Info: Failed to authenticate the user. Mon Jul 23 11:36:48 2012 : Debug: WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Mon Jul 23 11:36:48 2012 : Info: Using Post-Auth-Type Reject Mon Jul 23 11:36:48 2012 : Info: # Executing group from file /netnfork/radius//etc/raddb/sites-enabled/default Mon Jul 23 11:36:48 2012 : Info: +- entering group REJECT {...} Mon Jul 23 11:36:48 2012 : Info: [attr_filter.access_reject] expand: %{User-Name} -> test1 Mon Jul 23 11:36:48 2012 : Debug: attr_filter: Matched entry DEFAULT at line 11 Mon Jul 23 11:36:48 2012 : Info: ++[attr_filter.access_reject] returns updated Mon Jul 23 11:36:48 2012 : Info: Delaying reject of request 3 for 1 seconds Mon Jul 23 11:36:48 2012 : Debug: Going to the next request Mon Jul 23 11:36:48 2012 : Debug: Waking up in 0.9 seconds. Mon Jul 23 11:36:49 2012 : Info: Sending delayed reject for request 3 Sending Access-Reject of id 50 to 127.0.0.1 port 38027 Mon Jul 23 11:36:49 2012 : Debug: Waking up in 4.9 seconds. Mon Jul 23 11:36:54 2012 : Info: Cleaning up request 3 ID 50 with timestamp +250 Mon Jul 23 11:36:54 2012 : Info: Ready to process requests. >From the output I understand that the password shouldn't be encrypted when is sent. Can anybody suggest me how to fix that problem?

2 1