Your maximum never usage time has been reached

30 May 2010

      Hi

I've installed easyhotspot which incorporates an installation of freeradius.

My user can authenticate fine, but if they logout, the next time they 
try to authenticate the message "Your maximum never usage time has been 
reached".  This is despite setting a maximum download of 100MB within a 
one month time.

A copy of the radius -X output follows...

I can see where the "never" part of the message comes from in the 
max_all_mb counter (if I change it to "monthly" it still refuses to 
authorise a user with the message showing " "Your maximum monthly usage 
time has been reached", despite there still being time and data quote 
left on the account.

Any help is appreciated.

Thanks

David

You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License v2.
Starting - reading configuration files ...
including configuration file /etc/freeradius/radiusd.conf
including configuration file /etc/freeradius/proxy.conf
including configuration file /etc/freeradius/clients.conf
including files in directory /etc/freeradius/modules/
including configuration file /etc/freeradius/modules/ldap
including configuration file /etc/freeradius/modules/mac2vlan
including configuration file /etc/freeradius/modules/wimax
including configuration file /etc/freeradius/modules/digest
including configuration file /etc/freeradius/modules/echo
including configuration file /etc/freeradius/modules/passwd
including configuration file /etc/freeradius/modules/inner-eap
including configuration file /etc/freeradius/modules/unix
including configuration file /etc/freeradius/modules/pam
including configuration file /etc/freeradius/modules/pap
including configuration file /etc/freeradius/modules/files
including configuration file /etc/freeradius/modules/acct_unique
including configuration file /etc/freeradius/modules/etc_group
including configuration file /etc/freeradius/modules/realm
including configuration file /etc/freeradius/modules/sql_log
including configuration file /etc/freeradius/modules/policy
including configuration file /etc/freeradius/modules/attr_filter
including configuration file /etc/freeradius/modules/radutmp
including configuration file /etc/freeradius/modules/smbpasswd
including configuration file /etc/freeradius/modules/always
including configuration file /etc/freeradius/modules/counter
including configuration file /etc/freeradius/modules/linelog
including configuration file /etc/freeradius/modules/mschap
including configuration file /etc/freeradius/modules/attr_rewrite
including configuration file /etc/freeradius/modules/ippool
including configuration file /etc/freeradius/modules/preprocess
including configuration file /etc/freeradius/modules/detail.example.com
including configuration file /etc/freeradius/modules/chap
including configuration file /etc/freeradius/modules/expiration
including configuration file /etc/freeradius/modules/sradutmp
including configuration file /etc/freeradius/modules/krb5
including configuration file /etc/freeradius/modules/mac2ip
including configuration file /etc/freeradius/modules/detail
including configuration file /etc/freeradius/modules/exec
including configuration file /etc/freeradius/modules/expr
including configuration file /etc/freeradius/modules/logintime
including configuration file /etc/freeradius/modules/detail.log
including configuration file /etc/freeradius/modules/checkval
including configuration file /etc/freeradius/eap.conf
including configuration file /etc/freeradius/sql.conf
including configuration file /etc/freeradius/sql/mysql/dialup.conf
including configuration file /etc/freeradius/sql/mysql/counter.conf
including configuration file /etc/freeradius/policy.conf
including files in directory /etc/freeradius/sites-enabled/
including configuration file /etc/freeradius/sites-enabled/inner-tunnel
including configuration file /etc/freeradius/sites-enabled/default
including dictionary file /etc/freeradius/dictionary
main {
     prefix = "/usr"
     localstatedir = "/var"
     logdir = "/var/log/freeradius"
     libdir = "/usr/lib/freeradius"
     radacctdir = "/var/log/freeradius/radacct"
     hostname_lookups = no
     max_request_time = 30
     cleanup_delay = 5
     max_requests = 1024
     allow_core_dumps = no
     pidfile = "/var/run/freeradius/freeradius.pid"
     checkrad = "/usr/sbin/checkrad"
     debug_level = 0
     proxy_requests = yes
  log {
     stripped_names = no
     auth = no
     auth_badpass = no
     auth_goodpass = no
  }
  security {
     max_attributes = 200
     reject_delay = 1
     status_server = yes
  }
}
  client localhost {
     ipaddr = 127.0.0.1
     require_message_authenticator = no
     secret = "topsecret"
     nastype = "other"
  }
radiusd: #### Loading Realms and Home Servers ####
  proxy server {
     retry_delay = 5
     retry_count = 3
     default_fallback = no
     dead_time = 120
     wake_all_if_all_dead = no
  }
  home_server localhost {
     ipaddr = 127.0.0.1
     port = 1812
     type = "auth"
     secret = "testing123"
     response_window = 20
     max_outstanding = 65536
     zombie_period = 40
     status_check = "status-server"
     ping_interval = 30
     check_interval = 30
     num_answers_to_alive = 3
     num_pings_to_alive = 3
     revive_interval = 120
     status_check_timeout = 4
  }
  home_server_pool my_auth_failover {
     type = fail-over
     home_server = localhost
  }
  realm example.com {
     auth_pool = my_auth_failover
  }
  realm LOCAL {
  }
radiusd: #### Instantiating modules ####
  instantiate {
  Module: Linked to module rlm_exec
  Module: Instantiating exec
   exec {
     wait = no
     input_pairs = "request"
     shell_escape = yes
   }
  Module: Linked to module rlm_expr
  Module: Instantiating expr
  Module: Linked to module rlm_expiration
  Module: Instantiating expiration
   expiration {
     reply-message = "Your account has expired, %{User-Name}."
   }
  Module: Linked to module rlm_sqlcounter
  Module: Instantiating chillispot_max_bytes
   sqlcounter chillispot_max_bytes {
     counter-name = "ChilliSpot-Max-Total-Octets"
     check-name = "ChilliSpot-Max-Total-Octets"
     reply-name = "ChilliSpot-Max-Total-Octets"
     key = "User-Name"
     sqlmod-inst = "sql"
     query = "SELECT SUM(AcctInputOctets) + SUM(AcctOutputOctets) FROM 
radacct WHERE"
     reset = "never"
     safe-characters = 
"@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /"
   }
rlm_sqlcounter: Reply attribute ChilliSpot-Max-Total-Octets is number 
954138627
rlm_sqlcounter: Counter attribute ChilliSpot-Max-Total-Octets is number 
954138627
rlm_sqlcounter: Check attribute ChilliSpot-Max-Total-Octets is number 
954138627
rlm_sqlcounter: Current Time: 1275217359 [2010-05-30 23:02:39], Next 
reset 0 [2010-05-30 23:00:00]
rlm_sqlcounter: Current Time: 1275217359 [2010-05-30 23:02:39], Prev 
reset 0 [2010-05-30 23:00:00]
  Module: Instantiating noresetcounter
   sqlcounter noresetcounter {
     counter-name = "Session-Timeout"
     check-name = "Session-Timeout"
     reply-name = "Session-Timeout"
     key = "User-Name"
     sqlmod-inst = "sql"
     query = "SELECT SUM(Acctsessiontime) FROM radacct WHERE 
UserName='%{%k}'"
     reset = "never"
     safe-characters = 
"@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /"
   }
rlm_sqlcounter: Reply attribute Session-Timeout is number 27
rlm_sqlcounter: Counter attribute Session-Timeout is number 27
rlm_sqlcounter: Check attribute Session-Timeout is number 27
rlm_sqlcounter: Current Time: 1275217359 [2010-05-30 23:02:39], Next 
reset 0 [2010-05-30 23:00:00]
rlm_sqlcounter: Current Time: 1275217359 [2010-05-30 23:02:39], Prev 
reset 0 [2010-05-30 23:00:00]
  Module: Linked to module rlm_logintime
  Module: Instantiating logintime
   logintime {
     reply-message = "You are calling outside your allowed timespan  "
     minimum-timeout = 60
   }
  }
radiusd: #### Loading Virtual Servers ####
server inner-tunnel {
  modules {
  Module: Checking authenticate {...} for more modules to load
  Module: Linked to module rlm_pap
  Module: Instantiating pap
   pap {
     encryption_scheme = "auto"
     auto_header = no
   }
  Module: Linked to module rlm_chap
  Module: Instantiating chap
  Module: Linked to module rlm_mschap
  Module: Instantiating mschap
   mschap {
     use_mppe = yes
     require_encryption = no
     require_strong = no
     with_ntdomain_hack = no
   }
  Module: Linked to module rlm_unix
  Module: Instantiating unix
   unix {
     radwtmp = "/var/log/freeradius/radwtmp"
   }
  Module: Linked to module rlm_eap
  Module: Instantiating eap
   eap {
     default_eap_type = "md5"
     timer_expire = 60
     ignore_unknown_eap_types = no
     cisco_accounting_username_bug = no
     max_sessions = 2048
   }
  Module: Linked to sub-module rlm_eap_md5
  Module: Instantiating eap-md5
  Module: Linked to sub-module rlm_eap_leap
  Module: Instantiating eap-leap
  Module: Linked to sub-module rlm_eap_gtc
  Module: Instantiating eap-gtc
    gtc {
     challenge = "Password: "
     auth_type = "PAP"
    }
Ignoring EAP-Type/tls because we do not have OpenSSL support.
Ignoring EAP-Type/ttls because we do not have OpenSSL support.
Ignoring EAP-Type/peap because we do not have OpenSSL support.
  Module: Linked to sub-module rlm_eap_mschapv2
  Module: Instantiating eap-mschapv2
    mschapv2 {
     with_ntdomain_hack = no
    }
  Module: Checking authorize {...} for more modules to load
  Module: Linked to module rlm_realm
  Module: Instantiating suffix
   realm suffix {
     format = "suffix"
     delimiter = "@"
     ignore_default = no
     ignore_null = no
   }
  Module: Linked to module rlm_files
  Module: Instantiating files
   files {
     usersfile = "/etc/freeradius/users"
     acctusersfile = "/etc/freeradius/acct_users"
     preproxy_usersfile = "/etc/freeradius/preproxy_users"
     compat = "no"
   }
  Module: Checking session {...} for more modules to load
  Module: Linked to module rlm_radutmp
  Module: Instantiating radutmp
   radutmp {
     filename = "/var/log/freeradius/radutmp"
     username = "%{User-Name}"
     case_sensitive = yes
     check_with_nas = yes
     perm = 384
     callerid = yes
   }
  Module: Checking post-proxy {...} for more modules to load
  Module: Checking post-auth {...} for more modules to load
  Module: Linked to module rlm_attr_filter
  Module: Instantiating attr_filter.access_reject
   attr_filter attr_filter.access_reject {
     attrsfile = "/etc/freeradius/attrs.access_reject"
     key = "%{User-Name}"
   }
  }
}
  modules {
  Module: Checking authenticate {...} for more modules to load
  Module: Checking authorize {...} for more modules to load
  Module: Linked to module rlm_preprocess
  Module: Instantiating preprocess
   preprocess {
     huntgroups = "/etc/freeradius/huntgroups"
     hints = "/etc/freeradius/hints"
     with_ascend_hack = no
     ascend_channels_per_line = 23
     with_ntdomain_hack = no
     with_specialix_jetstream_hack = no
     with_cisco_vsa_hack = no
     with_alvarion_vsa_hack = no
   }
  Module: Linked to module rlm_sql
  Module: Instantiating sql
   sql {
     driver = "rlm_sql_mysql"
     server = "localhost"
     port = ""
     login = "easyhotspot"
     password = "secretpassword"
     radius_db = "easyhotspot_opensource"
     read_groups = yes
     sqltrace = no
     sqltracefile = "/var/log/freeradius/sqltrace.sql"
     readclients = no
     deletestalesessions = yes
     num_sql_socks = 5
     sql_user_name = "%{User-Name}"
     default_user_profile = ""
     nas_query = "SELECT id, nasname, shortname, type, secret FROM nas"
     authorize_check_query = "SELECT id, username, attribute, value, 
op           FROM radcheck           WHERE username = 
'%{SQL-User-Name}'           ORDER BY id"
     authorize_reply_query = "SELECT id, username, attribute, value, 
op           FROM radreply           WHERE username = 
'%{SQL-User-Name}'           ORDER BY id"
     authorize_group_check_query = "SELECT id, groupname, 
attribute,           Value, op           FROM radgroupcheck           
WHERE groupname = '%{Sql-Group}'           ORDER BY id"
     authorize_group_reply_query = "SELECT id, groupname, 
attribute,           value, op           FROM radgroupreply           
WHERE groupname = '%{Sql-Group}'           ORDER BY id"
     accounting_onoff_query = "          UPDATE radacct           
SET              acctstoptime       =  '%S',              
acctsessiontime    =  unix_timestamp('%S') 
-                                    
unix_timestamp(acctstarttime),              acctterminatecause =  
'%{Acct-Terminate-Cause}',              acctstopdelay      =  
%{%{Acct-Delay-Time}:-0}           WHERE acctstoptime IS NULL           
AND nasipaddress      =  '%{NAS-IP-Address}'           AND acctstarttime 
<= '%S'"
     accounting_update_query = "           UPDATE radacct           
SET              framedipaddress = '%{Framed-IP-Address}',              
acctsessiontime     = '%{Acct-Session-Time}',              
acctinputoctets     = '%{%{Acct-Input-Gigawords}:-0}' << 32 
|                                    
'%{%{Acct-Input-Octets}:-0}',              acctoutputoctets    = 
'%{%{Acct-Output-Gigawords}:-0}' << 32 
|                                    
'%{%{Acct-Output-Octets}:-0}'           WHERE acctsessionid = 
'%{Acct-Session-Id}'           AND username        = 
'%{SQL-User-Name}'           AND nasipaddress    = '%{NAS-IP-Address}'"
     accounting_update_query_alt = "           INSERT INTO 
radacct             (acctsessionid,    acctuniqueid,      
username,              realm,            nasipaddress,      
nasportid,              nasporttype,      acctstarttime,     
acctsessiontime,              acctauthentic,    connectinfo_start, 
acctinputoctets,              acctoutputoctets, calledstationid,   
callingstationid,              servicetype,      framedprotocol,    
framedipaddress,              acctstartdelay,   
xascendsessionsvrkey)           VALUES             
('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}',              
'%{SQL-User-Name}',              '%{Realm}', '%{NAS-IP-Address}', 
'%{NAS-Port}',              '%{NAS-Port-Type}',              
DATE_SUB('%S',                       INTERVAL 
(%{%{Acct-Session-Time}:-0} +                                 
%{%{Acct-Delay-Time}:-0}) SECOND),                       
'%{Acct-Session-Time}',              '%{Acct-Authentic}', 
'',              '%{%{Acct-Input-Gigawords}:-0}' << 32 |              
'%{%{Acct-Input-Octets}:-0}',              
'%{%{Acct-Output-Gigawords}:-0}' << 32 |              
'%{%{Acct-Output-Octets}:-0}',              '%{Called-Station-Id}', 
'%{Calling-Station-Id}',              '%{Service-Type}', 
'%{Framed-Protocol}',              '%{Framed-IP-Address}',              
'0', '%{X-Ascend-Session-Svr-Key}')"
     accounting_start_query = "           INSERT INTO 
radacct             (acctsessionid,    acctuniqueid,     
username,              realm,            nasipaddress,     
nasportid,              nasporttype,      acctstarttime,    
acctstoptime,              acctsessiontime,  acctauthentic,    
connectinfo_start,              connectinfo_stop, acctinputoctets,  
acctoutputoctets,              calledstationid,  callingstationid, 
acctterminatecause,              servicetype,      framedprotocol,   
framedipaddress,              acctstartdelay,   acctstopdelay,    
xascendsessionsvrkey)           VALUES             
('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}',              
'%{SQL-User-Name}',              '%{Realm}', '%{NAS-IP-Address}', 
'%{NAS-Port}',              '%{NAS-Port-Type}', '%S', NULL,              
'0', '%{Acct-Authentic}', '%{Connect-Info}',              '', '0', 
'0',              '%{Called-Station-Id}', '%{Calling-Station-Id}', 
'',              '%{Service-Type}', '%{Framed-Protocol}', 
'%{Framed-IP-Address}',              '%{%{Acct-Delay-Time}:-0}', '0', 
'%{X-Ascend-Session-Svr-Key}')"
     accounting_start_query_alt = "           UPDATE radacct 
SET              acctstarttime     = '%S',              
acctstartdelay    = '%{%{Acct-Delay-Time}:-0}',              
connectinfo_start = '%{Connect-Info}'           WHERE acctsessionid  = 
'%{Acct-Session-Id}'           AND username         = 
'%{SQL-User-Name}'           AND nasipaddress     = '%{NAS-IP-Address}'"
     accounting_stop_query = "           UPDATE radacct SET              
acctstoptime       = '%S',              acctsessiontime    = 
'%{Acct-Session-Time}',              acctinputoctets    = 
'%{%{Acct-Input-Gigawords}:-0}' << 32 
|                                   
'%{%{Acct-Input-Octets}:-0}',              acctoutputoctets   = 
'%{%{Acct-Output-Gigawords}:-0}' << 32 
|                                   
'%{%{Acct-Output-Octets}:-0}',              acctterminatecause = 
'%{Acct-Terminate-Cause}',              acctstopdelay      = 
'%{%{Acct-Delay-Time}:-0}',              connectinfo_stop   = 
'%{Connect-Info}'           WHERE acctsessionid   = 
'%{Acct-Session-Id}'           AND username          = 
'%{SQL-User-Name}'           AND nasipaddress      = '%{NAS-IP-Address}'"
     accounting_stop_query_alt = "           INSERT INTO 
radacct             (acctsessionid, acctuniqueid, username,              
realm, nasipaddress, nasportid,              nasporttype, acctstarttime, 
acctstoptime,              acctsessiontime, acctauthentic, 
connectinfo_start,              connectinfo_stop, acctinputoctets, 
acctoutputoctets,              calledstationid, callingstationid, 
acctterminatecause,              servicetype, framedprotocol, 
framedipaddress,              acctstartdelay, acctstopdelay)           
VALUES             ('%{Acct-Session-Id}', 
'%{Acct-Unique-Session-Id}',              
'%{SQL-User-Name}',              '%{Realm}', '%{NAS-IP-Address}', 
'%{NAS-Port}',              '%{NAS-Port-Type}',              
DATE_SUB('%S',                  INTERVAL (%{%{Acct-Session-Time}:-0} 
+                  %{%{Acct-Delay-Time}:-0}) SECOND),              '%S', 
'%{Acct-Session-Time}', '%{Acct-Authentic}', '',              
'%{Connect-Info}',              '%{%{Acct-Input-Gigawords}:-0}' << 32 
|              '%{%{Acct-Input-Octets}:-0}',              
'%{%{Acct-Output-Gigawords}:-0}' << 32 |              
'%{%{Acct-Output-Octets}:-0}',              '%{Called-Station-Id}', 
'%{Calling-Station-Id}',              
'%{Acct-Terminate-Cause}',              '%{Service-Type}', 
'%{Framed-Protocol}', '%{Framed-IP-Address}',              '0', 
'%{%{Acct-Delay-Time}:-0}')"
     group_membership_query = "SELECT groupname           FROM 
radusergroup           WHERE username = '%{SQL-User-Name}'           
ORDER BY priority"
     connect_failure_retry_delay = 60
     simul_count_query = ""
     simul_verify_query = "SELECT radacctid, acctsessionid, 
username,                                nasipaddress, nasportid, 
framedipaddress,                                callingstationid, 
framedprotocol                                FROM 
radacct                                WHERE username = 
'%{SQL-User-Name}'                                AND acctstoptime IS NULL"
     postauth_query = "INSERT INTO radpostauth                           
(username, pass, reply, authdate)                           VALUES 
(                           '%{User-Name}',                           
'%{%{User-Password}:-%{Chap-Password}}',                           
'%{reply:Packet-Type}', '%S')"
     safe-characters = 
"@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /"
   }
rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked
rlm_sql (sql): Attempting to connect to 
easyhotspot@localhost:/easyhotspot_opensource
rlm_sql (sql): starting 0
rlm_sql (sql): Attempting to connect rlm_sql_mysql #0
rlm_sql_mysql: Starting connect to MySQL server for #0
rlm_sql (sql): Connected new DB handle, #0
rlm_sql (sql): starting 1
rlm_sql (sql): Attempting to connect rlm_sql_mysql #1
rlm_sql_mysql: Starting connect to MySQL server for #1
rlm_sql (sql): Connected new DB handle, #1
rlm_sql (sql): starting 2
rlm_sql (sql): Attempting to connect rlm_sql_mysql #2
rlm_sql_mysql: Starting connect to MySQL server for #2
rlm_sql (sql): Connected new DB handle, #2
rlm_sql (sql): starting 3
rlm_sql (sql): Attempting to connect rlm_sql_mysql #3
rlm_sql_mysql: Starting connect to MySQL server for #3
rlm_sql (sql): Connected new DB handle, #3
rlm_sql (sql): starting 4
rlm_sql (sql): Attempting to connect rlm_sql_mysql #4
rlm_sql_mysql: Starting connect to MySQL server for #4
rlm_sql (sql): Connected new DB handle, #4
  Module: Instantiating max_all_mb
   sqlcounter max_all_mb {
     counter-name = "Max-All-MB"
     check-name = "Max-All-MB"
     reply-name = "ChilliSpot-Max-Total-Octets"
     key = "User-Name"
     sqlmod-inst = "sql"
     query = "SELECT SUM(AcctInputOctets) + SUM(AcctOutputOctets)  FROM 
radacct WHERE UserName='%{%k}'"
     reset = "never"
     safe-characters = 
"@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /"
   }
rlm_sqlcounter: Reply attribute ChilliSpot-Max-Total-Octets is number 
954138627
rlm_sqlcounter: Counter attribute Max-All-MB is number 954138635
rlm_sqlcounter: Check attribute Max-All-MB is number 954138635
rlm_sqlcounter: Current Time: 1275217359 [2010-05-30 23:02:39], Next 
reset 1275307200 [2010-06-01 00:00:00]
rlm_sqlcounter: Current Time: 1275217359 [2010-05-30 23:02:39], Prev 
reset 1272628800 [2010-05-01 00:00:00]
  Module: Checking preacct {...} for more modules to load
  Module: Linked to module rlm_acct_unique
  Module: Instantiating acct_unique
   acct_unique {
     key = "User-Name, Acct-Session-Id, NAS-IP-Address, 
Client-IP-Address, NAS-Port"
   }
  Module: Checking accounting {...} for more modules to load
  Module: Linked to module rlm_detail
  Module: Instantiating detail
   detail {
     detailfile = 
"/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d"
     header = "%t"
     detailperm = 384
     dirperm = 493
     locking = no
     log_packet_header = no
   }
  Module: Instantiating sradutmp
   radutmp sradutmp {
     filename = "/var/log/freeradius/sradutmp"
     username = "%{User-Name}"
     case_sensitive = yes
     check_with_nas = yes
     perm = 420
     callerid = no
   }
  Module: Instantiating attr_filter.accounting_response
   attr_filter attr_filter.accounting_response {
     attrsfile = "/etc/freeradius/attrs.accounting_response"
     key = "%{User-Name}"
   }
  Module: Checking session {...} for more modules to load
  Module: Checking post-proxy {...} for more modules to load
  Module: Checking post-auth {...} for more modules to load
  }
radiusd: #### Opening IP addresses and Ports ####
listen {
     type = "auth"
     ipaddr = *
     port = 0
}
listen {
     type = "acct"
     ipaddr = *
     port = 0
}
Listening on authentication address * port 1812
Listening on accounting address * port 1813
Listening on proxy address * port 1814
Ready to process requests.

Your maximum never usage time has been reached

David Moorhouse (FR)