Cannot authenticate but there is accounting record
Hi, I've found unusual activity where there is an attempt to authenticate but unsuccesfull due to no entry in database (LDAP) but there is accounting record for it. Below are the log & accounting record. Any comments on this.. TQ.. Fri Oct 21 22:03:06 2005 : Auth: Login incorrect (rlm_ldap: User not found): [assasaas] (from client 61.6.116.2 port 143) Fri Oct 21 22:03:08 2005 Acct-Session-Id = "0026190D" Framed-Protocol = PPP Framed-IP-Address = 61.6.116.27 User-Name = "assasaas" Acct-Authentic = RADIUS Acct-Session-Time = 7 Acct-Input-Octets = 762 Acct-Output-Octets = 494 Acct-Input-Packets = 16 Acct-Output-Packets = 15 Acct-Terminate-Cause = User-Error Acct-Status-Type = Stop Called-Station-Id = "20878830" NAS-Port-Type = Async NAS-Port = 143 Connect-Info = "28800 V34/V42bis/LAPM" Service-Type = Framed-User NAS-IP-Address = 61.6.116.2 Acct-Delay-Time = 0 Client-IP-Address = 61.6.116.2 Acct-Unique-Session-Id = "62a6e1512da039e2" Stripped-User-Name = "assasaas" Realm = "NULL" Timestamp = 1129903388
"Rohaizam Abu Bakar" <haizam@myjaring.net> wrote:
I've found unusual activity where there is an attempt to authenticate but unsuccesfull due to no entry in database (LDAP) but there is accounting record for it.
Ask the NAS vendor why they do this. FreeRADIUS just logs the accounting packets that the NAS sends. Alan DeKok.
Alan DeKok wrote:
"Rohaizam Abu Bakar" <haizam@myjaring.net> wrote:
I've found unusual activity where there is an attempt to authenticate but unsuccesfull due to no entry in database (LDAP) but there is accounting record for it.
Ask the NAS vendor why they do this. FreeRADIUS just logs the accounting packets that the NAS sends. Many NAS's have a setting to turn unauthenticated accounting on or off. Pretty standard to have it in there, just turn it off.
-- Lewis Bergman Texas Communications 4309 Maple St. Abilene, TX 79602-8044 Off. 325-691-1301 Cell 325-439-0533 fax 325-695-6841
participants (3)
-
Alan DeKok -
Lewis Bergman -
Rohaizam Abu Bakar