issue with reject function while handling interim-update accounting
Hello all, I am facing an issue in the accounting section. I do work on freeradius accounting to handle START, STOP and INTERIM-UPDATE requests. So in an interim-update request I am getting every 1 minute. In that request i am checking user balance if user balance is not sufficient then i am using reject function to send reject request to client. but when I do use the reject function then this function directly rejects the interim-update request without sending access-reject to the client. File : sites-available/default Here's my code : ######################################################### accounting { if(Acct-Status-Type == "Interim-Update"){ if ("%{user_balance}" == 0) { reject } } } ######################################################### Please suggest to me how I can send access-reject messages to client-server. Thanks & Regards Vinayak -- *Disclaimer* In addition to generic Disclaimer which you have agreed on our website, any views or opinions presented in this email are solely those of the originator and do not necessarily represent those of the Company or its sister concerns. Any liability (in negligence, contract or otherwise) arising from any third party taking any action, or refraining from taking any action on the basis of any of the information contained in this email is hereby excluded. *Confidentiality* This communication (including any attachment/s) is intended only for the use of the addressee(s) and contains information that is PRIVILEGED AND CONFIDENTIAL. Unauthorized reading, dissemination, distribution, or copying of this communication is prohibited. Please inform originator if you have received it in error. *Caution for viruses, malware etc.* This communication, including any attachments, may not be free of viruses, trojans, similar or new contaminants/malware, interceptions or interference, and may not be compatible with your systems. You shall carry out virus/malware scanning on your own before opening any attachment to this e-mail. The sender of this e-mail and Company including its sister concerns shall not be liable for any damage that may incur to you as a result of viruses, incompleteness of this message, a delay in receipt of this message or any other computer problems.
On 06/12/2023 11:36, Vinayak Makwana via Freeradius-Users wrote:> I am facing an issue in the accounting section. I do work on
freeradius accounting to handle START, STOP and INTERIM-UPDATE requests. So in an interim-update request I am getting every 1 minute.
That is very frequent. Every 15-30 minutes is more usual. You run the risk of overloading your database.
In that request i am checking user balance if user balance is not sufficient then i am using reject function to send reject request to client. but when I do use the reject function then this function directly rejects the interim-update request without sending access-reject to the client.
You can only reject an authentication request, you can't reject in accounting. The way to do this is to send a CoA disconnect request to your NAS to kick the session, if it's supported. If not you will need to either use some other method to terminate the session, or use shorter session lengths and then refuse on next authentication. See raddb/sites-available/originate-coa -- Matthew
As with all RADIUS things look at the BNG / BRAS / AP / AP-controller / etc (whatever the device is managing the session). Some have ‘quota’ systems that allow a slightly nicer way of handling usage limits. Mostly they do this by sending a new authentication request when a quota expires along with enough information to indicate which quota ran out (But not actually stopping the session until you reject the ‘quota expired’ - auth). If not, you must play the short session game or hope that CoA’s work. Both achieve the desired outcome but not necessarily in the nicest way For example: CoA is particularly bad with DHCP based clients given there is nothing that a standard client does that will detect the session stopped until the lease expires; Short duration sessions are bad with dynamic IP’s regardless of the type of session being managed because it might change every time a new auth is accepted breaking established user connections. From: Freeradius-Users <freeradius-users-bounces+alister.winfield=sky.uk@lists.freeradius.org> on behalf of Matthew Newton via Freeradius-Users <freeradius-users@lists.freeradius.org> Date: Wednesday, 6 December 2023 at 12:00 To: freeradius-users@lists.freeradius.org <freeradius-users@lists.freeradius.org> Cc: Matthew Newton <mcn@freeradius.org> Subject: [EXTERNAL] Re: issue with reject function while handling interim-update accounting On 06/12/2023 11:36, Vinayak Makwana via Freeradius-Users wrote:> I am facing an issue in the accounting section. I do work on
freeradius accounting to handle START, STOP and INTERIM-UPDATE requests. So in an interim-update request I am getting every 1 minute.
That is very frequent. Every 15-30 minutes is more usual. You run the risk of overloading your database.
In that request i am checking user balance if user balance is not sufficient then i am using reject function to send reject request to client. but when I do use the reject function then this function directly rejects the interim-update request without sending access-reject to the client.
You can only reject an authentication request, you can't reject in accounting. The way to do this is to send a CoA disconnect request to your NAS to kick the session, if it's supported. If not you will need to either use some other method to terminate the session, or use shorter session lengths and then refuse on next authentication. See raddb/sites-available/originate-coa -- Matthew - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -------------------------------------------------------------------- This email is from an external source. Please do not open attachments or click links from an unknown or suspicious origin. Phishing attempts can be reported by using the report message button in Outlook or sending them as an attachment to phishing@sky.uk. Thank you -------------------------------------------------------------------- Information in this email including any attachments may be privileged, confidential and is intended exclusively for the addressee. The views expressed may not be official policy, but the personal views of the originator. If you have received it in error, please notify the sender by return e-mail and delete it from your system. You should not reproduce, distribute, store, retransmit, use or disclose its contents to anyone. Please note we reserve the right to monitor all e-mail communication through our internal and external networks. SKY and the SKY marks are trademarks of Sky Limited and Sky International AG and are used under licence. Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Registration No. 2067075), Sky Subscribers Services Limited (Registration No. 2340150) and Sky CP Limited (Registration No. 9513259) are direct or indirect subsidiaries of Sky Limited (Registration No. 2247735). All of the companies mentioned in this paragraph are incorporated in England and Wales and share the same registered office at Grant Way, Isleworth, Middlesex TW7 5QD
Re : issue with reject function while handling interim-update accounting Thanks for sharing. I am not much aware about COA configuration. Is there any way to send a reply-message like "Insufficient balance" to a client in an account-accept request? Thanks On Wed, Dec 6, 2023 at 6:21 PM Winfield, Alister (Senior Solutions Architect) via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
As with all RADIUS things look at the BNG / BRAS / AP / AP-controller / etc (whatever the device is managing the session). Some have ‘quota’ systems that allow a slightly nicer way of handling usage limits. Mostly they do this by sending a new authentication request when a quota expires along with enough information to indicate which quota ran out (But not actually stopping the session until you reject the ‘quota expired’ - auth).
If not, you must play the short session game or hope that CoA’s work. Both achieve the desired outcome but not necessarily in the nicest way For example: CoA is particularly bad with DHCP based clients given there is nothing that a standard client does that will detect the session stopped until the lease expires; Short duration sessions are bad with dynamic IP’s regardless of the type of session being managed because it might change every time a new auth is accepted breaking established user connections.
From: Freeradius-Users <freeradius-users-bounces+alister.winfield= sky.uk@lists.freeradius.org> on behalf of Matthew Newton via Freeradius-Users <freeradius-users@lists.freeradius.org> Date: Wednesday, 6 December 2023 at 12:00 To: freeradius-users@lists.freeradius.org < freeradius-users@lists.freeradius.org> Cc: Matthew Newton <mcn@freeradius.org> Subject: [EXTERNAL] Re: issue with reject function while handling interim-update accounting
On 06/12/2023 11:36, Vinayak Makwana via Freeradius-Users wrote:> I am facing an issue in the accounting section. I do work on
freeradius accounting to handle START, STOP and INTERIM-UPDATE requests. So in an interim-update request I am getting every 1 minute.
That is very frequent. Every 15-30 minutes is more usual. You run the risk of overloading your database.
In that request i am checking user balance if user balance is not sufficient then i am using reject function to send reject request to client. but when I do use the reject function then this function directly rejects the interim-update request without sending access-reject to the client.
You can only reject an authentication request, you can't reject in accounting.
The way to do this is to send a CoA disconnect request to your NAS to kick the session, if it's supported. If not you will need to either use some other method to terminate the session, or use shorter session lengths and then refuse on next authentication.
See raddb/sites-available/originate-coa
-- Matthew - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -------------------------------------------------------------------- This email is from an external source. Please do not open attachments or click links from an unknown or suspicious origin. Phishing attempts can be reported by using the report message button in Outlook or sending them as an attachment to phishing@sky.uk. Thank you -------------------------------------------------------------------- Information in this email including any attachments may be privileged, confidential and is intended exclusively for the addressee. The views expressed may not be official policy, but the personal views of the originator. If you have received it in error, please notify the sender by return e-mail and delete it from your system. You should not reproduce, distribute, store, retransmit, use or disclose its contents to anyone. Please note we reserve the right to monitor all e-mail communication through our internal and external networks. SKY and the SKY marks are trademarks of Sky Limited and Sky International AG and are used under licence.
Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Registration No. 2067075), Sky Subscribers Services Limited (Registration No. 2340150) and Sky CP Limited (Registration No. 9513259) are direct or indirect subsidiaries of Sky Limited (Registration No. 2247735). All of the companies mentioned in this paragraph are incorporated in England and Wales and share the same registered office at Grant Way, Isleworth, Middlesex TW7 5QD - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Regards, *Vinayak Makwana* [image: Ecosmob Technologies Pvt. Ltd.] <https://www.ecosmob.com/> Ecosmob Technologies Pvt. Ltd. https://www.ecosmob.com VoIP | Web | Mobile | DevOps | QA | L1/ L2/ L3 Support -- *Disclaimer* In addition to generic Disclaimer which you have agreed on our website, any views or opinions presented in this email are solely those of the originator and do not necessarily represent those of the Company or its sister concerns. Any liability (in negligence, contract or otherwise) arising from any third party taking any action, or refraining from taking any action on the basis of any of the information contained in this email is hereby excluded. *Confidentiality* This communication (including any attachment/s) is intended only for the use of the addressee(s) and contains information that is PRIVILEGED AND CONFIDENTIAL. Unauthorized reading, dissemination, distribution, or copying of this communication is prohibited. Please inform originator if you have received it in error. *Caution for viruses, malware etc.* This communication, including any attachments, may not be free of viruses, trojans, similar or new contaminants/malware, interceptions or interference, and may not be compatible with your systems. You shall carry out virus/malware scanning on your own before opening any attachment to this e-mail. The sender of this e-mail and Company including its sister concerns shall not be liable for any damage that may incur to you as a result of viruses, incompleteness of this message, a delay in receipt of this message or any other computer problems.
No accounting messages are just data the reply just informs the sending device that you have received the message so it can stop retrying. A. From: Freeradius-Users <freeradius-users-bounces+alister.winfield=sky.uk@lists.freeradius.org> on behalf of Vinayak Makwana via Freeradius-Users <freeradius-users@lists.freeradius.org> Date: Wednesday, 6 December 2023 at 13:36 To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Cc: Vinayak Makwana <vinayak.makwana@ecosmob.com> Subject: Re: [EXTERNAL] Re: issue with reject function while handling interim-update accounting Re : issue with reject function while handling interim-update accounting Thanks for sharing. I am not much aware about COA configuration. Is there any way to send a reply-message like "Insufficient balance" to a client in an account-accept request? Thanks On Wed, Dec 6, 2023 at 6:21 PM Winfield, Alister (Senior Solutions Architect) via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
As with all RADIUS things look at the BNG / BRAS / AP / AP-controller / etc (whatever the device is managing the session). Some have ‘quota’ systems that allow a slightly nicer way of handling usage limits. Mostly they do this by sending a new authentication request when a quota expires along with enough information to indicate which quota ran out (But not actually stopping the session until you reject the ‘quota expired’ - auth).
If not, you must play the short session game or hope that CoA’s work. Both achieve the desired outcome but not necessarily in the nicest way For example: CoA is particularly bad with DHCP based clients given there is nothing that a standard client does that will detect the session stopped until the lease expires; Short duration sessions are bad with dynamic IP’s regardless of the type of session being managed because it might change every time a new auth is accepted breaking established user connections.
From: Freeradius-Users <freeradius-users-bounces+alister.winfield= sky.uk@lists.freeradius.org> on behalf of Matthew Newton via Freeradius-Users <freeradius-users@lists.freeradius.org> Date: Wednesday, 6 December 2023 at 12:00 To: freeradius-users@lists.freeradius.org < freeradius-users@lists.freeradius.org> Cc: Matthew Newton <mcn@freeradius.org> Subject: [EXTERNAL] Re: issue with reject function while handling interim-update accounting
On 06/12/2023 11:36, Vinayak Makwana via Freeradius-Users wrote:> I am facing an issue in the accounting section. I do work on
freeradius accounting to handle START, STOP and INTERIM-UPDATE requests. So in an interim-update request I am getting every 1 minute.
That is very frequent. Every 15-30 minutes is more usual. You run the risk of overloading your database.
In that request i am checking user balance if user balance is not sufficient then i am using reject function to send reject request to client. but when I do use the reject function then this function directly rejects the interim-update request without sending access-reject to the client.
You can only reject an authentication request, you can't reject in accounting.
The way to do this is to send a CoA disconnect request to your NAS to kick the session, if it's supported. If not you will need to either use some other method to terminate the session, or use shorter session lengths and then refuse on next authentication.
See raddb/sites-available/originate-coa
-- Matthew - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -------------------------------------------------------------------- This email is from an external source. Please do not open attachments or click links from an unknown or suspicious origin. Phishing attempts can be reported by using the report message button in Outlook or sending them as an attachment to phishing@sky.uk. Thank you -------------------------------------------------------------------- Information in this email including any attachments may be privileged, confidential and is intended exclusively for the addressee. The views expressed may not be official policy, but the personal views of the originator. If you have received it in error, please notify the sender by return e-mail and delete it from your system. You should not reproduce, distribute, store, retransmit, use or disclose its contents to anyone. Please note we reserve the right to monitor all e-mail communication through our internal and external networks. SKY and the SKY marks are trademarks of Sky Limited and Sky International AG and are used under licence.
Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Registration No. 2067075), Sky Subscribers Services Limited (Registration No. 2340150) and Sky CP Limited (Registration No. 9513259) are direct or indirect subsidiaries of Sky Limited (Registration No. 2247735). All of the companies mentioned in this paragraph are incorporated in England and Wales and share the same registered office at Grant Way, Isleworth, Middlesex TW7 5QD - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Regards, *Vinayak Makwana* [image: Ecosmob Technologies Pvt. Ltd.] <https://www.ecosmob.com/> Ecosmob Technologies Pvt. Ltd. https://www.ecosmob.com VoIP | Web | Mobile | DevOps | QA | L1/ L2/ L3 Support -- *Disclaimer* In addition to generic Disclaimer which you have agreed on our website, any views or opinions presented in this email are solely those of the originator and do not necessarily represent those of the Company or its sister concerns. Any liability (in negligence, contract or otherwise) arising from any third party taking any action, or refraining from taking any action on the basis of any of the information contained in this email is hereby excluded. *Confidentiality* This communication (including any attachment/s) is intended only for the use of the addressee(s) and contains information that is PRIVILEGED AND CONFIDENTIAL. Unauthorized reading, dissemination, distribution, or copying of this communication is prohibited. Please inform originator if you have received it in error. *Caution for viruses, malware etc.* This communication, including any attachments, may not be free of viruses, trojans, similar or new contaminants/malware, interceptions or interference, and may not be compatible with your systems. You shall carry out virus/malware scanning on your own before opening any attachment to this e-mail. The sender of this e-mail and Company including its sister concerns shall not be liable for any damage that may incur to you as a result of viruses, incompleteness of this message, a delay in receipt of this message or any other computer problems. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Information in this email including any attachments may be privileged, confidential and is intended exclusively for the addressee. The views expressed may not be official policy, but the personal views of the originator. If you have received it in error, please notify the sender by return e-mail and delete it from your system. You should not reproduce, distribute, store, retransmit, use or disclose its contents to anyone. Please note we reserve the right to monitor all e-mail communication through our internal and external networks. SKY and the SKY marks are trademarks of Sky Limited and Sky International AG and are used under licence. Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Registration No. 2067075), Sky Subscribers Services Limited (Registration No. 2340150) and Sky CP Limited (Registration No. 9513259) are direct or indirect subsidiaries of Sky Limited (Registration No. 2247735). All of the companies mentioned in this paragraph are incorporated in England and Wales and share the same registered office at Grant Way, Isleworth, Middlesex TW7 5QD
participants (3)
-
Matthew Newton -
Vinayak Makwana -
Winfield, Alister (Senior Solutions Architect)