Admin logins from NEW PM3

John Lange ( radadmin@palacenet.net )
Thu, 16 Apr 1998 12:30:51 -0500

HI

We just installed our first PM3 and am seeing something unusual in the
radius 2.2.38 debug. Every minute or so I get 5 or 6 attempts from the PM3
to log in with an account name "admin". admin is NOT in Emerald nor do I
want it to be. This is filling my server logs rather quickly. I thought
it was the monitoring from "What's Up" so I turned it off and got the same
results.

Login-Host = 207.112.212.26 is the Win95 machine running "What's Up", and
occasionally "AMBER" or "PMConsole". Neither of these programs attempt an
"admin" login to the best of my knowledge. I do telnet to the PM from this
machine and log in as !root.

I get 5 or 6 attempts in a row, every minute. This is driving me nuts.

radrecv: Request from host cf70d413 code=4, id=1, length=79
Acct-Session-Id = "0B000001"
User-Name = "admin"
NAS-Identifier = 207.112.212.19
Acct-Status-Type = Start
Acct-Authentic = Local
User-Service = Shell-User
Login-Service = Telnet
Login-Host = 207.112.212.26
Acct-Delay-Time = 151197

SQL Statement: INSERT INTO Calls (CallDate,AcctSessionId,UserName,NASIdentif
ier,AcctStatusType,UserService,AcctDelayTime) VALUES (GetDate(),'0B000001','a
dmin','207.112.212.19',1,6,151197)

ODBC: SQLExecDirect Error 233:
[Microsoft][ODBC SQL Server Driver][SQL Server]The column NASPort in table C
alls may not be null.

Resp Time: 240 Auth: 175/266 -> 441 Acct: 16/38575/7 -> 38598

John C. Lange, Sr. PALACE dot NET, INC.
microjl@palacenet.net MICRO-TECH Computers, Inc.
608.742.1601 & 6980 2800 New Pinery Road
http://www.palacenet.net/ Portage, WI 53901
Visit our online store @ http://www.microt.com/
Authorized iPSwitch WebVar @ http://www.microt.com/iPSwitch/index.html

--- __o
--- _-\<,_ Fastest Service in Town
--- (_)/ (_)