Very interesting and useful, However, in the case where the accounting table already records multiple sessions for a username seconds after the first person has logged in on a fresh account, this periodic check won't help much. checkrad would solve the problem here (if the controller provides the information), and rlm_snmp sounds like it would as well. For my case, I'm actually suspecting now that this controller might specifically have a tendency to spam sessions when someone logs in, so perhaps removing non-unique sessions might be useful. Regardless, I'll have a proper look at my radacct table before proceeding with checkrad and SNMP. Thanks a lot, Taymour On 08/07/2019, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On Jul 7, 2019, at 3:10 PM, Alan DeKok <aland@deployingradius.com> wrote:
On Jul 7, 2019, at 8:49 PM, Taymour Gabr via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
this doesn't answer my question though of how/if checkrad works for simultaneous-use set to anything other than 1.
Checkrad is run once for every user session. But that means it has to check *each* user session.
Also, could you please expand on what you consider to be 'modern' NASes? 2 years-old, 5 years-old, 10?
Realistically, 10 years. Checkrad is ~20 years old, and hasn't been updated in a very long time.
We are looking to replace our crappy HP controller. Unfortunately HP was taken over by Aruba, and their controllers don't support HP Access points. So we are trying to go with the latest HP controller, and I would like to make sure that simultaneous-use will be covered.
At this point, the NASes should work better. Checkrad is less useful.
The majority of installations that use simultaneous use checks, just run a script against the database periodically, looking at the last time an interim was received, and closing out sessions where at least two interims have been missed. I added 'acctupdatetime' to the majority of the default schemas a few years back to encourage more people to do that, over using the old SNMP based methods. For this to work you do need to enable interim updates on the controller (set it to something like 5 mins if your servers can handle it).
If you wanted to contribute something useful, I know some databases have cronlike functionality. It'd be good to include a cronlike job to close out stale sessions in the default schemas.
Just as an aside - there's also been some internal discussion about creating an rlm_snmp to allow async queries against NAS. If that work gets completed, then we'd likely ditch checkrad in favour of integrated runtime checks. When the I/O is async you don't really care about blocking the request trying to talk to an unreachable NAS, you just need to set appropriate timeouts.
-Arran