December 2014 - Freeradius-Users - lists.freeradius.org

New Problem with sqlcounter
by Haviaras Kostas 04 Dec '14

04 Dec '14

Hello, I have write the following rule on the sqlcounter module: sqlcounter checkthetime { sql_module_instance = "sql" dialect = ${modules.sql.dialect} counter_name = "All-Hour-Used" check_name = "Max-Hour-Used" key = "User-Name" reset = "never" $INCLUDE ${modconfdir}/sql/counter/${dialect}/${.:instance}.conf } checkthetime file: query = "SELECT HOUR(SEC_TO_TIME(UNIX_TIMESTAMP() - UNIX_TIMESTAMP(AcctStartTime))) FROM radacct WHERE UserName = '%{${key}}' LIMIT 1 my debug mode is here: http://pastebin.com/F9QA2WN2, but also the interesting parts is here: ........ # Instantiating module "checkthetime" from file /etc/freeradius/mods-enabled/sqlcounter sqlcounter checkthetime { sql_module_instance = "sql" key = "User-Name" query = "SELECT HOUR(SEC_TO_TIME(UNIX_TIMESTAMP() - UNIX_TIMESTAMP(AcctStartTime))) FROM radacct WHERE UserName = '%{User-Name}' LIMIT 1;" reset = "never" counter_name = "All-Hour-Used" check_name = "Max-Hour-Used" reply_name = "Session-Timeout" } ............ (0) checkthetime : --> 2 (0) checkthetime : Allowing user, control:Max-Hour-Used value (336) is greater than counter value (2) (0) checkthetime : Setting reply:Session-Timeout value to 334 .......... Sending Access-Accept Id 72 from 192.168.40.12:1812 to 192.168.40.102:54010 Mikrotik-Rate-Limit = '512k/2M' Session-Timeout = 334 And in my MySQL radgroupcheck table: 7 2 Week Max-Hour-Used := 336 Even I don't have define property reply_name = "Session-Timeout" in my rule it appears!! My problem is that the Session Time out is defined even if I didn't define it. Thanks for your attention and time. My Freeradius is 3.0.4

2 1

Re: Problem with the sqlcounter!
by Haviaras Kostas 04 Dec '14

04 Dec '14

I finally manage to solve my problem, I just add the fall-through "Yes" on the radreply and radgroupreply tables and it works.

1 0

Accounting-Start and Accounting-Off
by Frank Wei 03 Dec '14

03 Dec '14

Hi All, I have a few questions about the "Accounting-Start" and "Accounting-Off". 1. If a NAS configured to have a primary and a backup RADIUS server. To start with all the "Accounting-Start" records will be in the primary RADIUS server. Later on the primary server goes down (Primary server won't tell the NAS?). When sessions stop, the NAS sends the "Accounting-Stop" to the secondary. I understand the "Start-Stop" record with the same "user name" and "session-id" ideally should be recorded in the same server. If this situation happens what should both the NAS and RADIUS server do? 2. A NAS configured to have a primary and backup RADIUS server. To start with all the "Accounting-Start" records will be in the primary RADIUS server. Later on the administrator decided to change the primary server (as there are problems with the previous primary). sessions stop, the NAS sends the "Accounting-Stop" to the new primary. This ends up the "Accounting-Start" and "Accounting-Stop" with the same "user name" and "session Id" in two RADIUS servers. To summarize, how to avoid the "start-stop" pair ends up in different servers ? If it does, is it an issue for RADIUS application ? Cheers, 4RF Limited The information in this email communication (inclusive of attachments) is confidential to 4RF Limited and the intended recipient(s). If you are not the intended recipient(s), please note that any use, disclosure, distribution or copying of this information or any part thereof is strictly prohibited and that the author accepts no liability for the consequences of any action taken on the basis of the information provided. If you have received this email in error, please notify the sender immediately by return email and then delete all instances of this email from your system. 4RF Limited will not accept responsibility for any consequences associated with the use of this email (including, but not limited to, damages sustained as a result of any viruses and/or any action or lack of action taken in reliance on it).

1 1

Re: Problem with the sqlcounter!
by Haviaras Kostas 03 Dec '14

03 Dec '14

I must add the value "All-Hour-Used" and "Max-Hour-Used" on the dictionary ? Thanks

1 0

Re: Problem with the sqlcounter!
by Haviaras Kostas 03 Dec '14

03 Dec '14

Sorry I have make wrong the reply but this post is related with http://lists.freeradius.org/pipermail/freeradius-users/2014-October/074124.…

1 0

Re: Problem with the sqlcounter!
by Haviaras Kostas 03 Dec '14

03 Dec '14

Here all the debug output http://pastebin.com/KdpSkNuQ Thanks

1 0

Problem with the sqlcounter!
by Haviaras Kostas 03 Dec '14

03 Dec '14

Here all the debug output http://pastebin.com/KdpSkNuQ Thanks

1 0

SQL insert on TLs failure
by Dean Goldhill 03 Dec '14

03 Dec '14

Hello, I want to write a record to the MySQL database when a client sends a TLS close notification. So when a laptop is not properly configured to trust our CA, the client sends a TLS close notification. And in the log we see something like: "Auth: Login incorrect (TLS Alert read:warning:close notify):" I know why this is happening, but I just want to write an entry to the database so we have a record of which users are failing because of this reason. Is it possible to do this? Thanks. Dean

2 2

radtest failed to send request to radius server having ipv6 address.
by timingsrc src 03 Dec '14

03 Dec '14

Hello, I have made radius server 3.0.5 setup in my PC. It worked fine with IPV4 addresses, radtest fails to send request with IPV6 addresses. Below command worked fine,user authenticated. radtest -x USER 72e#05 192.168.242.43 1812 testinglab Where as with IPV6 address it throws an error. radtest -x -6 USER 72e#05 2001:e30:1400:1:208:c7ff:fecf:9f0f 1812 testinglab (0) Error parsing "-": ip_hton: No address associated with hostname Please let me know how i should send radius auth requests with IPV6 address. Thanks, Manjunath

2 1

"Accounting-On" and "Accouting-Off"
by Frank Wei 03 Dec '14

03 Dec '14

Hi all, I am new to RADIUS. I understand "Accounting-off" can be sent before the NAS shutting down to inform the server that all the currently opened session to be closed. "Accounting -on" is to mark the start of the accounting upon booting. There are also per "session-id" based "Accounting-start" and "Accounting-stop". It seems to me if we can apply all the session IDs to "Accounting-start" and "Accounting-stop" then we do not need to use "Accounting-off" and "Accounting-on". Please somebody to explain to me when we have to use "Accounting-off" and "Accounting-on"? Regards, 4RF Limited The information in this email communication (inclusive of attachments) is confidential to 4RF Limited and the intended recipient(s). If you are not the intended recipient(s), please note that any use, disclosure, distribution or copying of this information or any part thereof is strictly prohibited and that the author accepts no liability for the consequences of any action taken on the basis of the information provided. If you have received this email in error, please notify the sender immediately by return email and then delete all instances of this email from your system. 4RF Limited will not accept responsibility for any consequences associated with the use of this email (including, but not limited to, damages sustained as a result of any viruses and/or any action or lack of action taken in reliance on it).

3 2