CID при PPTP и PPPoE соединениях

bazungu · Вс мар 30, 2008 6:20 am

При подключении юзеров по PPTP в CID виднеется IP с которого подключаются, все хорошо. Но при PPPoE нету MAC аддресса в CID-е. Cisco посылает Радиусу : Cisco-AVPair = "client-mac-address=aaaa.aaaa.aaaa". Кто нибудь вникал?

chtito · Вс мар 30, 2008 6:30 am

+1. Очень важный момент. Абиллс наверное ждет номер в Calling-Station-ID и наверняка это лечится хаком во FreeRADIUS, который Cisco-AVPair = "client-mac-address=..." перепишет в Calling-Station-ID, но я не уверен поддерживается ли это.

ran · Сообщение **ran** » Вс мар 30, 2008 9:29 am

да нафиг тебе этот мак??? егож третьеклассник уже проспуфить умеет! авторизации по логину/паролю мало?

chtito · Вс мар 30, 2008 10:11 am

ran писал(а):да нафиг тебе этот мак??? егож третьеклассник уже проспуфить умеет! авторизации по логину/паролю мало?

ran, например на DSLAM'ах можно ставить MAC фильтры на определенный порт, предотвращающие спуфинг, и так и делается, так что вопрос имеет право жить.

ran · Сообщение **ran** » Вс мар 30, 2008 11:58 am

та знаю я это... так тем более - зачем тебе мак? если дслам или управляемый свич уже отфильтровал? вот связать эти штуки с абиллсом, чтоб они маки как-то у него брали - другое дело... и кстати наскоко помню - свичи у которых есь радиусклиент - думаю связать не проблема... думаю, что и дсламы с радиусклиентом есь

chtito · Вс мар 30, 2008 12:35 pm

Авторизация по маку нужна например чтобы исключить возможность зайти под чужим логином и паролем, накатать гигабайты, и потом доказывать клиенту, что он должен заплатить, логин то его.

ran · Сообщение **ran** » Вс мар 30, 2008 12:51 pm

логин то его.

ВОТ ИМЕННО!!! А то что он прое... проср... вощем потерял свой пароль - его личная беда. И в догворе с клиентом ЭТО должно быть чётко и правильно оговорено. И пусть потом ДОКАЖЕТ В СУДЕ, что у него украли пароль при авторизации по мсчапв2

NiTr0 · Вс мар 30, 2008 2:35 pm

ИМХО - проще поправить auth.pl

dennisTS · Вс мар 30, 2008 3:49 pm

Помогите пожалуйста решить вопрос.
Стоит FreeBSD 6.2 AMD64, poptop 1.3.4, abills 3.7

В поле CID прописываю мак абонента, но авторизация не происходит.

2008-03-30 11:26:13 LOG_WARNING: AUTH [test] NAS: 1 Wrong CID ''

Патчил поптоп согласно документации : http://abills.net.ua/wiki/doku.php?id=a ... s:exppp:ru

В чем еще может быть проблема?

Спасибо всем.

NiTr0 · Вс мар 30, 2008 4:03 pm

dennisTS
radiusd -X и смотреть, что передает NAS...

dennisTS · Вс мар 30, 2008 4:28 pm

NiTr0 писал(а):dennisTS
radiusd -X и смотреть, что передает NAS...

radiusd -X
Starting - reading configuration files ...
reread_config: reading radiusd.conf
Config: including file: /usr/local/etc/raddb/proxy.conf
Config: including file: /usr/local/etc/raddb/clients.conf
Config: including file: /usr/local/etc/raddb/snmp.conf
Config: including file: /usr/local/etc/raddb/eap.conf
Config: including file: /usr/local/etc/raddb/sql.conf
main: prefix = "/usr/local"
main: localstatedir = "/var"
main: logdir = "/var/log"
main: libdir = "/usr/local/lib"
main: radacctdir = "/var/log/radacct"
main: hostname_lookups = no
main: snmp = no
main: max_request_time = 30
main: cleanup_delay = 5
main: max_requests = 1024
main: delete_blocked_requests = 0
main: port = 0
main: allow_core_dumps = no
main: log_stripped_names = no
main: log_file = "/var/log/radius.log"
main: log_auth = no
main: log_auth_badpass = no
main: log_auth_goodpass = no
main: pidfile = "/var/run/radiusd/radiusd.pid"
main: user = "(null)"
main: group = "(null)"
main: usercollide = no
main: lower_user = "no"
main: lower_pass = "no"
main: nospace_user = "no"
main: nospace_pass = "no"
main: checkrad = "/usr/local/sbin/checkrad"
main: proxy_requests = yes
proxy: retry_delay = 5
proxy: retry_count = 3
proxy: synchronous = no
proxy: default_fallback = yes
proxy: dead_time = 120
proxy: post_proxy_authorize = no
proxy: wake_all_if_all_dead = no
security: max_attributes = 200
security: reject_delay = 1
security: status_server = no
main: debug_level = 0
read_config_files: reading dictionary
read_config_files: reading naslist
Using deprecated naslist file. Support for this will go away soon.
read_config_files: reading clients
read_config_files: reading realms
radiusd: entering modules setup
Module: Library search path is /usr/local/lib
Module: Loaded exec
exec: wait = yes
exec: program = "(null)"
exec: input_pairs = "request"
exec: output_pairs = "(null)"
exec: packet_type = "(null)"
rlm_exec: Wait=yes but no output defined. Did you mean output=none?
Module: Instantiated exec (exec)
Module: Loaded expr
Module: Instantiated expr (expr)
Module: Loaded PAP
pap: encryption_scheme = "crypt"
pap: auto_header = yes
Module: Instantiated pap (pap)
Module: Loaded CHAP
Module: Instantiated chap (chap)
Module: Loaded MS-CHAP
mschap: use_mppe = yes
mschap: require_encryption = no
mschap: require_strong = no
mschap: with_ntdomain_hack = no
mschap: passwd = "(null)"
mschap: ntlm_auth = "(null)"
Module: Instantiated mschap (mschap)
Module: Loaded System
unix: cache = no
unix: passwd = "(null)"
unix: shadow = "(null)"
unix: group = "(null)"
unix: radwtmp = "/var/log/radwtmp"
unix: usegroup = no
unix: cache_reload = 600
Module: Instantiated unix (unix)
Module: Loaded eap
eap: default_eap_type = "md5"
eap: timer_expire = 60
eap: ignore_unknown_eap_types = no
eap: cisco_accounting_username_bug = no
rlm_eap: Loaded and initialized type md5
rlm_eap: Loaded and initialized type leap
gtc: challenge = "Password: "
gtc: auth_type = "PAP"
rlm_eap: Loaded and initialized type gtc
mschapv2: with_ntdomain_hack = no
rlm_eap: Loaded and initialized type mschapv2
Module: Instantiated eap (eap)
Module: Loaded preprocess
preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups"
preprocess: hints = "/usr/local/etc/raddb/hints"
preprocess: with_ascend_hack = no
preprocess: ascend_channels_per_line = 23
preprocess: with_ntdomain_hack = no
preprocess: with_specialix_jetstream_hack = no
preprocess: with_cisco_vsa_hack = no
preprocess: with_alvarion_vsa_hack = no
Module: Instantiated preprocess (preprocess)
Module: Loaded realm
realm: format = "suffix"
realm: delimiter = "@"
realm: ignore_default = no
realm: ignore_null = no
Module: Instantiated realm (suffix)
Module: Loaded files
files: usersfile = "/usr/local/etc/raddb/users"
files: acctusersfile = "/usr/local/etc/raddb/acct_users"
files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users"
files: compat = "no"
Module: Instantiated files (files)
Module: Loaded Acct-Unique-Session-Id
acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
Module: Instantiated acct_unique (acct_unique)
Module: Loaded detail
detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d"
detail: detailperm = 384
detail: dirperm = 493
detail: locking = no
Module: Instantiated detail (detail)
Module: Loaded radutmp
radutmp: filename = "/var/log/radutmp"
radutmp: username = "%{User-Name}"
radutmp: case_sensitive = yes
radutmp: check_with_nas = yes
radutmp: perm = 384
radutmp: callerid = yes
Module: Instantiated radutmp (radutmp)
Listening on authentication *:1812
Listening on accounting *:1813
Ready to process requests.

NiTr0 · Вс мар 30, 2008 5:18 pm

dennisTS
И где здесь попытки коннекта NAS-а к серверу???

dennisTS · Вс мар 30, 2008 9:12 pm

NiTr0 писал(а):dennisTS
И где здесь попытки коннекта NAS-а к серверу???

Не совсем понял. Натолкните на мысль..

ran · Сообщение **ran** » Пн мар 31, 2008 5:55 am

ты привёл лог запуска радиуса...

а нафиг он? что он в момент коннекта пишет?

dennisTS · Пн мар 31, 2008 8:29 am

ran писал(а):ты привёл лог запуска радиуса... а нафиг он? что он в момент коннекта пишет?

Service-Type = VPN
User-Name = "test"
Framed-Protocol = PPP
Framed-IP-Address = 10.10.0.23
Framed-IP-Netmask = 0.0.0.0
NAS-Identifier = "ABM"
NAS-Port = 0
Acct-Status-Type = Stop
Acct-Session-Id = "s-2398383189"
Acct-Multi-Session-Id = ""
Acct-Delay-Time = 0
Acct-Input-Octets = 0
Acct-Input-Packets = 0
Acct-Output-Octets = 4250
Acct-Output-Packets = 37
Acct-Session-Time = 33
Exppp-Acct-LocalInput-Octets = 0
Exppp-Acct-LocalOutput-Octets = 0
Exppp-Acct-IteriumIn-Octets = 0
Exppp-Acct-IteriumOut-Octets = 4250
Exppp-Acct-LocalIteriumIn-Octets = 0
Exppp-Acct-LocalIteriumOut-Octets = 0
Exppp-Acct-IteriumTime = 33
NAS-IP-Address = 127.0.0.1
Client-IP-Address = 127.0.0.1
Acct-Unique-Session-Id = "15b24952b9b54102"
Timestamp = 1206866300

Sun Mar 30 11:40:12 2008
Calling-Station-Id = "0

e4:be:29:81"
Called-Station-Id = "pppoe"
Service-Type = VPN
User-Name = "test"
Framed-Protocol = PPP
Framed-IP-Address = 10.10.0.23
Framed-IP-Netmask = 0.0.0.0
NAS-Identifier = "ABM"
NAS-Port = 0
Acct-Status-Type = Start
Acct-Session-Id = "s-1404562368"
Acct-Multi-Session-Id = ""
Acct-Delay-Time = 0
NAS-IP-Address = 127.0.0.1
Client-IP-Address = 127.0.0.1
Acct-Unique-Session-Id = "00d48a95bc92fcb4"
Timestamp = 1206866412

Sun Mar 30 11:41:13 2008
Calling-Station-Id = "0

e4:be:29:81"
Called-Station-Id = "pppoe"
Service-Type = VPN
User-Name = "test"
Framed-Protocol = PPP
Framed-IP-Address = 10.10.0.23
Framed-IP-Netmask = 0.0.0.0
NAS-Identifier = "ABM"
NAS-Port = 0
Acct-Status-Type = Interim-Update
Acct-Session-Id = "s-1404562368"
Acct-Multi-Session-Id = ""
Acct-Delay-Time = 0
Acct-Input-Octets = 113043
Acct-Input-Packets = 129
Acct-Output-Octets = 29504
Acct-Output-Packets = 115
Acct-Session-Time = 61
Exppp-Acct-LocalInput-Octets = 0
Exppp-Acct-LocalOutput-Octets = 0
Exppp-Acct-IteriumIn-Octets = 113043
Exppp-Acct-IteriumOut-Octets = 29504
Exppp-Acct-LocalIteriumIn-Octets = 0
Exppp-Acct-LocalIteriumOut-Octets = 0
Exppp-Acct-IteriumTime = 61
NAS-IP-Address = 127.0.0.1
Client-IP-Address = 127.0.0.1
Acct-Unique-Session-Id = "00d48a95bc92fcb4"
Timestamp = 1206866473

Sun Mar 30 11:41:40 2008
Calling-Station-Id = "0

e4:be:29:81"
Called-Station-Id = "pppoe"
Service-Type = VPN
User-Name = "test"
Framed-Protocol = PPP
Framed-IP-Address = 10.10.0.23
Framed-IP-Netmask = 0.0.0.0
NAS-Identifier = "ABM"
NAS-Port = 0
Acct-Status-Type = Stop
Acct-Session-Id = "s-1404562368"
Acct-Multi-Session-Id = ""
Acct-Delay-Time = 0
Acct-Input-Octets = 113043
Acct-Input-Packets = 129
Acct-Output-Octets = 29624
Acct-Output-Packets = 117
Acct-Session-Time = 88
Exppp-Acct-LocalInput-Octets = 0
Exppp-Acct-LocalOutput-Octets = 0
Exppp-Acct-IteriumIn-Octets = 0
Exppp-Acct-IteriumOut-Octets = 120
Exppp-Acct-LocalIteriumIn-Octets = 0
Exppp-Acct-LocalIteriumOut-Octets = 0
Exppp-Acct-IteriumTime = 27
NAS-IP-Address = 127.0.0.1
Client-IP-Address = 127.0.0.1
Acct-Unique-Session-Id = "00d48a95bc92fcb4"
Timestamp = 1206866500

Sun Mar 30 11:50:56 2008
Service-Type = VPN
User-Name = "test"
Framed-Protocol = PPP
Framed-IP-Address = 10.10.0.23
Framed-IP-Netmask = 0.0.0.0
NAS-Identifier = "ABM"
NAS-Port = 0
Acct-Status-Type = Start
Acct-Session-Id = "s-3449222347"
Acct-Multi-Session-Id = ""
Acct-Delay-Time = 0
NAS-IP-Address = 127.0.0.1
Client-IP-Address = 127.0.0.1
Acct-Unique-Session-Id = "f7e7f257a6e6341b"
Timestamp = 1206867056

Sun Mar 30 11:51:44 2008
Service-Type = VPN
User-Name = "test"
Framed-Protocol = PPP
Framed-IP-Address = 10.10.0.23
Framed-IP-Netmask = 0.0.0.0
NAS-Identifier = "ABM"
NAS-Port = 0
Acct-Status-Type = Stop
Acct-Session-Id = "s-3449222347"
Acct-Multi-Session-Id = ""
Acct-Delay-Time = 0
Acct-Input-Octets = 31787
Acct-Input-Packets = 43
Acct-Output-Octets = 9263
Acct-Output-Packets = 66
Acct-Session-Time = 48
Exppp-Acct-LocalInput-Octets = 0
Exppp-Acct-LocalOutput-Octets = 0
Exppp-Acct-IteriumIn-Octets = 31787
Exppp-Acct-IteriumOut-Octets = 9263
Exppp-Acct-LocalIteriumIn-Octets = 0
Exppp-Acct-LocalIteriumOut-Octets = 0
Exppp-Acct-IteriumTime = 48
NAS-IP-Address = 127.0.0.1
Client-IP-Address = 127.0.0.1
Acct-Unique-Session-Id = "f7e7f257a6e6341b"
Timestamp = 1206867104

Sun Mar 30 17:52:14 2008
Calling-Station-Id = "0

e4:be:29:81"
Called-Station-Id = "pppoe"
Service-Type = VPN
User-Name = "test"
Framed-Protocol = PPP
Framed-IP-Address = 10.10.0.23
Framed-IP-Netmask = 0.0.0.0
NAS-Identifier = "ABM"
NAS-Port = 0
Acct-Status-Type = Start
Acct-Session-Id = "s-1970452923"
Acct-Multi-Session-Id = ""
Acct-Delay-Time = 0
NAS-IP-Address = 127.0.0.1
Client-IP-Address = 127.0.0.1
Acct-Unique-Session-Id = "3f4efbdfe731e679"
Timestamp = 1206888734

Sun Mar 30 17:52:36 2008
Calling-Station-Id = "0

e4:be:29:81"
Called-Station-Id = "pppoe"
Service-Type = VPN
User-Name = "test"
Framed-Protocol = PPP
Framed-IP-Address = 10.10.0.23
Framed-IP-Netmask = 0.0.0.0
NAS-Identifier = "ABM"
NAS-Port = 0
Acct-Status-Type = Stop
Acct-Session-Id = "s-1970452923"
Acct-Multi-Session-Id = ""
Acct-Delay-Time = 0
Acct-Input-Octets = 49269
Acct-Input-Packets = 45
Acct-Output-Octets = 7463
Acct-Output-Packets = 49
Acct-Session-Time = 22
Exppp-Acct-LocalInput-Octets = 0
Exppp-Acct-LocalOutput-Octets = 0
Exppp-Acct-IteriumIn-Octets = 49269
Exppp-Acct-IteriumOut-Octets = 7463
Exppp-Acct-LocalIteriumIn-Octets = 0
Exppp-Acct-LocalIteriumOut-Octets = 0
Exppp-Acct-IteriumTime = 22
NAS-IP-Address = 127.0.0.1
Client-IP-Address = 127.0.0.1
Acct-Unique-Session-Id = "3f4efbdfe731e679"
Timestamp = 1206888756

radius.log :

Fri Mar 28 23:53:51 2008 : Info: Using deprecated naslist file. Support for this will go away soon.
Fri Mar 28 23:53:51 2008 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none?
Fri Mar 28 23:53:51 2008 : Info: Ready to process requests.
Fri Mar 28 23:57:45 2008 : Info: Using deprecated naslist file. Support for this will go away soon.
Fri Mar 28 23:57:45 2008 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none?
Fri Mar 28 23:57:45 2008 : Info: Ready to process requests.
Sat Mar 29 01:35:16 2008 : Info: Using deprecated naslist file. Support for this will go away soon.
Sat Mar 29 01:35:16 2008 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none?
Sat Mar 29 01:35:16 2008 : Info: Ready to process requests.
Sat Mar 29 01:42:23 2008 : Info: Using deprecated naslist file. Support for this will go away soon.
Sat Mar 29 01:42:23 2008 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none?
Sat Mar 29 01:42:23 2008 : Info: Ready to process requests.
Sat Mar 29 01:51:58 2008 : Info: Using deprecated naslist file. Support for this will go away soon.
Sat Mar 29 01:51:58 2008 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none?
Sat Mar 29 01:51:58 2008 : Info: Ready to process requests.
Sun Mar 30 11:33:20 2008 : Info: Using deprecated naslist file. Support for this will go away soon.
Sun Mar 30 11:33:20 2008 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none?
Sun Mar 30 11:33:20 2008 : Info: Ready to process requests.
Sun Mar 30 19:29:18 2008 : Info: Using deprecated naslist file. Support for this will go away soon.
Sun Mar 30 19:29:18 2008 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none?
Sun Mar 30 19:29:18 2008 : Info: Ready to process requests.