- Freeradius-Users - lists.freeradius.org

freeradius 2.2 COA capability
by Mehdi Ravanbakhsh 05 Apr '13

05 Apr '13

hi all freeradius 2.2 can support COA (for something like changing bandwidth) or just can handel POD?

1 0

update coa not working
by Mehdi Ravanbakhsh 03 Apr '13

03 Apr '13

Hi all i configure all config file to use COA . i can use update disconnect and it work will in all section , but update coa is not working. i read all file for 10 times but can not find where is the problem. in log file i can not find any message that related to update COA in any section. my config file : * clent.conf : * client lar { ipaddr = 5.190.103.4 secret = testing123 require_message_authenticator = no nastype = other coa_server = lar } *coa-originate :* home_server lar { type = coa ipaddr = 5.190.103.4 port = 1700 secret = testing123 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool main { type = fail-over home_server = lar } server originate-coa.lar { pre-proxy { # update proxy-request { # NAS-IP-Address = 127.0.0.1 # } ok } # # Handle the responses here. # post-proxy { switch "%{proxy-reply:Packet-Type}" { case CoA-ACK { ok } case CoA-NAK { # the NAS didn't like the CoA request ok } case Disconnect-ACK { ok } case Disconnect-NAK { # the NAS didn't like the Disconnect request ok } # Invalid packet type. This shouldn't happen. case { fail } } # # These methods are run when there is NO response # to the request. # Post-Proxy-Type Fail-CoA { ok } Post-Proxy-Type Fail-Disconnect { ok } } } *default config :* preacct { update coa { User-Name = "%{User-Name}" Acct-Session-Id = "%{Acct-Session-Id}" NAS-IP-Address = "%{NAS-IP-Address}" Mikrotik-Rate-Limit = "256K/256K" } } -------------------

1 0

Real server certificate for PEAP
by Rudolf Henze 03 Apr '13

03 Apr '13

3 3

CoA proxy error
by Mehdi Ravanbakhsh 02 Apr '13

02 Apr '13

Hi All : i have get this error in log after setup COA-originate in site-enable : WARNING: No previous template for proxy socket. Source IP address may be chosen by the OS ... adding new socket proxy address * port 16288 ERROR: Failed to insert CoA request into proxy list. ---------------------------------------- * clent.conf : * client lar { ipaddr = 5.190.103.4 secret = testing123 require_message_authenticator = no nastype = other coa_server = lar } *coa-originate :* home_server lar { type = coa ipaddr = 5.190.103.4 port = 1700 secret = testing123 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool main { type = fail-over home_server = lar } *default config :* preacct { update disconnect { User-Name = "%{User-Name}" Acct-Session-Id = "%{Acct-Session-Id}" NAS-IP-Address = "%{NAS-IP-Address}" } }

2 2

originate-coa virtual server for each NAS
by Mehdi Ravanbakhsh 02 Apr '13

02 Apr '13

Hi All do we need separated originate-coa in site enable for each NAS ? Do we need to define "coa_server = coa " in client.conf for each client?

1 0

disconnect packet
by Mehdi Ravanbakhsh 02 Apr '13

02 Apr '13

Hi All we can use Update control in unlang? so if that possible in witch file or tables parameter of coa such as port and ip address is set? i read orginate COA but it not be clear that how i can use coa for disconnect user in unlang . can explane step of work to use update coa in unlang.. please. Best regards.

2 1

Re: Real server certificate for PEAP
by Alan Buxey 02 Apr '13

02 Apr '13

A self-signed is real. It's just that you are the CA...which actually gives you greater security and keeps your authentication under your own destiny control. If you believe that having a RADIUS server signed by a CA that is in the OS of your clients is the way you want to go, then simply go and buy a cert from eg thawte, verisign etc. alan

1 0

Don't log user pass to database
by Dmitry Korzhevin 02 Apr '13

02 Apr '13

Hi, Guys, please tell - how prevent freeradius to log pass to radpostauth mysql (MariaDB) table? I have modified /etc/freeradius/modules section to: Post-Auth = "INSERT INTO ${postauth_table} \ (username, reply, authdate) VALUES \ ('%{User-Name}', \ %{reply:Packet-Type}', '%S');" But, seems this not helps, as i see user passwords in database. Best Regards, Dmitry --- Dmitry KORZHEVIN System Administrator STIDIA S.A. - Luxembourg e: dmitry.korzhevin(a)stidia.com m: +38 093 874 5453 w: http://www.stidia.com

3 2

Freeradius "Expire-After" How To .. ?
by Russell Mike 02 Apr '13

02 Apr '13

Hi List, i need to expire the prepaid card after three months of first login. after reading mail achieves, i was able to figured out that i need to use " Expire-After" FR attribute and value in seconds. i was bit of unclear how to bring the module in to the action because i am unable to locate "Expire-After" attribute to users (Through Daloradius). Someone please help ... # Default Module Came With FR v2.2 sqlcounter expire_on_login { counter-name = Expire-After-Initial-Login check-name = Expire-After sqlmod-inst = sql key = User-Name reset = never query = "SELECT TIME_TO_SEC(TIMEDIFF(NOW(), acctstarttime)) \ FROM radacct \ WHERE UserName='%{${key}}' \ ORDER BY acctstarttime \ LIMIT 1;" } Thanks / Regards RM --

2 2

Re: don't wait rlm_sql response
by Mitsuhiro Nakamura 02 Apr '13

02 Apr '13

Yes we use sql only for accounting. We will try decoupled accounting then. There are some complex problems on our DB, the team and DBA are working on it too.Thank you for the advice. Thank you all for your help :) Nakamura > On Tue, Apr 2, 2013 at 9:13 AM, Mitsuhiro Nakamura <[hidden email]> wrote: > > Alan, > > Thank you. > Our database has some problem and the response is slow. > Since the problem itself seems to take long time to fix it, we wanted to > avoid it. > > > > Are you using sql ONLY for accounting? > > If yes, then Olivier's suggestion on using decoupled accounting might help. In fact, on some scenarios where the db is actually fast but has a somewhat high latency (e.g. mysql cluster), I'd highly recommend that. > > However, since you say the db response is slow, you'd only be putting band-aid on the wound. The detail file reader may very likely end up hours or days behind the actual accounting packet. > > If there is no way to do, then we will try to find the otherway. > > > Fix the db. It's the right thing to do. > > The usual causes are: > - too much data (e.g. tens of millions of rows from years of accounting data in a single table) > - inefficient indices (too many index which slows down writes, or no index used which slows down reads) > - not enough disk IOPS available (e.g. using 2 x HDD in mirror mode for a db with hundreds of writes requirement per second) > - default, untuned db > > A qualified dba should be able to help you. > > -- > Fajar >

1 0