Hello, I am trying to use the Simultaneous-Use feature of FreeRADIUS. I have some questions regarding https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/doc/configuratio... I am using SQL and I have set Simultaneous-Use to 1 with the := operator. I can see this in debug output. Is the implementation notes regarding radutmp valid for SQL too? I have verified that simul_count_query and simul_verify_query are syntactically correct. When I execute them manually, I see some SQL results in PostgreSQL console. I tried to run radcheck like this: checkrad -d other 192.168.3.5 0 testuser01 'ACA31EB30AD1-70BBE9363CBC-5CC2A65E-8DAD3' Returning 1 (double detected) I am using Aruba NAS. I do not know what NAS-Type to use. I tried 'other' and it doesn't seem to have any effect. Should I be looking at getting checkrad to work first before doing anything else? If so, any tips to get this to work with Aruba NAS would be appreciated. At the moment, FreeRADIUS allows login from two devices at the same time for the same user. I am not sure what approach to take here. Some guidance would be appreciated. - Sudheer S
On Apr 26, 2019, at 3:06 AM, Sudheer Satyanarayana <sudheer@techchorus.net> wrote:
I am trying to use the Simultaneous-Use feature of FreeRADIUS.
I have some questions regarding https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/doc/configuratio...
I am using SQL and I have set Simultaneous-Use to 1 with the := operator. I can see this in debug output.
That's good.
Is the implementation notes regarding radutmp valid for SQL too?
Which notes?
I have verified that simul_count_query and simul_verify_query are syntactically correct. When I execute them manually, I see some SQL results in PostgreSQL console.
I tried to run radcheck like this:
checkrad -d other 192.168.3.5 0 testuser01 'ACA31EB30AD1-70BBE9363CBC-5CC2A65E-8DAD3'
Returning 1 (double detected)
Because it *always* returns "1" for type "other".
I am using Aruba NAS. I do not know what NAS-Type to use. I tried 'other' and it doesn't seem to have any effect.
Should I be looking at getting checkrad to work first before doing anything else? If so, any tips to get this to work with Aruba NAS would be appreciated.
At the moment, FreeRADIUS allows login from two devices at the same time for the same user. I am not sure what approach to take here. Some guidance would be appreciated.
Simultaneous-Use only works if the NAS sends accounting packets. This is made clear in section 5 of the document you read. So is the NAS sending accounting packets? Alan DeKok.
On 26/04/19 4:13 PM, Alan DeKok wrote:
On Apr 26, 2019, at 3:06 AM, Sudheer Satyanarayana <sudheer@techchorus.net> wrote:
I am trying to use the Simultaneous-Use feature of FreeRADIUS.
I have some questions regarding https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/doc/configuratio...
I am using SQL and I have set Simultaneous-Use to 1 with the := operator. I can see this in debug output. That's good.
Is the implementation notes regarding radutmp valid for SQL too? Which notes?
"3. IMPLEMENTATION The server keeps a list of logged-in users in the /var/log/radutmp file. This is also called "the session database". " This notes ^.
I have verified that simul_count_query and simul_verify_query are syntactically correct. When I execute them manually, I see some SQL results in PostgreSQL console.
I tried to run radcheck like this:
checkrad -d other 192.168.3.5 0 testuser01 'ACA31EB30AD1-70BBE9363CBC-5CC2A65E-8DAD3'
Returning 1 (double detected) Because it *always* returns "1" for type "other".
I am using Aruba NAS. I do not know what NAS-Type to use. I tried 'other' and it doesn't seem to have any effect.
Should I be looking at getting checkrad to work first before doing anything else? If so, any tips to get this to work with Aruba NAS would be appreciated. Do you recommend using a particular NAS type in the radcheck command for Aruba?
At the moment, FreeRADIUS allows login from two devices at the same time for the same user. I am not sure what approach to take here. Some guidance would be appreciated. Simultaneous-Use only works if the NAS sends accounting packets. This is made clear in section 5 of the document you read.
So is the NAS sending accounting packets?
Yes, the NAS is sending accounting packets. - Sudheer
On Apr 26, 2019, at 7:26 AM, Sudheer S <sudheer@techchorus.net> wrote:
Is the implementation notes regarding radutmp valid for SQL too? Which notes?
"3. IMPLEMENTATION
The server keeps a list of logged-in users in the /var/log/radutmp file. This is also called "the session database".
If you configure the "radutmp" module, then the server stores sessions in the "radutmp" file. If you don't configure the "radutmp" module, then it should be clear what happens. Read the default configuration to see what happens when you use radutmp and sql. All of the information you need is in front of you, in documentation and in the standard configuration.
Do you recommend using a particular NAS type in the radcheck command for Aruba?
No.
Yes, the NAS is sending accounting packets.
Then read the debug output to see what it's doing. If you don't understand it, post it here. Alan DeKok.
"3. IMPLEMENTATION
The server keeps a list of logged-in users in the /var/log/radutmp file. This is also called "the session database". If you configure the "radutmp" module, then the server stores sessions in the "radutmp" file. If you don't configure the "radutmp" module, then it should be clear what happens.
Read the default configuration to see what happens when you use radutmp and sql. All of the information you need is in front of you, in documentation and in the standard configuration. You are right. Thanks for emphasizing to read the documentation. All the relevant information is indeed available in the comments of default configuration. It was hard to understand all of them at once. Reading them repeatedly helped understand the concepts well.
Yes, the NAS is sending accounting packets. Then read the debug output to see what it's doing. If you don't understand it, post it here.
I was able to fix the configuration. Simultaneous-Use works as expected now. Thanks. - Sudheer S
On Apr 28, 2019, at 3:04 AM, Sudheer S <sudheer@techchorus.net> wrote:
You are right. Thanks for emphasizing to read the documentation. All the relevant information is indeed available in the comments of default configuration. It was hard to understand all of them at once. Reading them repeatedly helped understand the concepts well.
That's good to hear. The documentation is getting pretty good. The problem is that peoples needs are complex. It's hard to have documentation which is perfect for everyone. Instead, we just document how the server works, and ask people to put the pieces together. It can be a pain, but the solution is almost always simple.
I was able to fix the configuration. Simultaneous-Use works as expected now.
Sounds good. Alan DeKok.
participants (3)
-
Alan DeKok -
Sudheer S -
Sudheer Satyanarayana