- Freeradius-Users - lists.freeradius.org

help with proxy settings for EDUROAM
by Hocine M 21 Jan '13

21 Jan '13

Hello, Could anyone help me? I'm trying setting up freeradius 2.1.12 for eduroam. The local auth works well, but the proxy part not so. here is the configuration : RADIUSD.CONF : prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct name = freeradius confdir = ${raddbdir} run_dir = ${localstatedir}/run/${name} db_dir = ${raddbdir} libdir = /usr/lib/freeradius pidfile = ${run_dir}/${name}.pid user = freerad group = freerad max_request_time = 30 cleanup_delay = 5 max_requests = 1024 listen { type = auth ipaddr = * port = 0 } listen { ipaddr = * port = 0 type = acct } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = no auth_badpass = no auth_goodpass = no } checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = yes } proxy_requests = yes $INCLUDE proxy.conf $INCLUDE clients.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { $INCLUDE ${confdir}/modules/ $INCLUDE eap.conf $INCLUDE sql.conf } instantiate { exec expr expiration logintime } $INCLUDE policy.conf $INCLUDE sites-enabled/ site-enabled/default : authorize { preprocess if ("%{Called-Station-Id}" =~ /^([0-9A-F]{2}:){5}[0-9A-F]{2}:L3Invites$/) { sql_l3invites } elsif ("%{User-Name}" =~ /.*@.*/) { ok } else { update reply { Reply-Message := "%{User-Name} : Format Identifiant non valide!" } reject } mschap suffix eap { ok = return } pap } authenticate { Auth-Type PAP { pap } Auth-Type MS-CHAP { mschap } eap } preacct { preprocess acct_unique suffix files } accounting { sql_acct exec attr_filter.accounting_response } session { } post-auth { reply_log update reply { Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" } if ("%{User-Name}" == "L3Invite") { update reply { Tunnel-Private-Group-Id := "53" } } switch "%{Realm}" { case "univ-lille3.fr" { update reply { Tunnel-Private-Group-Id := "54" } } case "etu.univ-lille3.fr" { update reply { Tunnel-Private-Group-Id := "55" } } case "ext.univ-lille3.fr" { update reply { Tunnel-Private-Group-Id := "50" } } } exec Post-Auth-Type REJECT { attr_filter.access_reject linelog } } pre-proxy { pre_proxy_log } post-proxy { post_proxy_log eap Post-Proxy-Type Fail { post_proxy_fail_log } } PROXY.CONF : proxy server { default_fallback = no retry_delay = 5 retry_count = 3 dead_time = 600 } home_server localhost { type = auth ipaddr = 127.0.0.1 port = 1812 secret = testing123 require_message_authenticator = yes response_window = 20 zombie_period = 40 revive_interval = 120 status_check = status-server check_interval = 30 num_answers_to_alive = 3 max_outstanding = 65536 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } realm NULL { } realm univ-lille3.fr { type = radius authhost = LOCAL accthost = LOCAL nostrip } realm etu.univ-lille3.fr { type = radius authhost = LOCAL accthost = LOCAL nostrip } realm ext.univ-lille3.fr { type = radius authhost = LOCAL accthost = LOCAL nostrip } realm DEFAULT { type = radius authhost = rad1.eduroam.fr:1812 accthost = rad1.eduroam.fr:1813 secret = ********************************** nostrip } realm DEFAULT { type = radius authhost = rad2.eduroam.fr:1812 accthost = rad2.eduroam.fr:1813 secret = ************************************ nostrip } CLIENTS.CONF : client localhost { ipaddr = 127.0.0.1 secret = ******* require_message_authenticator = yes } client 193.51.224.109 { secret = **************************** shortname = rad1.eduroam.fr } client 130.79.200.23 { secret = **************************** shortname = rad2.eduroam.fr } client ******* { secret = ********** shortname = MX800R-1 nastype = trapeze } client ******** { secret = *********** shortname = MX800R-2 nastype = trapeze } debug -XX rad_recv: Access-Request packet from host 192.168.58.5 port 20009, id=46, length=176 NAS-Port-Id = "AP42/1" Calling-Station-Id = "74-2F-68-ED-12-1C" Called-Station-Id = "00-0B-0E-94-89-40:eduroam" Service-Type = Framed-User EAP-Message = 0x0201001a016573757064656d40756e69762d726f75656e2e6672 User-Name = "esupdem(a)univ-rouen.fr" NAS-Port = 57286 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 192.168.58.5 NAS-Identifier = "Trapeze" Message-Authenticator = 0x6830881b1c96c187831ae1494d8e8f2a Mon Jan 21 15:29:46 2013 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/eduroam Mon Jan 21 15:29:46 2013 : Info: +- entering group authorize {...} Mon Jan 21 15:29:46 2013 : Info: ++[preprocess] returns ok Mon Jan 21 15:29:46 2013 : Info: ++? if ("%{Called-Station-Id}" =~ /^([0-9A-F]{2}:){5}[0-9A-F]{2}:L3Invites$/) Mon Jan 21 15:29:46 2013 : Info: expand: %{Called-Station-Id} -> 00-0B-0E-94-89-40:eduroam Mon Jan 21 15:29:46 2013 : Info: ? Evaluating ("%{Called-Station-Id}" =~ /^([0-9A-F]{2}:){5}[0-9A-F]{2}:L3Invites$/) -> FALSE Mon Jan 21 15:29:46 2013 : Info: ++? if ("%{Called-Station-Id}" =~ /^([0-9A-F]{2}:){5}[0-9A-F]{2}:L3Invites$/) -> FALSE Mon Jan 21 15:29:46 2013 : Info: ++? elsif ("%{User-Name}" =~ /.*@.*/) Mon Jan 21 15:29:46 2013 : Info: expand: %{User-Name} -> hidden Mon Jan 21 15:29:46 2013 : Info: ? Evaluating ("%{User-Name}" =~ /.*@.*/) -> TRUE Mon Jan 21 15:29:46 2013 : Info: ++? elsif ("%{User-Name}" =~ /.*@.*/) -> TRUE Mon Jan 21 15:29:46 2013 : Info: ++- entering elsif ("%{User-Name}" =~ /.*@.*/) {...} Mon Jan 21 15:29:46 2013 : Info: +++[ok] returns ok Mon Jan 21 15:29:46 2013 : Info: ++- elsif ("%{User-Name}" =~ /.*@.*/) returns ok Mon Jan 21 15:29:46 2013 : Info: ++ ... skipping else for request 228: Preceding "if" was taken Mon Jan 21 15:29:46 2013 : Info: ++[mschap] returns noop Mon Jan 21 15:29:46 2013 : Info: [suffix] Looking up realm hidden for User-Name = hidden Mon Jan 21 15:29:46 2013 : Info: [suffix] Found realm "DEFAULT" Mon Jan 21 15:29:46 2013 : Info: [suffix] Adding Realm = "DEFAULT" Mon Jan 21 15:29:46 2013 : Info: [suffix] Proxying request from user hidden to realm DEFAULT Mon Jan 21 15:29:46 2013 : Info: [suffix] Preparing to proxy authentication request to realm "DEFAULT" Mon Jan 21 15:29:46 2013 : Info: ++[suffix] returns updated Mon Jan 21 15:29:46 2013 : Info: [eap] Request is supposed to be proxied to Realm DEFAULT. Not doing EAP. Mon Jan 21 15:29:46 2013 : Info: ++[eap] returns noop Mon Jan 21 15:29:46 2013 : Info: ++[pap] returns noop Mon Jan 21 15:29:46 2013 : Info: # Executing section pre-proxy from file /etc/freeradius/sites-enabled/eduroam Mon Jan 21 15:29:46 2013 : Info: +- entering group pre-proxy {...} Mon Jan 21 15:29:46 2013 : Info: [pre_proxy_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.58.5/pre-proxy-detail-20130121 Mon Jan 21 15:29:46 2013 : Info: [pre_proxy_log] /var/log/freeradius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.58.5/pre-proxy-detail-20130121 Mon Jan 21 15:29:46 2013 : Info: [pre_proxy_log] expand: %t -> Mon Jan 21 15:29:46 2013 Mon Jan 21 15:29:46 2013 : Info: ++[pre_proxy_log] returns ok Sending Access-Request of id 243 to 193.51.224.109 port 1812 NAS-Port-Id = "AP42/1" Calling-Station-Id = "74-2F-68-ED-12-1C" Called-Station-Id = "00-0B-0E-94-89-40:eduroam" Service-Type = Framed-User EAP-Message = 0x0201001a016573757064656d40756e69762d726f75656e2e6672 User-Name = hidden NAS-Port = 57286 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 192.168.58.5 NAS-Identifier = "Trapeze" Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3436 Mon Jan 21 15:29:46 2013 : Info: Proxying request 228 to home server 193.51.224.109 port 1812 Sending Access-Request of id 243 to 193.51.224.109 port 1812 NAS-Port-Id = "AP42/1" Calling-Station-Id = "74-2F-68-ED-12-1C" Called-Station-Id = "00-0B-0E-94-89-40:eduroam" Service-Type = Framed-User EAP-Message = 0x0201001a016573757064656d40756e69762d726f75656e2e6672 User-Name = hidden NAS-Port = 57286 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 192.168.58.5 NAS-Identifier = "Trapeze" Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3436 Mon Jan 21 15:29:46 2013 : Debug: Going to the next request Mon Jan 21 15:29:46 2013 : Debug: Waking up in 0.9 seconds. Mon Jan 21 15:29:47 2013 : Debug: Waking up in 13.0 seconds. rad_recv: Access-Request packet from host 192.168.58.5 port 20009, id=46, length=176 Mon Jan 21 15:29:51 2013 : Info: Sending duplicate proxied request to home server 193.51.224.109 port 1812 - ID: 243 Sending Access-Request of id 243 to 193.51.224.109 port 1812 NAS-Port-Id = "AP42/1" Calling-Station-Id = "74-2F-68-ED-12-1C" Called-Station-Id = "00-0B-0E-94-89-40:eduroam" Service-Type = Framed-User EAP-Message = 0x0201001a016573757064656d40756e69762d726f75656e2e6672 User-Name =hidden NAS-Port = 57286 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 192.168.58.5 NAS-Identifier = "Trapeze" Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3436 Mon Jan 21 15:29:51 2013 : Debug: Waking up in 9.0 seconds. rad_recv: Access-Request packet from host 192.168.58.5 port 20009, id=46, length=176 Mon Jan 21 15:29:56 2013 : Info: Sending duplicate proxied request to home server 193.51.224.109 port 1812 - ID: 243 Sending Access-Request of id 243 to 193.51.224.109 port 1812 NAS-Port-Id = "AP42/1" Calling-Station-Id = "74-2F-68-ED-12-1C" Called-Station-Id = "00-0B-0E-94-89-40:eduroam" Service-Type = Framed-User EAP-Message = 0x0201001a016573757064656d40756e69762d726f75656e2e6672 User-Name = hidden NAS-Port = 57286 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 192.168.58.5 NAS-Identifier = "Trapeze" Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3436 Mon Jan 21 15:29:56 2013 : Debug: Waking up in 4.0 seconds. Mon Jan 21 15:30:00 2013 : Info: Cleaning up request 228 ID 46 with timestamp +1976 Mon Jan 21 15:30:00 2013 : Proxy: Marking home server 193.51.224.109 port 1812 as zombie (it looks like it is dead). Thanks

3 2

Starting RADIUS server: gdbm fatal: write error
by pamela pomary 21 Jan '13

21 Jan '13

Hello Folks I encountered an error - 'Starting RADIUS server: gdbm fatal: write error' while restarting my radius service this morning. Any help please!

1 1

sub-tlv data isn't copyed on FR 2.2.0
by 马俊峰 21 Jan '13

21 Jan '13

Reason: src/lib/radius.c static VALUE_PAIR *rad_vp2tlv(VALUE_PAIR *vps) { …… end = vp2data(NULL, NULL, NULL, vp, ptr + 2, tlv->vp_tlv + tlv->length - ptr); …… } static uint8_t *vp2data(const RADIUS_PACKET *packet, const RADIUS_PACKET *original, const char *secret, const VALUE_PAIR *vp, uint8_t *ptr, size_t room) { …… if (packet) switch (vp->flags.encrypt) { // packet is NULL, data isn't copyed. case FLAG_ENCRYPT_USER_PASSWORD: …… default: /* * Just copy the data over */ memcpy(ptr, data, len); break; } /* switch over encryption flags */ return ptr + len; } patched: diff old/src/lib/radius.c new/src/lib/radius.c 799a800,801 > else > memcpy(ptr, data, len);

1 0

No authenticate method (Auth-Type) found for the request
by Beeblebrox 20 Jan '13

20 Jan '13

I know you guys have received tons of e-mail with the same title, but I am just unable to fix this - sorry. Today I setup freeradius on a fresh install OpenWRT router. I found some tutorials, this one among them: http://jackofallit.wordpress.com/2012/02/15/turn-a-60-120-router-into-an-en… and started the configuration. The "initial radius test" and the "initial wifi radius test" were successful and I connected to the router. Later I did something wrong and now I am getting: : Info: +- entering group authorize {...} : Info: [eap] No EAP-Message, not doing EAP : Info: ++[eap] returns noop : Info: ++[files] returns noop : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. : Info: ++[pap] returns noop : Info: ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user : Info: Failed to authenticate the user. I have only modified: clients.conf and users. I have also generated new certificates (per tutorial) and maybe this is where the problem is? I also edited eap.conf section: private_key_password = mypass private_key_file = ${certdir}/server.key The service starts fine (radiusd -XX) but cannot authenticate even from localhost. I am not using LDAP / SQL or any other backend. Please give me some ideas on how I can debug the error. Thanks.

3 12

Re: No authenticate method (Auth-Type) found for the request
by Alan Buxey 18 Jan '13

18 Jan '13

...and then you did comment . And added more. It's open source and the documentation and Wikipedia is there for everyone.e to contribute. Don't like it? Feel free to show the world how you think it should look, or add the missing bits you have discovered. Unfortunately , what we get is people saying the docs are poor...that they found out how to do what they want...and never tell us. The next person who comes along then faces the same issue as the initial person was selfish. It's not a developer problem. alan

1 0

Re: Chap/Pap Authentication
by Alan Buxey 18 Jan '13

18 Jan '13

Forget the user-password. You are not using it, you are trying to kludge it. Just use the variable you have, or the facsimile you are making. This is freeradius, there are at least a dozen ways of doing what you want, Alan has given you a fine method alan

1 0

Chap/Pap Authentication
by Joseph Showalter 18 Jan '13

18 Jan '13

What we would like to do is this: Take this request: User-Name = "6064191111(a)evdo.myawi.net" CHAP-Password = 0x59db2896a9629a7a1296e8e3dc7751da58 NAS-IP-Address = 10.130.2.1 CHAP-Challenge = 0x022074534be2e8405c867f676b46b432 3GPP2-Attr-60 = 0x00000001 3GPP2-Attr-61 = 0x0106000000010209a0000029275c41 Message-Authenticator = 0x01f9054690c3a469fa1bf824dfba3bbe Proxy-State = 0x3136 And instead of using chap to authenticate the user, we take the 3GPP2-Attr-61, convert it to the password we want, set it into the cleartext-password, and have the sql module query the DB for that new password. Here is the perl code that we run prior to the pap module: $retattr .= "Cleartext-Password := $meid"; $retattr .= ", CHAP-Password :=\"\" , CHAP-Challenge :=\"\" "; $retattr .= ", Auth-Type := PAP "; We return the retattr to freeradius. Here is the output: Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} [preprocess] expand: %{NAS-IP-Address} -> 10.130.2.1 [preprocess] expand: %{NAS-IP-Address} -> 10.130.2.1 ++[preprocess] returns ok [evdoesn] expand: %{User-Name} -> 6064191111(a)evdo.myawi.net Exec-Program output: Cleartext-Password := 268435460102579521, CHAP-Password :="" , CHAP-Challenge :="" , Auth-Type := PAP Exec-Program-Wait: value-pairs: Cleartext-Password := 268435460102579521, CHAP-Password :="" , CHAP-Challenge :="" , Auth-Type := PAP Exec-Program: returned: 0 ++[evdoesn] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/10.55.42.32/auth-detail-20130118 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.55.42.32/auth-detail-20130118 [auth_log] expand: %t -> Fri Jan 18 11:06:43 2013 ++[auth_log] returns ok [sql] expand: %{User-Name} -> 6064191111(a)evdo.myawi.net [sql] sql_set_user escaped user --> '6064191111(a)evdo.myawi.net' rlm_sql (sql): Reserving sql socket id: 50 [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '6064191111(a)evdo.myawi.net' ORDER BY id rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '6064191111(a)evdo.myawi.net' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 5 WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [sql] User found in radcheck table [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '6064191111(a)evdo.myawi.net' ORDER BY id rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '6064191111(a)evdo.myawi.net' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 [sql] expand: SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}' -> SELECT GroupName FROM usergroup WHERE UserName='6064191111(a)evdo.myawi.net' rlm_sql_postgresql: query: SELECT GroupName FROM usergroup WHERE UserName='6064191111(a)evdo.myawi.net' rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 [sql] expand: SELECT radgroupcheck.id, radgroupcheck.GroupName, radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op FROM radgroupcheck, usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id -> SELECT radgroupcheck.id, radgroupcheck.GroupName, radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op FROM radgroupcheck, usergroup WHERE usergroup.Username = '6064191111(a)evdo.myawi.net' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id rlm_sql_postgresql: query: SELECT radgroupcheck.id, radgroupcheck.GroupName, radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op FROM radgroupcheck, usergroup WHERE usergroup.Username = '6064191111(a)evdo.myawi.net' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 [sql] User found in group evdo [sql] expand: SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, radgroupreply.Value, radgroupreply.Op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id -> SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, radgroupreply.Value, radgroupreply.Op FROM radgroupreply,usergroup WHERE usergroup.Username = '6064191111(a)evdo.myawi.net' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql_postgresql: query: SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, radgroupreply.Value, radgroupreply.Op FROM radgroupreply,usergroup WHERE usergroup.Username = '6064191111(a)evdo.myawi.net' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 rlm_sql (sql): Released sql socket id: 50 ++[sql] returns ok [pap] No clear-text password in the request. Not performing PAP. ++[pap] returns noop !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. CHAP-Password is incorrect. Failed to authenticate the user. Login incorrect: [6064191111(a)evdo.myawi.net/<CHAP-Password>] (from client radius08 port 0) Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default -- regards, Joseph

2 5

Session time again
by Emmanuel BILLOT 18 Jan '13

18 Jan '13

Hi, I saw that interim-update was a partial report of what was done during the session, fixed on interval for not losing all data if connexion fail for accounting. Ok, but i knew there was regular re-auth session to keep the connexion alive, right ? If it is right, what could be the attribut to increase interval between two checks ? BR, -- Emmanuel BILLOT CATEL - Dpt. Système et Réseaux Rectorat - Académie d'Orléans-Tours 10, rue Molière - 45000 Orléans Tél : 02 38 79 45 57

2 2

Session-Timeout
by Emmanuel BILLOT 18 Jan '13

18 Jan '13

Hi, We want to "force" Session-Timeout for all our users. Authorization and authentication are made by LDAP. Is it possible to add Session-Timeout in a file or config file to apply it to all our users ? BR, -- Emmanuel BILLOT CATEL - Dpt. Système et Réseaux Rectorat - Académie d'Orléans-Tours 10, rue Molière - 45000 Orléans Tél : 02 38 79 45 57

2 2

Re: Session-Timeout
by Alan Buxey 18 Jan '13

18 Jan '13

Yes. You could do it simply with users file, use unlang in post-auth or add it to LDAP as 3 places to start with (just one way is enough!) And you'll need to ensure tour NAS kit follow/honours the value you provide. If you are proxying a la eduroam then the remote site providing the service will decide what to do. They may honour your value, they may filter it out or they may override it with their chosen value alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

1 0