Yubico Forum

...visit our web-store at store.yubico.com
It is currently Tue Jan 30, 2018 3:44 pm

All times are UTC + 1 hour




Post new topic Reply to topic  [ 2 posts ] 
Author Message
PostPosted: Fri May 03, 2013 7:27 pm 
Offline

Joined: Mon Apr 15, 2013 6:15 pm
Posts: 4
Scenario:
  • 2 yubiradius server
  • Each is synced to the other
  • Both are set to local for validation
  • Keys are imported on both

Problem: When either server goes offline, the remaining server does not validate keys and returns the following

Code:
Validate OTP Response:

Last Client Query:

http://127.0.0.1/wsapi/2.0/verify?id=1&nonce=d80b1f388e058af0e5d010979f75b115&otp=vvihtevtvbcutjrgecjnkjcktlekekdvftkkeubrlgdc&h=VVwO4gQpMqDYUmqsNNICOO3l9eA=

Server Responses:

Authentication Failed!

Error message: NO_VALID_ANSWER


Top
 Profile  
Reply with quote  

Share On:

Share on Facebook FacebookShare on Twitter TwitterShare on Tumblr TumblrShare on Google+ Google+

PostPosted: Mon May 20, 2013 11:20 am 
Offline
Yubico Team
Yubico Team

Joined: Mon Feb 22, 2010 9:49 am
Posts: 183
Hello Sir,

We do not recommend customers to use only two servers for synchronization because if one server is down, all data will be centralized to the remaining server and if that server also fails then there will be data loss. If you still interested in using 2 servers for synchronization, please set the sync level to 0. We recommend you to have four servers and set the sync level to 25% to have each request sync with at least one other server. (And for three servers the sync level to 33%)

You can set the default sync level required in the validation server(s) but the clients can also tell the servers how much sync they require per request

For more information about the sync level, please refer the below link: http://code.google.com/p/yubikey-val-server-php/

Here are the step by step instructions to set the sync level.

1) SSH to the YubiRADIUS

2) Navigate to the location '/etc/ykval'

3) Open the ykval-config.php file

# vim ykval-config.php

4) Set the $baseParams['__YKVAL_SYNC_DEFAULT_LEVEL__'] value as per your requirement.

5) Save the file

6) restart the ykval sync service

/etc/init.d/ykval-queue restart

Hope this helps!

Thanks and best regards,
Samir.


Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 2 posts ] 

All times are UTC + 1 hour


Who is online

Users browsing this forum: No registered users and 2 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group