Re: Proxy auth should supersede local auth

2013-09-25 Thread JB
24.09.2013 Phil Mayers: On 24/09/13 12:25, JB wrote: At first glance, this seems to work but I wanted to know if there's a better or more common way to achieve this. Or is this completely stupid after all? (Why?) Looks fine to me; you're conditionally executing the rest of your policy

Re: Active Directory authentication question

2013-09-25 Thread Roberto Carna
Dear Stephan, just the last question pleasein your guide you say: In /etc/raddb/eap.conf, change the ttls section as follows: default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = no That's OKbut what do I have to put in the eap section from eap.conf file???

RE: Active Directory authentication question

2013-09-25 Thread stefan.paetow
In the eap section, the default is md5, set it to ttls And Roberto, you've emailed the entire FreeRADIUS mailing list. :-) Stefan -Original Message- From: freeradius-users- bounces+stefan.paetow=diamond.ac...@lists.freeradius.org [mailto:freeradius-users-

EAP-AKA, EAP-AKA'

2013-09-25 Thread Arran Cudbard-Bell
Just out of interest is anyone using EAP-AKA with the EAP2 module in FreeRADIUS 2.x.x? If so what sorts of services are you using for? Have any telcos successfully deployed EAP-SIM/EAP-AKA['] for authenticating handsets to GSM and 802.11 networks to facilitate cross medium roaming? -Arran

Re: Active Directory authentication question

2013-09-25 Thread Roberto Carna
Dear Stephan: Notebook with Windows 7 + AP + EAP-TTLS + MSCHAPv2 + Freeradius + AD is working now !!! But just a doubt: if I access with my Android device, using EAP-TLS (not EAP-TTLS) + MSCHAPv2, I can access the same...why ??? Regards and thanks, Roberto 2013/9/25

RE: Active Directory authentication question

2013-09-25 Thread stefan.paetow
Because your EAP-TLS process works? Remember, you set up EAP-TLS first (which worked). You just configured EAP-TTLS with EAP-MSCHAPv2 as an additional authentication method. Since the default_eap_type is set to ttls, your server *prefers* using EAP-TTLS with EAP-MSCHAPv2, but it still

Re: Active Directory authentication question

2013-09-25 Thread Roberto Carna
But in the EAP-TLS section from eap.conf file, I don't see any reference to MSCHAPv2and remember the NTLM authentication query is set up in the MSCHAPv2 module 2013/9/25 stefan.pae...@diamond.ac.uk: Because your EAP-TLS process works? Remember, you set up EAP-TLS first (which worked).

Re: Active Directory authentication question

2013-09-25 Thread Alan Buxey
Well.  There's no such thing as EAP-TLS/MSCHAPv2 . So I'd guess that your Android device is just doing PEAPv0/EAP-MSCHAPv2 or such and your config allows it to.  If you ran in full debug mode when connecting with the Android device you'd see exactly what's happening alan - List

RE: Active Directory authentication question

2013-09-25 Thread stefan.paetow
But in the EAP-TLS section from eap.conf file, I don't see any reference to MSCHAPv2and remember the NTLM authentication query is set up in the MSCHAPv2 module EAP-TLS does not use MSCHAPv2. It uses certificates. I quote Alan DeKok's response to your question on September 18:

Help with sqlcounter for data transferred

2013-09-25 Thread Fabrizio Fiore Donati
Hi, i'm configuring a server with a sql counter to check the total byte in a week for the users. But the server will reply a wrong count. Here's the counter: sqlcounter weeklybytecounter { counter-name = Weekly-Total-Max-Octets check-name = Max-Weekly-Octets reply-name = Mikrotik-Total-Limit

Freeradius - DeadLock

2013-09-25 Thread Alisson
Hi, I have a lot of logs with deadlocks ed Sep 25 15:05:44 2013 : Error: [sql] Couldn't update SQL accounting ALIVE record - Deadlock found when trying to get lock; try restarting transaction Wed Sep 25 15:05:44 2013 : Error: [sql] Couldn't update SQL accounting ALIVE record - Deadlock

Re: Freeradius - DeadLock

2013-09-25 Thread Arran Cudbard-Bell
On 25 Sep 2013, at 20:08, Alisson alissongoncal...@bsd.com.br wrote: Hi, I have a lot of logs with deadlocks Those would be caused by a bug in your custom SQL queries? Arran Cudbard-Bell a.cudba...@freeradius.org FreeRADIUS Development Team - List info/subscribe/unsubscribe? See

Re: Freeradius - DeadLock

2013-09-25 Thread Alisson
This messages are from radius.log I've doesn't changed anything in db... and I haven't custom queries... 2013/9/25 Arran Cudbard-Bell a.cudba...@freeradius.org On 25 Sep 2013, at 20:08, Alisson alissongoncal...@bsd.com.br wrote: Hi, I have a lot of logs with deadlocks Those

empty preacct and accounting section

2013-09-25 Thread WorkingMan
I have been seen this weird message for two days now. I setup PPTP and IPSec (ikev1) with freeradius + mysql. In both cases I see Access-Acccept and in Accounting-Request I see these two message: WARNING: Empty preacct section. Using default return values. WARNING: Empty accounting section.

Re: Freeradius - DeadLock

2013-09-25 Thread Arran Cudbard-Bell
On 25 Sep 2013, at 20:54, Alisson alissongoncal...@bsd.com.br wrote: This messages are from radius.log Those errors were generated by the MySQL client library or the MySQL server, just because they're included in the radius.log file does not mean they originated from within the FreeRADIUS

Re: empty preacct and accounting section

2013-09-25 Thread Arran Cudbard-Bell
On 25 Sep 2013, at 21:20, WorkingMan signup_mail2...@yahoo.com wrote: I have been seen this weird message for two days now. I setup PPTP and IPSec (ikev1) with freeradius + mysql. In both cases I see Access-Acccept and in Accounting-Request I see these two message: WARNING: Empty

Re: empty preacct and accounting section

2013-09-25 Thread Alan Buxey
As the msg says.  Your preacct {} and accounting {} sections in your server are not configured to do anything. Add active modules to them eg a database call and things will be different.  alan- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: empty preacct and accounting section

2013-09-25 Thread Signup_mail2002
On Sep 25, 2013, at 4:33 PM, Arran Cudbard-Bell a.cudba...@freeradius.org wrote: On 25 Sep 2013, at 21:20, WorkingMan signup_mail2...@yahoo.com wrote: I have been seen this weird message for two days now. I setup PPTP and IPSec (ikev1) with freeradius + mysql. In both cases I see

Re: empty preacct and accounting section

2013-09-25 Thread Signup_mail2002
I will double check them when I get back to my machine. I think I know what you mean. Will report back. On Sep 25, 2013, at 4:38 PM, Alan Buxey a.l.m.bu...@lboro.ac.uk wrote: As the msg says. Your preacct {} and accounting {} sections in your server are not configured to do anything. Add

Re: Freeradius - DeadLock

2013-09-25 Thread Alisson
So this error its caused by my application? 2013/9/25 Arran Cudbard-Bell a.cudba...@freeradius.org On 25 Sep 2013, at 20:54, Alisson alissongoncal...@bsd.com.br wrote: This messages are from radius.log Those errors were generated by the MySQL client library or the MySQL server, just

Re: empty preacct and accounting section

2013-09-25 Thread Arran Cudbard-Bell
Are you saying my default file has these sections as empty? Or that the vpn clients are sending empty data? Sections. As the Warning clearly states, sections. Arran Cudbard-Bell a.cudba...@freeradius.org FreeRADIUS Development Team - List info/subscribe/unsubscribe? See

Re: empty preacct and accounting section

2013-09-25 Thread WorkingMan
Signup_mail2002 signup_mail2002 at yahoo.com writes: I will double check them when I get back to my machine. I think I know what you mean. Will report back. On Sep 25, 2013, at 4:38 PM, Alan Buxey A.L.M.Buxey at lboro.ac.uk wrote: As the msg says. Your preacct {} and accounting {}

Re: Freeradius - DeadLock

2013-09-25 Thread Fajar A. Nugraha
On Thu, Sep 26, 2013 at 4:14 AM, Alisson alissongoncal...@bsd.com.brwrote: So this error its caused by my application? Whatever it is that creates queries to mysql. In the default schema, radacct will continue to grow. If you're running it on a production system with significant amount of