On Mon, Apr 28, 2025 at 12:19 PM Alan DeKok <aland@deployingradius.com> wrote:
On Apr 28, 2025, at 11:58 AM, Timothy M Butterworth < timothy.m.butterworth@gmail.com> wrote:
I did not destroy the configuration. I am using the Debian default config plus the additions I made and posted above. Attached is the full config files.
As per the documentation: http://wiki.freeradius.org/list-help
We do not need to see the configuration files.
We DO need to see the debug output.
ALL OF THE DEBUG OUTPUT.
When the documentation says "post all of it and don't edit it", what that means is "post all of it and don't edit it".
Plus, the debug output you posted makes it VERY clear that you edited the file sites-available/default, and removed everything related to accounting.
here is the complete debug: (0) Received Access-Request Id 1 from 10.1.1.1:1645 to 10.0.0.1:1812 length 74 (0) User-Name = "tmb" (0) User-Password = "620978" (0) NAS-Port = 0 (0) NAS-Port-Id = "tty0" (0) NAS-Port-Type = Async (0) Calling-Station-Id = "async" (0) NAS-IP-Address = 10.1.1.1 (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /@\./) { (0) if (&User-Name =~ /@\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "tmb", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) files: users: Matched entry tmb at line 87 (0) files: EXPAND Hello, %{User-Name} (0) files: --> Hello, tmb (0) [files] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known good" Cleartext-Password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (0) post-auth { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name )) { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name )) -> FALSE (0) update { (0) No attributes updated for RHS &session-state: (0) } # update = noop (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) if (EAP-Key-Name && &reply:EAP-Session-Id) { (0) if (EAP-Key-Name && &reply:EAP-Session-Id) -> FALSE (0) } # post-auth = noop (0) Sent Access-Accept Id 1 from 10.0.0.1:1812 to 10.1.1.1:1645 length 81 (0) Service-Type = NAS-Prompt-User (0) Cisco-AVPair = "shell:priv-lvl=15" (0) Reply-Message = "Hello, tmb" (0) Finished request Waking up in 4.9 seconds. (1) Received Accounting-Request Id 1 from 10.1.1.1:1646 to 10.0.0.1:1813 length 90 (1) Acct-Session-Id = "00000001" (1) User-Name = "tmb" (1) Acct-Authentic = RADIUS (1) Acct-Status-Type = Start (1) NAS-Port = 0 (1) NAS-Port-Id = "tty0" (1) NAS-Port-Type = Async (1) Calling-Station-Id = "async" (1) Service-Type = NAS-Prompt-User (1) NAS-IP-Address = 10.1.1.1 (1) Acct-Delay-Time = 0 (1) Not sending reply to client. (1) Finished request (1) Cleaning up request packet ID 1 with timestamp +203 due to done Waking up in 4.9 seconds. (2) Received Accounting-Request Id 1 from 10.1.1.1:1646 to 10.0.0.1:1813 length 90 (2) Acct-Session-Id = "00000001" (2) User-Name = "tmb" (2) Acct-Authentic = RADIUS (2) Acct-Status-Type = Start (2) NAS-Port = 0 (2) NAS-Port-Id = "tty0" (2) NAS-Port-Type = Async (2) Calling-Station-Id = "async" (2) Service-Type = NAS-Prompt-User (2) NAS-IP-Address = 10.1.1.1 (2) Acct-Delay-Time = 4 (2) Not sending reply to client. (2) Finished request (2) Cleaning up request packet ID 1 with timestamp +207 due to done Waking up in 0.7 seconds. (0) Cleaning up request packet ID 1 with timestamp +203 due to cleanup_delay was reached Ready to process requests (3) Received Accounting-Request Id 1 from 10.1.1.1:1646 to 10.0.0.1:1813 length 90 (3) Acct-Session-Id = "00000001" (3) User-Name = "tmb" (3) Acct-Authentic = RADIUS (3) Acct-Status-Type = Start (3) NAS-Port = 0 (3) NAS-Port-Id = "tty0" (3) NAS-Port-Type = Async (3) Calling-Station-Id = "async" (3) Service-Type = NAS-Prompt-User (3) NAS-IP-Address = 10.1.1.1 (3) Acct-Delay-Time = 9 (3) Not sending reply to client. (3) Finished request (3) Cleaning up request packet ID 1 with timestamp +212 due to done Ready to process requests (4) Received Accounting-Request Id 1 from 10.1.1.1:1646 to 10.0.0.1:1813 length 90 (4) Acct-Session-Id = "00000001" (4) User-Name = "tmb" (4) Acct-Authentic = RADIUS (4) Acct-Status-Type = Start (4) NAS-Port = 0 (4) NAS-Port-Id = "tty0" (4) NAS-Port-Type = Async (4) Calling-Station-Id = "async" (4) Service-Type = NAS-Prompt-User (4) NAS-IP-Address = 10.1.1.1 (4) Acct-Delay-Time = 14 (4) Not sending reply to client. (4) Finished request (4) Cleaning up request packet ID 1 with timestamp +217 due to done Ready to process requests
Just read what you posted to the list. You will see:
* receiving Access-Request * processing the Access-Request through all kinds of configuration, modules, etc. * replying to the Access-Request
Then for accounting:
* receiving Accounting-Request * nothing happens * no reply is sent to the client.
Conclusion: you edited sites-available/default, and removed everything related to accounting. The debug output doesn't lie.
Now stop arguing, and go fix the configuration. Use the default configuration. It works.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- ⢀⣴⠾⠻⢶⣦⠀ ⣾⠁⢠⠒⠀⣿⡁ Debian - The universal operating system ⢿⡄⠘⠷⠚⠋⠀ https://www.debian.org/ ⠈⠳⣄⠀⠀