different acctuniqueids with common keys?
I have a curious problem with my FreeRADIUS 2.1.10 installation. I'm using a PostgresQL backend and something close to the default config. It seems that sometimes (judging from the value of affected sessions this is a fairly rare occurrence) a duplicate entry is added to the radacct table which has a different acctuniqueid to its related duplicate entries. Relevant radconf2xml snippet is: <acct_unique> <key>User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port</key> </acct_unique> Related entries I'm looking at in the radacct table are: username, acctsessionid, nasipaddress, framedipaddress, nasportid. I have checked these with a script and confirmed that I have a number of entries which share all these attributes yet have different acctuniqueids. This is a problem for me since it causes my billing software to overconsume usage. I could change this to not use acctuniqueid, but a fixed acctuniqueid would make my life easier. Any ideas? Best, -AL.
andrew@sybaweb.com wrote:
I have a curious problem with my FreeRADIUS 2.1.10 installation. I'm using a PostgresQL backend and something close to the default config.
It seems that sometimes (judging from the value of affected sessions this is a fairly rare occurrence) a duplicate entry is added to the radacct table which has a different acctuniqueid to its related duplicate entries.
Relevant radconf2xml snippet is:
Huh? Why not just copy the text from the configuration file? Why use XML?
Any ideas?
Blame the NAS. FreeRADIUS just uses what the NAS sends it. Alan DeKok.
As Alan says it's the NAS not including a consistent set of Attribute and or values. Probably worth setting up a packet log and seeing if you can figure out what changes in the packets that cause new sessions to be generated. Once you know which attribute it is, replace it in the acctuniqueid config with an alternate, or remove it entirely. On 18 Jun 2011, at 06:59, Alan DeKok <aland@deployingradius.com> wrote:
andrew@sybaweb.com wrote:
I have a curious problem with my FreeRADIUS 2.1.10 installation. I'm using a PostgresQL backend and something close to the default config.
It seems that sometimes (judging from the value of affected sessions this is a fairly rare occurrence) a duplicate entry is added to the radacct table which has a different acctuniqueid to its related duplicate entries.
Relevant radconf2xml snippet is:
Huh? Why not just copy the text from the configuration file? Why use XML?
Any ideas?
Blame the NAS. FreeRADIUS just uses what the NAS sends it.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Sat, 18 Jun 2011 07:39:53 +0200, Arran Cudbard-Bell wrote:
As Alan says it's the NAS not including a consistent set of Attribute and or values.
The key attributes per the config (acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" }) *are* consistent in the radacct table yet the value of acctuniqueid is not. I suppose the missing values could have been populated later. Will look into finding out more about the behaviour of the NAS (not operated by me, supplied documentation doesn't make any guarantees about presence of a given attribute :/). Thanks, -AL.
On Jun 18, 2011, at 1:26 PM, andrew@sybaweb.com wrote:
On Sat, 18 Jun 2011 07:39:53 +0200, Arran Cudbard-Bell wrote:
As Alan says it's the NAS not including a consistent set of Attribute and or values.
The key attributes per the config (acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" }) *are* consistent in the radacct table yet the value of acctuniqueid is not. I suppose the missing values could have been populated later.
Um yes. Especially if you're using interim updates. -Arran Arran Cudbard-Bell RM-RF Limited - Security consultation and contracting VoIP: +1 916-436-1352 Cell: +44 7854041841
This is an issue for us as well. It seems in our case, the NAS retransmits the start packet 60 seconds later and this has an impact on the acctuniqueid as shown in the example below: Tue Aug 30 13:32:49 2011 Event-Timestamp = "Aug 30 2011 13:32:48 EDT" User-Name = "user@example.com" NAS-IP-Address = 69.72.31.155 NAS-Identifier = "mtar-apx01.1dial.com" Ascend-Owner-IP-Addr = 0.0.0.0 NAS-Port = 4652 Ascend-NAS-Port-Format = 4 NAS-Port-Type = Async Service-Type = Framed-User Class = 0x4241534943495350 Acct-Status-Type = Start Acct-Delay-Time = 0 Acct-Session-Id = "592238627" Acct-Authentic = RADIUS Ascend-Auth-Delay = 1580 Ascend-Data-Rate = 21600 Ascend-Xmit-Rate = 40000 Ascend-Modem-PortNo = 92 Ascend-Modem-SlotNo = 14 Ascend-Modem-ShelfNo = 1 Calling-Station-Id = "..." Ascend-Calling-Id-Type-Of-Num = Unknown Ascend-Calling-Id-Number-Plan = Unknown Ascend-Calling-Id-Presentatn = Allowed Ascend-Calling-Id-Screening = 40 Called-Station-Id = "..." Ascend-Data-Svc = Switched-Voice-Bearer Framed-Protocol = PPP Framed-IP-Address = 208.103.135.234 Proxy-State = 0x3138 Proxy-State = 0x313435 Proxy-State = 0x323034 Realm = "example.com" Acct-Unique-Session-Id = "547e6cd62913bca0" Timestamp = 1314725569 Tue Aug 30 13:33:49 2011 Event-Timestamp = "Aug 30 2011 13:32:48 EDT" User-Name = "user@example.com" NAS-IP-Address = 69.72.31.155 NAS-Identifier = "mtar-apx01.1dial.com" Ascend-Owner-IP-Addr = 0.0.0.0 NAS-Port = 4652 Ascend-NAS-Port-Format = 4 NAS-Port-Type = Async Service-Type = Framed-User Class = 0x4241534943495350 Acct-Status-Type = Start Acct-Delay-Time = 60 Acct-Session-Id = "592238627" Acct-Authentic = RADIUS Ascend-Auth-Delay = 1580 Ascend-Data-Rate = 21600 Ascend-Xmit-Rate = 40000 Ascend-Modem-PortNo = 92 Ascend-Modem-SlotNo = 14 Ascend-Modem-ShelfNo = 1 Calling-Station-Id = "..." Ascend-Calling-Id-Type-Of-Num = Unknown Ascend-Calling-Id-Number-Plan = Unknown Ascend-Calling-Id-Presentatn = Allowed Ascend-Calling-Id-Screening = 40 Called-Station-Id = "..." Ascend-Data-Svc = Switched-Voice-Bearer Framed-Protocol = PPP Framed-IP-Address = 208.103.135.234 Proxy-State = 0x3230 Proxy-State = 0x3832 Proxy-State = 0x3934 Realm = "example.com" Acct-Unique-Session-Id = "0041ee21d0b1c6b1" Timestamp = 1314725629 As with many companies using load balancing, it may not be good to use Client-IP-Address to key on as this changed 60 seconds later. Default in modules/acct_unique: acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } The man page for rlm_acct_unique shows: acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Port" } Anyone know when this was changed? ----- Original Message ----- From: "Arran Cudbard-Bell" <a.cudbardb@gmail.com> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Saturday, June 18, 2011 7:50:49 AM Subject: Re: different acctuniqueids with common keys? On Jun 18, 2011, at 1:26 PM, andrew@sybaweb.com wrote:
On Sat, 18 Jun 2011 07:39:53 +0200, Arran Cudbard-Bell wrote:
As Alan says it's the NAS not including a consistent set of Attribute and or values.
The key attributes per the config (acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" }) *are* consistent in the radacct table yet the value of acctuniqueid is not. I suppose the missing values could have been populated later.
Um yes. Especially if you're using interim updates. -Arran Arran Cudbard-Bell RM-RF Limited - Security consultation and contracting VoIP: +1 916-436-1352 Cell: +44 7854041841 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 06/09/2011 00:36, Rob Turner wrote:
Default in modules/acct_unique:
acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" }
The man page for rlm_acct_unique shows:
acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Port" }
Anyone know when this was changed? Apparently, a long time ago: https://github.com/alandekok/freeradius-server/commits/master/raddb/modules/...
-James
On 6 Sep 2011, at 06:04, James J J Hooper wrote:
On 06/09/2011 00:36, Rob Turner wrote:
Default in modules/acct_unique:
acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" }
The man page for rlm_acct_unique shows:
acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Port" }
Anyone know when this was changed? Apparently, a long time ago: https://github.com/alandekok/freeradius-server/commits/master/raddb/modules/...
See policy.conf on the master branch for an acctuniqueid scheme which sucks less... This will be the default for new 3.x configs as the policy overloads the module. -Arran Arran Cudbard-Bell a.cudbardb@freeradius.org RADIUS - Half the complexity of Diameter
participants (6)
-
Alan DeKok -
andrew＠sybaweb.com -
Arran Cudbard-Bell -
Arran Cudbard-Bell -
James J J Hooper -
Rob Turner