April 2013 - Freeradius-Users - lists.freeradius.org

Real server certificate for PEAP
by Rudolf Henze 03 Apr '13

03 Apr '13

3 3

CoA proxy error
by Mehdi Ravanbakhsh 02 Apr '13

02 Apr '13

Hi All : i have get this error in log after setup COA-originate in site-enable : WARNING: No previous template for proxy socket. Source IP address may be chosen by the OS ... adding new socket proxy address * port 16288 ERROR: Failed to insert CoA request into proxy list. ---------------------------------------- * clent.conf : * client lar { ipaddr = 5.190.103.4 secret = testing123 require_message_authenticator = no nastype = other coa_server = lar } *coa-originate :* home_server lar { type = coa ipaddr = 5.190.103.4 port = 1700 secret = testing123 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool main { type = fail-over home_server = lar } *default config :* preacct { update disconnect { User-Name = "%{User-Name}" Acct-Session-Id = "%{Acct-Session-Id}" NAS-IP-Address = "%{NAS-IP-Address}" } }

2 2

originate-coa virtual server for each NAS
by Mehdi Ravanbakhsh 02 Apr '13

02 Apr '13

Hi All do we need separated originate-coa in site enable for each NAS ? Do we need to define "coa_server = coa " in client.conf for each client?

1 0

disconnect packet
by Mehdi Ravanbakhsh 02 Apr '13

02 Apr '13

Hi All we can use Update control in unlang? so if that possible in witch file or tables parameter of coa such as port and ip address is set? i read orginate COA but it not be clear that how i can use coa for disconnect user in unlang . can explane step of work to use update coa in unlang.. please. Best regards.

2 1

Re: Real server certificate for PEAP
by Alan Buxey 02 Apr '13

02 Apr '13

A self-signed is real. It's just that you are the CA...which actually gives you greater security and keeps your authentication under your own destiny control. If you believe that having a RADIUS server signed by a CA that is in the OS of your clients is the way you want to go, then simply go and buy a cert from eg thawte, verisign etc. alan

1 0

Don't log user pass to database
by Dmitry Korzhevin 02 Apr '13

02 Apr '13

Hi, Guys, please tell - how prevent freeradius to log pass to radpostauth mysql (MariaDB) table? I have modified /etc/freeradius/modules section to: Post-Auth = "INSERT INTO ${postauth_table} \ (username, reply, authdate) VALUES \ ('%{User-Name}', \ %{reply:Packet-Type}', '%S');" But, seems this not helps, as i see user passwords in database. Best Regards, Dmitry --- Dmitry KORZHEVIN System Administrator STIDIA S.A. - Luxembourg e: dmitry.korzhevin(a)stidia.com m: +38 093 874 5453 w: http://www.stidia.com

3 2

Freeradius "Expire-After" How To .. ?
by Russell Mike 02 Apr '13

02 Apr '13

Hi List, i need to expire the prepaid card after three months of first login. after reading mail achieves, i was able to figured out that i need to use " Expire-After" FR attribute and value in seconds. i was bit of unclear how to bring the module in to the action because i am unable to locate "Expire-After" attribute to users (Through Daloradius). Someone please help ... # Default Module Came With FR v2.2 sqlcounter expire_on_login { counter-name = Expire-After-Initial-Login check-name = Expire-After sqlmod-inst = sql key = User-Name reset = never query = "SELECT TIME_TO_SEC(TIMEDIFF(NOW(), acctstarttime)) \ FROM radacct \ WHERE UserName='%{${key}}' \ ORDER BY acctstarttime \ LIMIT 1;" } Thanks / Regards RM --

2 2

Re: don't wait rlm_sql response
by Mitsuhiro Nakamura 02 Apr '13

02 Apr '13

Yes we use sql only for accounting. We will try decoupled accounting then. There are some complex problems on our DB, the team and DBA are working on it too.Thank you for the advice. Thank you all for your help :) Nakamura > On Tue, Apr 2, 2013 at 9:13 AM, Mitsuhiro Nakamura <[hidden email]> wrote: > > Alan, > > Thank you. > Our database has some problem and the response is slow. > Since the problem itself seems to take long time to fix it, we wanted to > avoid it. > > > > Are you using sql ONLY for accounting? > > If yes, then Olivier's suggestion on using decoupled accounting might help. In fact, on some scenarios where the db is actually fast but has a somewhat high latency (e.g. mysql cluster), I'd highly recommend that. > > However, since you say the db response is slow, you'd only be putting band-aid on the wound. The detail file reader may very likely end up hours or days behind the actual accounting packet. > > If there is no way to do, then we will try to find the otherway. > > > Fix the db. It's the right thing to do. > > The usual causes are: > - too much data (e.g. tens of millions of rows from years of accounting data in a single table) > - inefficient indices (too many index which slows down writes, or no index used which slows down reads) > - not enough disk IOPS available (e.g. using 2 x HDD in mirror mode for a db with hundreds of writes requirement per second) > - default, untuned db > > A qualified dba should be able to help you. > > -- > Fajar >

1 0

don't wait rlm_sql response
by Mitsuhiro Nakamura 02 Apr '13

02 Apr '13

Hi all, When using rlm_sql, it always wait for response from database. Is there any way to configure to avoid it? (We don't wanna wait for its result after prosessing) accounting { detail sql <-wish to prosess it here without waiting for result } We'd appreciate if anyone can answer this promptly. Thank you,

4 4

auto-config of 802.1x supplicant windows 8 fail (wpa2-ent/peap)
by mike.albano＠unlv.edu 01 Apr '13

01 Apr '13

Trying post again (hopefully html email turned off this time). If someone knows how to delete a previous/duplicate post let me know.: I've been running FR for a while w/ out issue. Windows 8, however fails, when using auto-config (selecting the network and letting Windows figure out supplicant settings). I believe it's failing b/c of: "[mschap] FAILED: MS-CHAP2-Response is incorrect" This only happens on Windows 8 "auto-configuration" of it's 802.1x supplicant. In other words, if I manually add the network, selecting only "wpa2-enterprise", it works. It also works on OSX, Linux, Android and every other version of Windows, using 'autoconfiguration'...ie I do not need to manually configure the supplicant. I've debugged my wireless lan controller, but nothing interesting (I can attach if requested). It shows the EAP messages back/forth endinig up with processing the Access-Reject packet. Like many environments, I'm doing PEAP, with an OpenLDAP directory, though for this test the user is local. (test user is 'steve') I've got VM's of fresh-installed Win8 & Win7, passing same USB wireless NIC & same driver version. As previously mentioned, Win7 works with no manual supplicant configuration. I've included the -X at the bottom of the win7 auth. I do not believe this to be a FR issue, but I am wondering if anyone else has seen this. We are a large campus with ~30K auth's/day, though I'm concerned that Win8 is new enough that we havn't had any complaints yet. dpkg -l | grep freerad ii freeradius 2.1.12+dfsg-1.1 amd64 high-performance and highly configurable RADIUS server ii freeradius-common 2.1.12+dfsg-1.1 all FreeRADIUS common files ii freeradius-ldap 2.1.12+dfsg-1.1 amd64 LDAP module for FreeRADIUS server ii freeradius-utils 2.1.12+dfsg-1.1 amd64 FreeRADIUS client utilities ii libfreeradius2 2.1.12+dfsg-1.1 amd64 FreeRADIUS shared library Debugs at pastebin (too large): http://pastebin.com/gXhwSzZb

1 0