[RadiusNT] Bad Password!

Bisser Hadjimarkov ( bisser@mobiltel.bg )
Tue, 20 Jul 1999 18:24:33 +0300

Hi all

I use RadiusNT Enterprise version 2.5.175.

WinNT 4.0 with SP 5
SQL 6.5 with SP 5
Bay Networks RAC8000
Cisco 2511

I start RadiusNT in full debug mode ( radius -x15 )
and Authentication failed for users with granted access and
corect password.

See fragments from Debug Logs

See carefully fragment or similar
?????? (WINNT) User:àdÔ Domain: Password:GeOSvENgBi ??????
What is this? Wrong pointer OR ???????????

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

radrecv: Request from host c0a8fe01 code=1, id=63, length=78
NAS-Identifier = 192.168.254.1
NAS-Port = 15
NAS-Port-Type = Async
User-Name = "standart"
Password = "*\357\375f\351\201\305\001\374\264w/\343\343\232\001"
User-Service = Framed-User
Framed-Protocol = PPP
rad_authenticate_ODBC()

SQL Statement: Select DateDiff(Minute, GetDate(), DateAdd(Day,
(ma.Extension+ma.OverDue+1), maExpireDate)), DateDiff(Minute, GetDate(),

DateAdd(Day, sa.Extension+1, saExpireDate)), sa.AccountID,
sa.AccountType, sa.Password, sa.Login, sa.Shell From MasterAccounts ma,
SubAccounts sa Where sa.Login='standart' AND
ma.CustomerID=sa.CustomerID and sa.Active<>0 and ma.Active<>0

(WINNT) User:User-Service Domain: Password:zisula1299
Decrypted Password: zisula1299
Database Password: WINNT
Sending Reject of id 63 to c0a8fe01 (lasthope)
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

radrecv: Request from host c0a8fe01 code=1, id=64, length=78
NAS-Identifier = 192.168.254.1
NAS-Port = 15
NAS-Port-Type = Async
User-Name = "standart"
Password = "m\354\200p\2604@~\001\204\240\266\201}GR"
User-Service = Framed-User
Framed-Protocol = PPP
rad_authenticate_ODBC()

SQL Statement: Select DateDiff(Minute, GetDate(), DateAdd(Day,
(ma.Extension+ma.OverDue+1), maExpireDate)), DateDiff(Minute, GetDate(),

DateAdd(Day, sa.Extension+1, saExpireDate)), sa.AccountID,
sa.AccountType, sa.Password, sa.Login, sa.Shell From MasterAccounts ma,
SubAccounts sa Where sa.Login='standart' AND
ma.CustomerID=sa.CustomerID and sa.Active<>0 and ma.Active<>0

(WINNT) User:PÔ Domain: Password:zisula1299
Decrypted Password: zisula1299
Database Password: WINNT
Sending Reject of id 64 to c0a8fe01 (lasthope)

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

radrecv: Request from host c20cf3c1 code=1, id=232, length=98
User-Name = "Povo"
Password = "\353\325eX\243\2658\376\361\357\256\200%\020\242\345"
User-Service = Framed-User
Framed-Protocol = PPP
NAS-Identifier = 194.12.243.193
Framed-Address = 194.12.243.211
NAS-Port = 53
NAS-Port-Type = Async
Received unknown attribute 80, vendor 0
rad_authenticate_ODBC()

SQL Statement: Select DateDiff(Minute, GetDate(), DateAdd(Day,
(ma.Extension+ma.OverDue+1), maExpireDate)), DateDiff(Minute, GetDate(),

DateAdd(Day, sa.Extension+1, saExpireDate)), sa.AccountID,
sa.AccountType, sa.Password, sa.Login, sa.Shell From MasterAccounts ma,
SubAccounts sa Where sa.Login='Povo' AND ma.CustomerID=sa.CustomerID
and sa.Active<>0 and ma.Active<>0

(WINNT) User:FramedProtocol Domain: Password:begemott
Decrypted Password: begemott
Database Password: WINNT
Sending Reject of id 232 to c20cf3c1 (SOFIA)

SQL Statement: INSERT INTO RadLogs(RadLogMsgID, LogDate, Username,
Data, CallerID) VALUES (11, GetDate(), 'Povo', 'begemott', NULL)

User: Povo Bad Password
Resp Time: 3294 Auth: 13/13 -> 26 Acct: 27/0/0 -> 27

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

radrecv: Request from host c20cf3c1 code=1, id=235, length=103
User-Name = "valentina"
Password = "G\243\264\030\330\306\272:\255:\320\177V\024\003\266"
User-Service = Framed-User
Framed-Protocol = PPP
NAS-Identifier = 194.12.243.193
Framed-Address = 194.12.243.214
NAS-Port = 37
NAS-Port-Type = Async
Received unknown attribute 80, vendor 0
rad_authenticate_ODBC()

SQL Statement: Select DateDiff(Minute, GetDate(), DateAdd(Day,
(ma.Extension+ma.OverDue+1), maExpireDate)), DateDiff(Minute, GetDate(),

DateAdd(Day, sa.Extension+1, saExpireDate)), sa.AccountID,
sa.AccountType, sa.Password, sa.Login, sa.Shell From MasterAccounts ma,
SubAccounts sa Where sa.Login='valentina' AND
ma.CustomerID=sa.CustomerID and sa.Active<>0 and ma.Active<>0

(WINNT) User: µÔ Domain: Password:svetlina
Decrypted Password: svetlina
Database Password: WINNT
Sending Reject of id 235 to c20cf3c1 (SOFIA)

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

radrecv: Request from host c20cf3c1 code=1, id=237, length=98
User-Name = "Sony"
Password = "?$~\263U\277\205-Q\3676&\351Z\037\340"
User-Service = Framed-User
Framed-Protocol = PPP
NAS-Identifier = 194.12.243.193
Framed-Address = 194.12.243.209
NAS-Port = 55
NAS-Port-Type = Async
Received unknown attribute 80, vendor 0
rad_authenticate_ODBC()

SQL Statement: Select DateDiff(Minute, GetDate(), DateAdd(Day,
(ma.Extension+ma.OverDue+1), maExpireDate)), DateDiff(Minute, GetDate(),

DateAdd(Day, sa.Extension+1, saExpireDate)), sa.AccountID,
sa.AccountType, sa.Password, sa.Login, sa.Shell From MasterAccounts ma,
SubAccounts sa Where sa.Login='Sony' AND ma.CustomerID=sa.CustomerID
and sa.Active<>0 and ma.Active<>0

(WINNT) User:Áó
 Domain: Password:123456
Decrypted Password: 123456
Database Password: WINNT
Sending Reject of id 237 to c20cf3c1 (SOFIA)

SQL Statement: INSERT INTO RadLogs(RadLogMsgID, LogDate, Username,
Data, CallerID) VALUES (11, GetDate(), 'Sony', '123456', NULL)

User: Sony Bad Password
Resp Time: 3325 Auth: 19/23 -> 42 Acct

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

radrecv: Request from host c20cf3c1 code=1, id=239, length=100
User-Name = "SpEeDy"
Password = "\035w\362U\377\0056ss\013md\266\304\233\026"
User-Service = Framed-User
Framed-Protocol = PPP
NAS-Identifier = 194.12.243.193
Framed-Address = 194.12.243.219
NAS-Port = 11
NAS-Port-Type = Async
Received unknown attribute 80, vendor 0
rad_authenticate_ODBC()

SQL Statement: Select DateDiff(Minute, GetDate(), DateAdd(Day,
(ma.Extension+ma.OverDue+1), maExpireDate)), DateDiff(Minute, GetDate(),

DateAdd(Day, sa.Extension+1, saExpireDate)), sa.AccountID,
sa.AccountType, sa.Password, sa.Login, sa.Shell From MasterAccounts ma,
SubAccounts sa Where sa.Login='SpEeDy' AND ma.CustomerID=sa.CustomerID

and sa.Active<>0 and ma.Active<>0

(WINNT) User:Æó
 Domain: Password:GeOSvENgBi
Decrypted Password: GeOSvENgBi
Database Password: WINNT
Sending Reject of id 239 to c20cf3c1 (SOFIA)

SQL Statement: INSERT INTO RadLogs(RadLogMsgID, LogDate, Username,
Data, CallerID) VALUES (11, GetDate(), 'SpEeDy', 'GeOSvENgBi', NULL)

User: SpEeDy Bad Password
Resp Time: 3305 Auth: 20/24 -> 44 Acct: 38/0/0 -> 38

radrecv: Request from host c20cf3c1 code=1, id=240, length=100
User-Name = "SpEeDy"
Password = "2\273\2073vD\363\3533\023\241\347\020\356\317\012"
User-Service = Framed-User
Framed-Protocol = PPP
NAS-Identifier = 194.12.243.193
Framed-Address = 194.12.243.219
NAS-Port = 11
NAS-Port-Type = Async
Received unknown attribute 80, vendor 0
rad_authenticate_ODBC()

SQL Statement: Select DateDiff(Minute, GetDate(), DateAdd(Day,
(ma.Extension+ma.OverDue+1), maExpireDate)), DateDiff(Minute, GetDate(),

DateAdd(Day, sa.Extension+1, saExpireDate)), sa.AccountID,
sa.AccountType, sa.Password, sa.Login, sa.Shell From MasterAccounts ma,
SubAccounts sa Where sa.Login='SpEeDy' AND ma.CustomerID=sa.CustomerID

and sa.Active<>0 and ma.Active<>0

(WINNT) User:SpEeDy Domain: Password:GeOSvENgBi
Checking for duplicate logins.

SQL Statement: RadCheckOnline 'SpEeDy'

SpEeDy found on-line 0 time(s).

SQL Statement: RadGetConfigs 625

SQL Statement: RadGetATConfigs 'PPP'

Sending Ack of id 240 to c20cf3c1 (SOFIA)
User-Service = Framed-User
Framed-Protocol = PPP
Resp Time: 321 Auth: 21/24 -> 45 Acct: 38/0/0 -> 38

radrecv: Request from host c20cf3c1 code=4, id=102, length=104
Acct-Status-Type = Start
Acct-Session-Id = "f80f03d8"
Acct-Delay-Time = 1
NAS-Port = 11
NAS-Port-Type = Async
Received unknown attribute 60, vendor 1584
User-Name = "SpEeDy"
User-Service = Framed-User
Framed-Protocol = PPP
Acct-Authentic = RADIUS
Framed-Address = 194.12.243.219
NAS-Identifier = 194.12.243.193

SQL Statement: INSERT INTO Calls
(CallDate,AcctStatusType,AcctSessionId,AcctDelayTime,NASPort,UserName,FramedAddress,NASIdentifier)

VALUES
(GetDate(),1,'f80f03d8',1,11,'SpEeDy','194.12.243.219','194.12.243.193')

SQL Statement: UPDATE CallsOnline Set
Username='SpEeDy',AcctStatusType=1, CallDate=GetDate(),
FramedAddress='194.12.243.219' WHERE NASIdentifier='194.12.243.193' and
NASPort=11 AND (DateAdd(Second, 0-1, GetDate()) >= CallDate OR
CallDate IS NULL)

Sending Accounting Ack of id 102 to c20cf3c1 (SOFIA)
Resp Time: 30 Auth: 21/24 -> 45 Acct: 39/0/0 -> 39

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

radrecv: Request from host c20cf3c1 code=1, id=243, length=100
User-Name = "SpEeDy"
Password = "\362n:\304+h\315\360-\312,\243I\214\212\271"
User-Service = Framed-User
Framed-Protocol = PPP
NAS-Identifier = 194.12.243.193
Framed-Address = 194.12.243.220
NAS-Port = 9
NAS-Port-Type = Async
Received unknown attribute 80, vendor 0
rad_authenticate_ODBC()

SQL Statement: Select DateDiff(Minute, GetDate(), DateAdd(Day,
(ma.Extension+ma.OverDue+1), maExpireDate)), DateDiff(Minute, GetDate(),

DateAdd(Day, sa.Extension+1, saExpireDate)), sa.AccountID,
sa.AccountType, sa.Password, sa.Login, sa.Shell From MasterAccounts ma,
SubAccounts sa Where sa.Login='SpEeDy' AND ma.CustomerID=sa.CustomerID

and sa.Active<>0 and ma.Active<>0

(WINNT) User:àdÔ Domain: Password:GeOSvENgBi
Decrypted Password: GeOSvENgBi
Database Password: WINNT
Sending Reject of id 243 to c20cf3c1 (SOFIA)

SQL Statement: INSERT INTO RadLogs(RadLogMsgID, LogDate, Username,
Data, CallerID) VALUES (11, GetDate(), 'SpEeDy', 'GeOSvENgBi', NULL)

User: SpEeDy Bad Password
Resp Time: 3285 Auth: 24/41 -> 65 Acct: 48/0/0 -> 48

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Thank you in advance,
Bisser Hadjimarkov.

For more information about this list (including removal) go to:
http://www.iea-software.com/support/maillists/liststart