Hi I've got a scenario where we have multiple NAS devices authenticating their clients via a freeradius server. I want to originate COA requests to the NAS devices from the radius server and I have succeeded for one device by making an entry for a specific NAS in the home-server section of originate-coa. We add and remove NAS devices quite often and don't want to have to reconfigure originate-coa and restart freeradius every time. How we can enable dynamic addition of NAS to send COA requests OR can we send COA to servers without preconfiguring? Currently using & testing Freeradius 2.2.6 but in the process of migrating to 3, latest.
On Apr 6, 2016, at 9:18 AM, Mike <mike@hersham.net> wrote:
I want to originate COA requests to the NAS devices from the radius server and I have succeeded for one device by making an entry for a specific NAS in the home-server section of originate-coa. We add and remove NAS devices quite often and don't want to have to reconfigure originate-coa and restart freeradius every time. How we can enable dynamic addition of NAS to send COA requests OR can we send COA to servers without reconfiguring?
RADIUS doesn't work with dynamic IPs.
Currently using & testing Freeradius 2.2.6 but in the process of migrating to 3, latest.
You're best off using IPSec to create a virtual LAN for you devices, and then running RADIUS over that. Alan DeKok.
On 2016-04-06 16:50, Alan DeKok wrote:
RADIUS doesn't work with dynamic IPs. Effectively we have it working with Dynamic IPs because in Clients.conf we specify an IP range for a client and all our NAS devices share the same secret.
But this fix doesn't work for COA origination. I haven't got to the correct stage in migrating from v2 to v3 to test whether we can still do this with clients in version 3. If not we've got a big headache!
Hello, I need help with radius.log. I want to LOG Login Ok and Login Incorrect with plain-text passwords, but my output is: Wed Apr 6 22:27:02 2016 : Auth: Login OK: [testepppoe/<via Auth-Type = MSCHAP>] (from client ce-teste-rb port 15728657 cli F8:1A:67:58:42:E7) Wed Apr 6 22:32:23 2016 : Auth: Login incorrect: [testepppoe/<via Auth-Type = MSCHAP>] (from client ce-teste-rb port 15728658 cli F8:1A:67:58:42:E7) I want to supress rlm_sql Info like Thu Apr 7 08:27:01 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #31 Thu Apr 7 08:27:01 2016 : Info: rlm_sql (sql): Connected new DB handle, #31 It's possible? Thanks Aurelio
On Thu, Apr 07, 2016 at 08:33:20AM -0300, Aurélio de Souza Ribeiro Neto wrote:
I want to supress rlm_sql Info like
Thu Apr 7 08:27:01 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #31 Thu Apr 7 08:27:01 2016 : Info: rlm_sql (sql): Connected new DB handle, #31
It's possible?
Not in radius.log. Use linelog. You can customise it as much as you like. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Hi,
I want to LOG Login Ok and Login Incorrect with plain-text passwords, but my output is:
they are MSCHAP - you cant.
I want to supress rlm_sql Info like
for radiusd.log you cant - unless you edit the source code. if you want clean logs in the format you want with no other logging information then use linelog - however, apart from the startup events you can ensure less mysql loging by changing how you connect to mysql servers (min/max/spare/keepalives) alan
Hello, I need help. Every day, at 7:00:00 pm all my clients of all my NAS's are reconnected! I receive an stop packet and 1 second later the start packet. I have no cron-jobs. How can I solve this? Aurélio
Dear Alan, Thanks!!! I use CPE's with DD-WRT firmware. These CPE's were with the option Force-Reconnect enabled!! This is the problem!! Aurélio Em 08/04/2016 10:37, A.L.M.Buxey@lboro.ac.uk escreveu:
Hi,
How can I solve this?
look at your NAS, turn on debug on your NAS - verify that theres nothing local to the system that affects it in other domains - eg managed PDU or timer switch that reboots everything at 7pm :/
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Apr 7, 2016, at 2:58 AM, Mike <mike@hersham.net> wrote:
On 2016-04-06 16:50, Alan DeKok wrote:
RADIUS doesn't work with dynamic IPs. Effectively we have it working with Dynamic IPs because in Clients.conf we specify an IP range for a client and all our NAS devices share the same secret.
But this fix doesn't work for COA origination.
I know. As I said earlier, there is a work around.
I haven't got to the correct stage in migrating from v2 to v3 to test whether we can still do this with clients in version 3. If not we've got a big headache!
As I said, RADIUS is not designed to work with dynamic IPs. You have built a system based on *wrong* assumptions about how RADIUS works. You can't fix RADIUS. But you can run IPSec. Alan DeKok.
participants (5)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Aurélio de Souza Ribeiro Neto -
Matthew Newton -
Mike