December 2009 - Freeradius-Users - lists.freeradius.org

guest vlan and ip address in sql
by Maciej Łukasz Wojszkun 11 Dec '09

11 Dec '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, Im' using freeradius 2.0.4 with 3com 4500 switches. On switches is setting guest-vlan for dot1x. If user will be assigned to guest vlan, and receive a guest-IP address (eg. 192.168.253.10), then after authorization freeradius inputs this guest-ip into sql database (instead valid ip for his vlan, eg. 192.168.90.5). Of course, user receive vaild ip after authorization. Is there any idea how i can input valid ip address into database? - -- pozdrawiam Maciej Łukasz Wojszkun tel. +48698611234 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJLIi+gAAoJELZ0XRdrHMhcu44H/2f29r7QnC3L6GTgbxHdXGnA G/4lTk8iheF4uxMk5xnpgo84VlbqL+vVXBOFiM5P45UHo/RMQWU8A2rIfXSZh8Vd X/VmeAy4ifnWJMwUU6SpqNCUPXAIvQbRjaOek1g7ck6ZHlH6O4qXqvD4R8DbypYg KFmm957/r+pgdF1sKD06Y3Ls8q/FRdSG7V1I34xyQcW7bGRlh8Wayf2ADwld3A/Z g09zCYCZpuBYDFd9wQW+Ek1A8D5n4eJGnOW+6tVQ/0zFy1bRD/95lJvUtjfsRckZ gCB0yODUFnojDk0mfpZ24z1fF9Ws1HZH3/JyQ5YaOKV5kGibUpYl0jW5DKyCq7w= =YGKl -----END PGP SIGNATURE-----

3 3

Changing the format of a date attribute
by Patric 11 Dec '09

11 Dec '09

Hi everyone, Firstly, thanks Alan for your help with my acct_start_time problem, that was exactly what I was after. The only problem that remains for me is getting the value into a different format so I can store it in my database table. So I have the following setup currently: share/dictionary.freeradius: ATTRIBUTE FreeRADIUS-Acct-Session-Start-Time 2 date Then in my preacct section: update request { FreeRADIUS-Acct-Session-Start-Time = "%{expr: %l - %{%{Acct-Session-Time}:-0} - %{%{Acct-Delay-Time}:-0}}" } Then I can use %{FreeRADIUS-Acct-Session-Start-Time} which is in the date format: "Dec 8 2009 09:14:14 GMT". The database field I will be writing into is a MySQL DateTime field, which is in the format "YYYY-MM-DD HH:ii:ss", eg: "2009-12-08 11:27:34" Is there any way for me to get my FreeRADIUS-Acct-Session-Start-Time attribute value into that date format? Any advice would be very much appreciated. Many thanks, Patric

9 27

Request for directions: WinXP + Samba + LDAP + 802.1x
by Fabiano Caixeta Duarte 11 Dec '09

11 Dec '09

Fellows, I have a samba+ldap domain with a bunch of WinXP clients. I intend to get those clients to get access on switch through 802.1x authentication. The problem is: user don't get authorized on samba domain because the switch port is locked waiting for 802.1x auth. What I got so far? I have a freeradius daemon using LDAP as user database. The LDAP entries are shared by samba and freeradius. It's tested locally with radtest. Can you give me the next step? Is there some specific docs on that subject? I found lots of docs talking about AD and ntlm_auth. That's not what I'm looking for. Many thanks in advance. -- Fabiano Caixeta Duarte Especialista em Redes de Computadores Linux User #195299 Ribeirão Preto - SP

3 8

sqlippool
by Nadir Aliyev 11 Dec '09

11 Dec '09

Hello All, I have problems with ip pool. I use sqlippool on my configuration (postgresqlippool.conf included to radiusd.conf and sqlippool added to my default configuration file which in enabled-site directory) But i receive errors that server cannot define ip for client or [sqlippool] No Pool-Name defined. :( Here is my radiusd -X .......................... Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.10.1.1 port 1645, id=118, length=163 Cisco-AVPair = "client-mac-address=0030.05e3.e538" Framed-Protocol = PPP User-Name = "testuser" CHAP-Password = 0x0161a6e63fa662b05f9e996a2bbd95fff7 NAS-Port-Type = Ethernet NAS-Port = 464 NAS-Port-Id = "0/0/0/500" Service-Type = Framed-User NAS-IP-Address = 10.10.1.1 Acct-Session-Id = "000001D0" NAS-Identifier = "my-cisco-bras" +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok [sql] expand: %{User-Name} -> testuser [sql] sql_set_user escaped user --> 'testuser' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT * FROM check_user_with_mac('%{SQL-User-Name}', '%{Cisco-AVPair[0]}', '%{NAS-Port-Id}') AS foo(id int, UserName character varying, Attribute character varying, Value character varying, Op character varying) -> SELECT * FROM check_user_with_mac('testuser', 'client-mac-address=3D0030.05e3.e538', '0/0/0/500') AS foo(id int, UserName character varying, Attribute character varying, Value character varying, Op character varying) rlm_sql_postgresql: query: SELECT * FROM check_user_with_mac('testuser', 'client-mac-address=3D0030.05e3.e538', '0/0/0/500') AS foo(id int, UserName character varying, Attribute character varying, Value character varying, Op character varying) rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 5 WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [sql] User found in radcheck table [sql] expand: select * from get_user_attributes('%{SQL-User-Name}') order by id -> select * from get_user_attributes('testuser') order by id rlm_sql_postgresql: query: select * from get_user_attributes('testuser') order by id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 4 , fields = 5 [sql] expand: SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}' -> SELECT GroupName FROM usergroup WHERE UserName='testuser' rlm_sql_postgresql: query: SELECT GroupName FROM usergroup WHERE UserName='testuser' rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 [sql] expand: SELECT radgroupcheck.id, radgroupcheck.GroupName, radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op FROM radgroupcheck, usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id -> SELECT radgroupcheck.id, radgroupcheck.GroupName, radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op FROM radgroupcheck, usergroup WHERE usergroup.Username = 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id rlm_sql_postgresql: query: SELECT radgroupcheck.id, radgroupcheck.GroupName, radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op FROM radgroupcheck, usergroup WHERE usergroup.Username = 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 [sql] User found in group ActiveUsers [sql] expand: SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, radgroupreply.Value, radgroupreply.Op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id -> SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, radgroupreply.Value, radgroupreply.Op FROM radgroupreply,usergroup WHERE usergroup.Username = 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql_postgresql: query: SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, radgroupreply.Value, radgroupreply.Op FROM radgroupreply,usergroup WHERE usergroup.Username = 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok Found Auth-Type = CHAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! +- entering group CHAP {...} [chap] login attempt by "testuser" with CHAP password [chap] Using clear text password "testuser" for user testuser authentication. [chap] chap user testuser authenticated succesfully ++[chap] returns ok Login OK: [testuser/] (from client TESTNAS port 464) +- entering group post-auth {...} [SQLIPPOOL] NO POOL-NAME DEFINED. [sqlippool] expand: -> ++[sqlippool] returns noop [sql] expand: %{User-Name} -> testuser [sql] sql_set_user escaped user --> 'testuser' [sql] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW()) -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('testuser', 'Chap-Password', 'Access-Accept', NOW()) [sql] expand: /var/log/sqltrace.sql -> /var/log/sqltrace.sql rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('testuser', 'Chap-Password', 'Access-Accept', NOW()) rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_postgresql: query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('testuser', 'Chap-Password', 'Access-Accept', NOW()) rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 1 rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok [sql_log] Processing sql_log_postauth [sql_log] expand: %{User-Name} -> testuser [sql_log] expand: %{%{User-Name}:-DEFAULT} -> testuser [sql_log] sql_set_user escaped user --> 'testuser' [sql_log] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [sql_log] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', '%S'); -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('testuser', 'Chap-Password', 'Access-Accept', '2009-12-11 14:40:07'); [sql_log] expand: /var/log/radacct/sql-relay -> /var/log/radacct/sql-relay ++[sql_log] returns ok ++[exec] returns noop Sending Access-Accept of id 118 to 10.10.1.1 port 1645 Cisco-AVPair += "lcp:interface-config#1=rate-limit input 1024000 128000 128000 conform-action transmit exceed-action drop" Cisco-AVPair += "lcp:interface-config#2=rate-limit output 8192000 1024000 1024000 conform-action transmit exceed-action drop" Port-Limit := 1 Session-Timeout := 172800 Finished request 0. Going to the next request Waking up in 4.9 seconds.

2 1

Re: Testing radius server
by gera 11 Dec '09

11 Dec '09

Where did you create the user and password cisco? A copy of your users configuration file would be great On Thu, Dec 10, 2009 at 12:05 PM, g <gerardocb(a)gmail.com> wrote: > Where did you create the user and password cisco? > > A copy of your users configuration file would be great. > > > On Thu, Dec 10, 2009 at 11:03 AM, Alex Bahoor <alexbahoor(a)sbcglobal.net>wrote: > >> Alan, >> >> Radius -X is always on, and I went through the clients.conf file. -Xgives a lot information, since you asked here is my understanding. I'm not a >> programmer so some of them are cryptic to me. I put in comments to what I >> think they are, but they are only guesses. I would be very thankful if >> you can shed lights on them. >> >> Also, there is file experimental.conf stated in eap.conf, but did not >> exist. It may have some useful information. >> >> root@Crest raddb]# radtest cisco cisco 127.0.0.1 200 testing123 >> >> Sending Access-Request of id 187 to 127.0.0.1 port 1812 >> >> User-Name = "cisco" >> >> User-Password = "cisco" >> >> NAS-IP-Address = 127.0.0.1 >> >> NAS-Port = 200 >> >> rad_recv: Access-Request packet from host 127.0.0.1 port 43663, id=187, >> length=57 >> >> User-Name = "cisco" >> >> User-Password = "cisco" >> >> NAS-IP-Address = 127.0.0.1 >> >> NAS-Port = 200 >> >> +- entering group authorize {...} >> >> ++[preprocess] returns ok ;what is preprocess and what does it do? >> >> ++[chap] returns noop ;I can tell that chap was not selected as aprotocol, >> right? >> >> ++[mschap] returns noop ;as above >> >> [suffix] No '@' in User-Name = "cisco", looking up realm NULL ;why @ is >> expected in a name or password? >> >> [suffix] No such realm "NULL" ;what this mean? >> >> ++[suffix] returns noop >> >> [eap] No EAP-Message, not doing EAP ;eap is not auth protocol. >> >> ++[eap] returns noop >> >> ++[unix] returns notfound ;what is this? >> >> ++[files] returns noop ? >> >> ++[expiration] returns noop ? >> >> ++[logintime] returns noop ? >> >> [pap] WARNING! No "known good" password found for the user. >> Authentication may fail because of this. ;I do have a password (cisco). >> >> ++[pap] returns noop >> >> No authenticate method (Auth-Type) configuration found for the request: >> Rejecting the user ;this look like authentication protocol >> is a must before the process can work, however, eap.conf file is there >> and eap is uncommented out with it’s arguments. ? >> >> Failed to authenticate the user. >> >> Using Post-Auth-Type Reject >> >> +- entering group REJECT {...} >> >> [attr_filter.access_reject] expand: %{User-Name} -> cisco >> >> attr_filter: Matched entry DEFAULT at line 11 >> >> ++[attr_filter.access_reject] returns updated >> >> Delaying reject of request 5 for 1 seconds >> >> Going to the next request >> >> Waking up in 0.9 seconds. >> >> Sending delayed reject for request 5 >> >> Sending Access-Reject of id 187 to 127.0.0.1 port 43663 >> >> Waking up in 4.9 seconds. >> >> rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=187, >> length=20 >> >> [root@Crest raddb]# Cleaning up request 5 ID 187 with timestamp +411 >> >> Ready to process requests. >> >> Rgrds, >> >> Alex >> >> -----Original Message----- >> From: freeradius-users-bounces+alexbahoor=sbcglobal.net@ >> lists.freeradius.org [ >> mailto:freeradius-users-bounces+alexbahoor=sbcglobal.net@lists.freeradius.org<freeradius-users-bounces+alexbahoor=sbcglobal.net(a)lists.freeradius.org>] >> On Behalf Of Alan Buxey >> Sent: Thursday, December 10, 2009 2:07 AM >> To: FreeRadius users mailing list >> Subject: Re: Testing radius server >> >> Hi, >> >> > Now I know it's a config issue in the clients.conf, as radtest is >> failing. I >> >> > set user name and password, but radius is sending a reject. This is the >> >> > first time I'm using radius. So please bear with me. Can some one mail >> me >> >> > example of the minimum required configuration that needed for the radius >> to >> >> > work, no EAP or MSCAP ..etc. >> >> hey, guess what - 'radiusd -X' this will be far more useful than >> >> throwing random recommendations to you. >> >> have you followed basic guidance regarding hwo to use clients.conf >> >> eg >> >> testuser Cleartext-Password := "testpassword" >> >> alan >> >> - >> >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> >> >> >> __________ Information from ESET NOD32 Antivirus, version of virus >> signature database 4674 (20091209) __________ >> >> The message was checked by ESET NOD32 Antivirus. >> >> http://www.eset.com >> >> >> >> __________ Information from ESET NOD32 Antivirus, version of virus >> signature database 4676 (20091210) __________ >> >> The message was checked by ESET NOD32 Antivirus. >> >> http://www.eset.com >> >> >> >> >> >> __________ Information from ESET NOD32 Antivirus, version of virus >> signature database 4676 (20091210) __________ >> >> The message was checked by ESET NOD32 Antivirus. >> >> http://www.eset.com >> >> >> >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> > >

7 11

Freeradius 2.1.7 with IPPool + MySQL + Solaris 10 on sparc v490
by Hermes Ramon Velazquez Allende 11 Dec '09

11 Dec '09

Hello, I need you're help I can't compile the freeradius 2.1.7 on Solaris SunV490, I have the next messages when I try to compile the source of freeradius.2.1.7: I have the next configure opcion: bash-3.00# crle Configuration file [version 4]: /var/ld/ld.config Default Library Path (ELF): /lib:/usr/lib:/usr/local/lib:/opt/mysql/mysql/lib:/usr/local/ssl/lib:/usr/local/BerkeleyDB.4.2/lib:/usr/share/lib:/etc/lib:/etc/security/lib:/usr/ccs/lib:/usr/xpg4/lib:/usr/dt/lib:/usr/ucblib Trusted Directories (ELF): /lib/secure:/usr/lib/secure (system default) Command line: crle -c /var/ld/ld.config -l /lib:/usr/lib:/usr/local/lib:/opt/mysql/mysql/lib:/usr/local/ssl/lib:/usr/local/BerkeleyDB.4.2/lib:/usr/share/lib:/etc/lib:/etc/security/lib:/usr/ccs/lib:/usr/xpg4/lib:/usr/dt/lib:/usr/ucblib export CFLAGS=-m64 ./configure --prefix=/usr/local/radius --with-logdir=/var/log/radius --with-experimental-modules And I have the next error when I try to compile the freeradius 2.1.7 /data/instaladores/src/freeradius-server-2.1.7/libtool --mode=link gcc -release 2.1.7 \ -export-dynamic -o libfreeradius-radius.la -rpath /usr/local/radius/lib dict.lo filters.lo hash.lo hmac.lo hmacsha1.lo isaac.lo log.lo misc.lo missing.lo md4.lo md5.lo print.lo radius.lo rbtree.lo sha1.lo snprintf.lo strlcat.lo strlcpy.lo token.lo udpfromto.lo valuepair.lo fifo.lo packet.lo event.lo getaddrinfo.lo vqp.lo heap.lo dhcp.lo gcc -shared -Wl,-h -Wl,libfreeradius-radius-2.1.7.so -o .libs/ libfreeradius-radius-2.1.7.so .libs/dict.o .libs/filters.o .libs/hash.o .libs/hmac.o .libs/hmacsha1.o .libs/isaac.o .libs/log.o .libs/misc.o .libs/missing.o .libs/md4.o .libs/md5.o .libs/print.o .libs/radius.o .libs/rbtree.o .libs/sha1.o .libs/snprintf.o .libs/strlcat.o .libs/strlcpy.o .libs/token.o .libs/udpfromto.o .libs/valuepair.o .libs/fifo.o .libs/packet.o .libs/event.o .libs/getaddrinfo.o .libs/vqp.o .libs/heap.o .libs/dhcp.o -lc ld: fatal: file .libs/dict.o: wrong ELF class: ELFCLASS64 ld: fatal: File processing errors. No output written to .libs/ libfreeradius-radius-2.1.7.so collect2: ld returned 1 exit status make[4]: *** [libfreeradius-radius.la] Error 1 make[4]: Leaving directory `/data/instaladores/src/freeradius-server-2.1.7/src/lib' make[3]: *** [common] Error 2 make[3]: Leaving directory `/data/instaladores/src/freeradius-server-2.1.7/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/data/instaladores/src/freeradius-server-2.1.7/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/data/instaladores/src/freeradius-server-2.1.7' make: *** [all] Error 2 thanks in advance

1 0

(без темы)
by Nadir Aliyev 11 Dec '09

11 Dec '09

Hello again =) How can i fix following warning errors? Thanks to all! =) 1. WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. 2. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 3. [sql] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details

3 2

Question on processing delayed proxy packets
by Patric 11 Dec '09

11 Dec '09

Greetings all, Finally getting my system running nice and smoothly :) I have a scenario I would like some opinions on, something to think about... Lets say I have server A and server B getting requests from multiple sources. They proxy these requests to each other as well. Consider the following scenario: server A gets a start record at 08h00, and proxies it to server B immediately, so server A and server B each have an entry with start time 08h00. An hour later server A gets an interim update acct_input_octets = 5. The proxied packet is delayed due to a network issue. Another hour later server _B_ gets an interim update acct_input_octets = 7. It proxies the request and server A is updated immediately, so now server A and server B have an entry with start time 08h00 and acct_input_octets = 7. Great, all is right at this point. Then: The delayed interim update (which has acct_input_octets = 5) from server A finally gets through to server B, and server B processes the packet using my "accounting_update_query" query, which is formatted as follows: accounting_update_query = "UPDATE ${acct_table_new} \ SET \ framed_ip_address = '%{Framed-IP-Address}', \ acct_session_time = '%{Acct-Session-Time}', \ x_ascend_xmit_rate = '%{X-Ascend-Xmit-Rate}', \ x_ascend_data_rate = '%{X-Ascend-Data-Rate}', \ acct_input_octets = '%{Acct-Input-Octets}', \ acct_output_octets = '%{Acct-Output-Octets}', \ acct_input_gigawords = '%{Acct-Input-Gigawords}', \ acct_output_gigawords = '%{Acct-Output-Gigawords}' \ WHERE \ acct_session_id = '%{Acct-Session-Id}' \ AND \ user_name = '%{SQL-User-Name}' \ AND \ nas_ip_address = '%{NAS-IP-Address}'" As you can see, the above query will set acct_input_octets = 5 on server B, so now server A has acct_input_octets = 7 and server B has acct_input_octets = 5. Thats the problem. The solution I am toying with is the following: If a db entry exists, and the acct_input_octets in the db entry is more than the current packet we are processing, then the packet data is older than the db data in the record, so we want to ignore the packet and keep the db data. (Obviously we will need to apply the check to acct_output_octets and the gigaword fields as well...) So the very first problem we see is that checking the record before processing the new update is going to slow down the entire process. The best way I can think to handle this is to check the acct_delay_time field, and if it is a very small number we assume the record is fresh. If the delay time is more than say 30 minutes, we first do the lookup. This means that *most* requests wont need to do a lookup first, and only the heavily delayed ones are then checked. Im not even sure if it is possible to do this in the current setup, or if its possible to do it with a more complex SQL statement, but I would appreciate any comments on the idea and any experience others have had with this. Many thanks, Patric

2 1

Re: accounting with freeradius (Alan Buxey)
by rosect190＠yahoo.com 10 Dec '09

10 Dec '09

I hope to see step-by-step instructions to setup accounting system using sql server with freeradius such that I can see a user's network usage (Tx'd / Rx'd). Also, with freeRADIUS, is there a way to log a user's accounting info in a local file, not in a sql server? Thanks.

3 2

accounting with freeradius
by rosect190＠yahoo.com 10 Dec '09

10 Dec '09

I try to setup accounting with freeradius. Not much lick to find step-by-step instruction on Internet. Can some guru help on this? I have freeradius 2.1.3-1-fc9 installed on my Linux machine. Thanks in advance.

2 1