Trying to restrict simultaneous-use
I'm doing some tests from localhost to restrict simultaneous-use. * I have a user defined in the users file with Simultaneous-Use := 1. * I have the following file which I feed to radclient to initiate an accounting session for this user: Packet-Type=4 Packet-Dst-Port=1813 Acct-Session-Id = "4D2BB8AC-00000098" Acct-Status-Type = Start Acct-Authentic = RADIUS User-Name = "spackle" NAS-Port = 0 Connect-Info = "CONNECT 48Mbps 802.11b" * In sites-enabled/default I have uncommented "radutmp" and "sradumtp" in accounting{} and I have uncommented radutmp in session{} (yes I know sql is faster but this is just for testing) After running radclient, I see the following with "radwho": Login Name What TTY When From Location spackle spackle shell S0 Sat 08:08 127.0.0.1 All good so far. Now i try to simulate logging in again: radtest spartan password 127.0.0.1 101 hello I am expecting this to be Rejected, but it gets Accepted instead: Received Access-Accept Id 212 from 127.0.0.1:1812 to 0.0.0.0:0 length 35 The debug file shows: (2) # Executing section session from file /usr/local/freeradius/etc/raddb/sites-enabled/default (2) session { (2) radutmp: EXPAND /usr/local/freeradius/var/log/radius/radutmp (2) radutmp: --> /usr/local/freeradius/var/log/radius/radutmp (2) radutmp: EXPAND %{User-Name} (2) radutmp: --> spackle checkrad: No NAS type, or type "other" not checking (2) [radutmp] = fail (2) } # session = fail radutmp is failing but it still sends an Access-Accept. Any thoughts? -- --- Michael Martinez http://www.michael--martinez.com
On Mar 5, 2016, at 11:23 AM, Michael Martinez <mwtzzz@gmail.com> wrote:
I'm doing some tests from localhost to restrict simultaneous-use.
* I have a user defined in the users file with Simultaneous-Use := 1. * I have the following file which I feed to radclient to initiate an accounting session for this user:
That's good.
* In sites-enabled/default I have uncommented "radutmp" and "sradumtp" in accounting{} and I have uncommented radutmp in session{} (yes I know sql is faster but this is just for testing)
OK.
The debug file shows: (2) # Executing section session from file /usr/local/freeradius/etc/raddb/sites-enabled/default (2) session { (2) radutmp: EXPAND /usr/local/freeradius/var/log/radius/radutmp (2) radutmp: --> /usr/local/freeradius/var/log/radius/radutmp (2) radutmp: EXPAND %{User-Name} (2) radutmp: --> spackle checkrad: No NAS type, or type "other" not checking (2) [radutmp] = fail (2) } # session = fail
radutmp is failing but it still sends an Access-Accept. Any thoughts?
Because it's fail-safe. It can't do session checking, so it allows the user in. Fix the test so that the NAS is marked as a real NAS, and so checkrad can check it. Or, edit the "session" section so that it returns "ok" if "radutmp" returns "fail". See "man unlang" for documentation on module return codes. Alan DeKok.
On Sat, Mar 5, 2016 at 8:33 AM, Alan DeKok <aland@deployingradius.com> wrote:
Because it's fail-safe. It can't do session checking, so it allows the user in.
Fix the test so that the NAS is marked as a real NAS, and so checkrad can check it.
I reran the tests, this time with nas_type = cisco for localhost in clients.conf. Now it seems to timeout: (0) No reply from server for ID 144 socket 3 debug log: (1) # Executing section session from file /usr/local/freeradius/etc/raddb/sites-enabled/default (1) session { (1) radutmp: EXPAND /usr/local/freeradius/var/log/radius/radutmp (1) radutmp: --> /usr/local/freeradius/var/log/radius/radutmp (1) radutmp: EXPAND %{User-Name} (1) radutmp: --> spackle checkrad: Neither SNMP_Session module or found! checkrad: not found! I don't know if this is the expected result, or should it be giving me an "Access-Reject" instead?
On Mar 5, 2016, at 1:40 PM, Michael Martinez <mwtzzz@gmail.com> wrote:
On Sat, Mar 5, 2016 at 8:33 AM, Alan DeKok <aland@deployingradius.com> wrote:
Because it's fail-safe. It can't do session checking, so it allows the user in.
Fix the test so that the NAS is marked as a real NAS, and so checkrad can check it.
I reran the tests, this time with nas_type = cisco for localhost in clients.conf. Now it seems to timeout: (0) No reply from server for ID 144 socket 3
debug log: (1) # Executing section session from file /usr/local/freeradius/etc/raddb/sites-enabled/default (1) session { (1) radutmp: EXPAND /usr/local/freeradius/var/log/radius/radutmp (1) radutmp: --> /usr/local/freeradius/var/log/radius/radutmp (1) radutmp: EXPAND %{User-Name} (1) radutmp: --> spackle checkrad: Neither SNMP_Session module or found! checkrad: not found!
Which is expected if you don't have checkrad installed.
I don't know if this is the expected result, or should it be giving me an "Access-Reject" instead?
At this point, I'm going to have to suggest you read the docs on Simultaneous-Use. See the wiki. It explains all of this in detail. Alan DeKok.
On Sat, Mar 5, 2016 at 11:02 AM, Alan DeKok <aland@deployingradius.com> wrote:
At this point, I'm going to have to suggest you read the docs on Simultaneous-Use. See the wiki. It explains all of this in detail.
According to the wiki, snmp is needed by checkrad, so I installed it and added /usr/bin/snmpget to the snmpget variable in the script. Now remember I am trying to simulate Simultaneous-Use from localhost. I'm wondering whether this is possible, because if I define localhost as nastype "other", the checkrad ignores it and the server returns Access-Accept. If I put some other nas_type value such as "cisco" then checkrad tries to look up the MIB so that it can connect via snmpget. I don't want to have to set up snmpd on my localhost just to test this. Is there any other way? -- --- Michael Martinez http://www.michael--martinez.com
On Mar 6, 2016, at 6:09 PM, Michael Martinez <mwtzzz@gmail.com> wrote:
On Sat, Mar 5, 2016 at 11:02 AM, Alan DeKok <aland@deployingradius.com> wrote:
At this point, I'm going to have to suggest you read the docs on Simultaneous-Use. See the wiki. It explains all of this in detail.
According to the wiki, snmp is needed by checkrad, so I installed it and added /usr/bin/snmpget to the snmpget variable in the script.
That's all nice and good, but do you understand the concepts? Why is checkrad being called? Do you know?
Now remember I am trying to simulate Simultaneous-Use from localhost. I'm wondering whether this is possible, because if I define localhost as nastype "other", the checkrad ignores it and the server returns Access-Accept.
That's how it's supposed to work. As I said before, it's fail-safe. If you want it to behave differently... I told you how to get it to behave differently.
If I put some other nas_type value such as "cisco" then checkrad tries to look up the MIB so that it can connect via snmpget. I don't want to have to set up snmpd on my localhost just to test this. Is there any other way?
You can't just install snmpd on localhost, and expect it to answer on the *cisco* MIBS. That makes zero sense. And you can't expect snmpd to magically know that you ran radclient, and that a user tried to login. Read doc/configuration/simultaneous_use in the distribution archive. See section 3. This is documented. The "checkrad" program is run when the server thinks a user *might* be already online. "checkrad" checks the users status on the NAS, to see if the user is actually still online. Alan DeKok.
participants (2)
-
Alan DeKok -
Michael Martinez