RE: Stale Sessions
No one has any ideas or suggestions? If I can solve this issue I will have a 'perfect' freeradius installation. And FYI I upgraded my server to a dual core 2BG of RAM and still the same issue resides. Thanks, Shane ________________________________ From: Shane McKinley Sent: Tuesday, April 08, 2008 11:17 AM To: 'freeradius-users@lists.freeradius.org' Subject: Stale Sessions I have searched and searched, read the archives, etc. I feel that I may have a unique problem and just missing a piece of the puzzle. I have been running freeradius with a mysql database for over a year now. It is very stable and I am generally pleased. I have been having stale session issues on every one of my NASes. They range from Cisco 7200, Cisco 2600, and Livingston Portmasters. They all have stale sessions in the mysql database that never recieve a stop time. I am almost certain there are no network issues because it seems that start packets are never lost or update packets either. This is the aaa config on my Ciscos: aaa new-model ! ! aaa authentication login default local group radius aaa authentication login telnet line aaa authentication ppp default if-needed local group radius aaa authorization network default local group radius aaa authorization network iemcdslauth group radius local aaa accounting delay-start aaa accounting update newinfo aaa accounting network default start-stop group radius aaa session-id common ! radius-server attribute nas-port format d radius-server host X.X.X.X auth-port 1645 acct-port 1646 radius-server key 7 XXXXXXXXXXXXXXX So the question is, why are my NASs not sending stop packets, or why is the freeradius server not processing the stop packets? Is this a common problem? Feel free to also point me to some documents that may be of assistance. Maybe I don't have enough resources to process the commands? I have about 1500 users. This is my setup: openSuSE 10.2 Freeradius 1.1.13 MySQL 5.0.26 128MB RAM Pentium III Thanks for any help, Shane
Shane McKinley wrote:
No one has any ideas or suggestions? If I can solve this issue I will have a 'perfect' freeradius installation. And FYI I upgraded my server to a dual core 2BG of RAM and still the same issue resides.
If the radius server doesn't receive the packets, it doesn't matter how fast it is. Most people will: 1. enable interim accounting with an interim interval of e.g. 1/2 hour 2. delete sessions where "now - (starttime + sessiontime) > 2 hours" The former you can usually achieve by adding the Acct-Interim-Interval to your Access-Accept. The latter is database-specific and you'll need to come up with the SQL yourself.
Hi,
No one has any ideas or suggestions? If I can solve this issue I will have a 'perfect' freeradius installation. And FYI I upgraded my server to a dual core 2BG of RAM and still the same issue resides.
radutmp issueS? what are you using to make sessions unique? perhaps they are not unique enough. also, some NASs do have issues with sending this sort of thing properly. most posts on this topic have, historically, stated that if you have a session time-out of eg 1 hour, then just run a script which will close any session that has not bene updated for at least an hour - because ,logically, that session is now dead and gone. alan
Thanks for the reply. However, these are Internet customers coming from DSL or Dial up. I assume the Cisco and portmasters are sending unique session IDs. I will try creating a session timeout of 2 days, then create a script for updating the accounting stop time. Thanks all. -----Original Message----- From: A.L.M.Buxey@lboro.ac.uk [mailto:A.L.M.Buxey@lboro.ac.uk] Sent: Friday, April 11, 2008 12:40 PM To: FreeRadius users mailing list Subject: Re: Stale Sessions Hi,
No one has any ideas or suggestions? If I can solve this issue I will have a 'perfect' freeradius installation. And FYI I upgraded my server
to a dual core 2BG of RAM and still the same issue resides.
radutmp issueS? what are you using to make sessions unique? perhaps they are not unique enough. also, some NASs do have issues with sending this sort of thing properly. most posts on this topic have, historically, stated that if you have a session time-out of eg 1 hour, then just run a script which will close any session that has not bene updated for at least an hour - because ,logically, that session is now dead and gone. alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I'm using a PEAP-Mschapv2 autentication with freeradius. When a client wants to autenticate for the first time, windows askes for the credentials where you must put your user name and password. When this client wants to autenticate for the second time, windows doesn't ask his credentials (user name and password) again. How can I obligate windows to ask the client credentials before every authentication????
Hi,
I'm using a PEAP-Mschapv2 autentication with freeradius. When a client wants to autenticate for the first time, windows askes for the credentials where you must put your user name and password. When this client wants to autenticate for the second time, windows doesn't ask his credentials (user name and password) again.
How can I obligate windows to ask the client credentials before every authentication????
Windows caches this stuff. to get it to forget, you need to remove that information. REGEDIT4 [-HKEY_CURRENT_USER\Software\Microsoft\Eapol\UserEapInfo] alan
Thanks for the reply. However, these are Internet customers coming from DSL or Dial up. I assume the Cisco and portmasters are sending unique session IDs.
Don't assume. Use debug to see what's happening with accounting packets. Ivan Kalik Kalik Informatika ISP
participants (5)
-
A.L.M.Buxey＠lboro.ac.uk -
Eduardo Cavalcanti -
Ivan Kalik -
Phil Mayers -
Shane McKinley