Size Limitations on clients.conf

2007-04-22 Thread Alexander Papenburg
Hi,

iam just wondering if there are any size limitations on the 
clients.conf file.

Background is:
The current file consist of many /24 net-ranges and is currently 22k big ;)
For the past days I recognised some strange activities but unfortunately 
only saw the
following in the log:
.
Auth: Login incorrect (Home Server says so): [aaliyah] (from client 
INET-X.X.X.X/16 port 2 cli A.B.C.D)
.

Obviously A.B.C.D tries a Word-List-Attack on one device in the range 
but  I can't figure out on which one
without going into debugging mode. So I hacked a quick and dirty perl 
script which generate a clients.conf
with single ip's which is about 17M big  ^^

Is there a better way?


Thanks,

Alex
- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html


Re: Size Limitations on clients.conf

2007-04-22 Thread Alan DeKok
Alexander Papenburg wrote:
 iam just wondering if there are any size limitations on the
 clients.conf file.

  How much memory do you have?  That's the limit.

 Background is:
 The current file consist of many /24 net-ranges and is currently 22k big ;)
 For the past days I recognised some strange activities but unfortunately 
 only saw the
 following in the log:
 .
 Auth: Login incorrect (Home Server says so): [aaliyah] (from client 
 INET-X.X.X.X/16 port 2 cli A.B.C.D)
 .
 
 Obviously A.B.C.D tries a Word-List-Attack on one device in the range 
 but  I can't figure out on which one
 without going into debugging mode. So I hacked a quick and dirty perl 
 script which generate a clients.conf
 with single ip's which is about 17M big  ^^

  Why not just run 'radnsiff'?

  Alan DeKok.
--
  http://deployingradius.com   - The web site of the book
  http://deployingradius.com/blog/ - The blog
- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html


Re: Size Limitations on clients.conf

2007-04-22 Thread Peter Nixon
On Sun 22 Apr 2007, Alexander Papenburg wrote:
 Hi,

 iam just wondering if there are any size limitations on the
 clients.conf file.

 Background is:
 The current file consist of many /24 net-ranges and is currently 22k big
 ;) For the past days I recognised some strange activities but
 unfortunately only saw the
 following in the log:
 .
 Auth: Login incorrect (Home Server says so): [aaliyah] (from client
 INET-X.X.X.X/16 port 2 cli A.B.C.D)
 .

 Obviously A.B.C.D tries a Word-List-Attack on one device in the range
 but  I can't figure out on which one
 without going into debugging mode. 

Why dont you log failed auth to a detail file or database?

Cheers
-- 

Peter Nixon
http://www.peternixon.net/
PGP Key: http://www.peternixon.net/public.asc
- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html