Hi all, somewhere in this list there was already mentioned that current CVS version causes segmentation fault when received HUP signal(kill -HUP pid) - depending on the configuration it may survive 1st HUP and then it dies with 1st radius request/2nd HUP). Reason is also known: wrong freeing of memory. I've looked into the code for some time but I got lost in debugging of internal freeradius data structures. Until Alan comes with clean solution I'm offering following workaround: Here is a patch which just comments out freeing of config memory: Index: src/main/mainconfig.c =================================================================== RCS file: /source/radiusd/src/main/mainconfig.c,v retrieving revision 1.106 diff -u -r1.106 mainconfig.c --- src/main/mainconfig.c 7 Apr 2007 14:25:12 -0000 1.106 +++ src/main/mainconfig.c 11 Apr 2007 12:44:08 -0000 @@ -804,9 +804,9 @@ * Note that where possible, we do atomic switch-overs, * to ensure that the pointers are always valid. */ - oldcs = mainconfig.config; + //oldcs = mainconfig.config; mainconfig.config = cs; - cf_section_free(&oldcs); + //cf_section_free(&oldcs); snprintf(buffer, sizeof(buffer), "%.200s/%.50s", radius_dir, mainconfig.radiusd_conf); @@ -942,7 +942,7 @@ * Clean up the configuration data * structures. */ - cf_section_free(&mainconfig.config); +// cf_section_free(&mainconfig.config); free(mainconfig.radiusd_conf); realms_free(); listen_free(&mainconfig.listen); Of course it leads to memory leakage! With default configuration it will eat around 60k of memory per thread on each reload. With my configuration(rlm_sql, 65 NASes in database, some additional modules loaded) it eats something like 600k per thread/reload. Advantages: - HUP does not cause seqmentation fault. - /etc/init.d/freeradius reload is working(uses HUP) - reload using snmp is working(radiusAuthServConfigReset.0 = 2) Disadvantages: - serious memory leakage - you should definitely schedule freeradius restart(daily?, off-peak) in crontab in order to "free" unused memory - when using rlm_sql(as in my case) with this patch then please note that there will be unused open DB connections left after each reHUP ==> to get rid of these connections consider changing your DB configuration(eg. set "wait_timeout = 600" under [mysqld] section of my.cnf for mysql server; this causes to close unused connections older than 10 minutes) Hope this helps someone. PS: I hope freeing unused memory will be revisited and thus this workaround won't be needed anymore. Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------
Milan Holub wrote:
somewhere in this list there was already mentioned that current CVS version causes segmentation fault when received HUP signal(kill -HUP pid) - depending on the configuration it may survive 1st HUP and then it dies with 1st radius request/2nd HUP).
To back up a bit, *why* are you HUPing the server? Maybe we can add features that prevent the need for the HUP, and then remove support for HUP. That would be best, I think. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
On 4/11/07, Alan DeKok <aland@deployingradius.com> wrote:
To back up a bit, *why* are you HUPing the server?
I usually HUP servers to force them to re-read their configuration without forcing the server to restart. I'm glad I found the earlier commentary that HUPping radiusd is considered harmful. I did it myself when I was writing my first config last month, and ran across the segfault, too.
Maybe we can add features that prevent the need for the HUP, and then remove support for HUP. That would be best, I think.
Do you have in mind a favorite technique for signaling daemons that the config files have changed? HUP is a common way to do it, but I'm sure there are other ways. -ethan
Ethan Dicks wrote:
On 4/11/07, Alan DeKok <aland@deployingradius.com> wrote:
To back up a bit, *why* are you HUPing the server?
I usually HUP servers to force them to re-read their configuration without forcing the server to restart.
Well, yes. But *what* are you changing? Clients? Realms? Comments?
Do you have in mind a favorite technique for signaling daemons that the config files have changed? HUP is a common way to do it, but I'm sure there are other ways.
A command-line tool that uses some other method to update the server configuration. It means that the server gets told "X has changed", or "delete client Y", which is hugely less intrusive than a HUP. HUPs are like kicking the server in the head, and then expecting it to be nice to you. It can be done, but it takes work. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
Hi Alan, On Wed, Apr 11, 2007 at 04:02:15PM +0200, Alan DeKok wrote:
Do you have in mind a favorite technique for signaling daemons that the config files have changed? HUP is a common way to do it, but I'm sure there are other ways.
A command-line tool that uses some other method to update the server configuration. It means that the server gets told "X has changed", or "delete client Y", which is hugely less intrusive than a HUP.
HUPs are like kicking the server in the head, and then expecting it to be nice to you. It can be done, but it takes work.
==> I've found really useful the idea of telling freeradius to reload via snmp - could be such functionality easily kept when using your proposed approach?
Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------
Milan Holub wrote:
==> I've found really useful the idea of telling freeradius to reload via snmp - could be such functionality easily kept when using your proposed approach?
Reloading via SNMP is exactly the same as HUP. Configuring a server by doing SNMP writes is very hard. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
Dear all, We has the problem regarding the above subject... mysql> select * from radgroupcheck; +----+-----------+------------------+----+-------+ | id | GroupName | Attribute | op | Value | +----+-----------+------------------+----+-------+ | 1 | POSTPAID | Simultaneous-Use | == | 1 | | 2 | PREPAID | Simultaneous-Use | == | 1 | +----+-----------+------------------+----+-------+ 2 rows in set (0.01 sec) mysql> select * from usergroup; +----------+-----------+----------+ | UserName | GroupName | priority | +----------+-----------+----------+ | thomas | POSPAID | 1 | | christie | POSPAID | 1 | +----------+-----------+----------+ 2 rows in set (0.01 sec) and at sql.conf.. .. # Uncomment simul_count_query to enable simultaneous use checking # simul_counT_query = "SELECT COUNT(*) FROM ${acct_table1} WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" simul_count_query = "SELECT COUNT(*) FROM ${acct_table1} WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingSta tionId, FramedProtocol FROM ${acct_table1} WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" .. But.. the same user id still able to login at the same time on different terminal / pc I already try to change the op on radcheck from '==' become ':=' or '=' but the same problem still persist What could be wrong ? TIA PD
Hi, On Thu, Apr 12, 2007 at 07:14:48AM +0000, PD wrote:
Dear all,
We has the problem regarding the above subject... mysql> select * from radgroupcheck; +----+-----------+------------------+----+-------+ | id | GroupName | Attribute | op | Value | +----+-----------+------------------+----+-------+ | 1 | POSTPAID | Simultaneous-Use | == | 1 | | 2 | PREPAID | Simultaneous-Use | == | 1 | +----+-----------+------------------+----+-------+ 2 rows in set (0.01 sec) mysql> select * from usergroup; +----------+-----------+----------+ | UserName | GroupName | priority | +----------+-----------+----------+ | thomas | POSPAID | 1 | | christie | POSPAID | 1 | +----------+-----------+----------+ 2 rows in set (0.01 sec)
==> I believe you have a typo in the tables: radgroupcheck: groupname=POSTPAID usergroup: groupname=POSPAID which means that the Simultaneous-Use check is not performed because the user does not match the requested group...
and at sql.conf.. .. # Uncomment simul_count_query to enable simultaneous use checking # simul_counT_query = "SELECT COUNT(*) FROM ${acct_table1} WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" simul_count_query = "SELECT COUNT(*) FROM ${acct_table1} WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingSta tionId, FramedProtocol FROM ${acct_table1} WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" ..
But.. the same user id still able to login at the same time on different terminal / pc
I already try to change the op on radcheck from '==' become ':=' or '=' but the same problem still persist
What could be wrong ?
TIA
PD
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------
On 4/12/2007, "Milan Holub" <holub@thenet.ch> wrote:
Hi,
On Thu, Apr 12, 2007 at 07:14:48AM +0000, PD wrote:
Dear all,
We has the problem regarding the above subject... mysql> select * from radgroupcheck; +----+-----------+------------------+----+-------+ | id | GroupName | Attribute | op | Value | +----+-----------+------------------+----+-------+ | 1 | POSTPAID | Simultaneous-Use | == | 1 | | 2 | PREPAID | Simultaneous-Use | == | 1 | +----+-----------+------------------+----+-------+ 2 rows in set (0.01 sec) mysql> select * from usergroup; +----------+-----------+----------+ | UserName | GroupName | priority | +----------+-----------+----------+ | thomas | POSPAID | 1 | | christie | POSPAID | 1 | +----------+-----------+----------+ 2 rows in set (0.01 sec)
==> I believe you have a typo in the tables: radgroupcheck: groupname=POSTPAID usergroup: groupname=POSPAID
which means that the Simultaneous-Use check is not performed because the user does not match the requested group...
Arrghh... yeah.. I did not reliaze this... thank you for your correction. We will try it again.. TIA PD
On 4/12/2007, "Milan Holub" <holub@thenet.ch> wrote: .cut...
==> I believe you have a typo in the tables: radgroupcheck: groupname=POSTPAID usergroup: groupname=POSPAID
I still have another problem... many of radacct table records are incompleted. We know the user already disconnected (even by click logout botton or just shut his/her computer down), but the information did not saved. At Radacct table, many previous records with the same mac address and user name still get connected. Questions.. + what cause of this problem ? + how to delete this entry daily (perhaps with crontab) TIA PD
On Thu, Apr 12, 2007 at 07:42:16AM +0000, PD wrote:
I still have another problem... many of radacct table records are incompleted. We know the user already disconnected (even by click logout botton or just shut his/her computer down), but the information did not saved.
At Radacct table, many previous records with the same mac address and user name still get connected.
Questions.. + what cause of this problem ? + how to delete this entry daily (perhaps with crontab)
==> is Accounting-STOP reaching your radius? you can find out by running in debug mode: freeradius -X ==> is the correct query run on your database? check accounting_ queries in your sql/mysql-dialup.conf * check your DB log files: eg. with mysql: tail -f /var/log/mysql/mysql.log * try to run the query manually - does it update the radact table?
TIA
PD
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------
On 4/12/2007, "Milan Holub" <holub@thenet.ch> wrote:
==> is Accounting-STOP reaching your radius? you can find out by running in debug mode: freeradius -X
==> is the correct query run on your database? check accounting_ queries in your sql/mysql-dialup.conf * check your DB log files: eg. with mysql: tail -f /var/log/mysql/mysql.log * try to run the query manually - does it update the radact table?
Dear Milan, I am sure both of the above items are correct since the problem only persist sometime... once or two times a day. I can see both start and stop record on radacct table and or radius.log when I log in and log out or just shut the computer down without logout. TIA PD
Dana 12/4/2007, "PD" <paul@ranahminang.net> piše: >snip + what cause of this problem ? >snip Either NAS thinks that users are still connected or your RADIUS server is not receiving Stop packages. If NAS (NAS not radacct table) shows users as connected you can add Idle-Timeout of about 5 minutes in user (or group) configuration. If RADIUS packets are not being received have a look at your network. NAS needs reliable connection to RADIUS server - you shouldn't have firewalls and such in the way. >snip + how to delete this entry daily (perhaps with crontab) >snip Don't do that. Fix your server communication and then delete stale entries once. Ivan Kalik Kalik Informatika ISP
On 4/12/2007, "tnt@kalik.co.yu" <tnt@kalik.co.yu> wrote:
+ what cause of this problem ? Either NAS thinks that users are still connected or your RADIUS server is not receiving Stop packages. If NAS (NAS not radacct table) shows users as connected you can add Idle-Timeout of about 5 minutes in user (or group) configuration. If RADIUS packets are not being received have a look at your network. NAS needs reliable connection to RADIUS server - you shouldn't have firewalls and such in the way.
Well... the problem only persist sometime.. let say once or two timeseveryday. The communication between Radius box and NAS using STP cable. Currently we are still on development stage of hotspot system. Before implement them on big area, we found some problem, like explain above. When I log in and log out or shut the notebook down without logout, I can see both start and stop the record on radacct table, I could not find the problem sources.. perhaps someone else has face the same problem ?
+ how to delete this entry daily (perhaps with crontab) Don't do that. Fix your server communication and then delete stale entries once.
Well.. with simultaneous-use:=1, the same user will not be able login anymore because radius see that he / she still online. TIA PD
If you are happy with reliability then fix checkrad and it will clean these random drops. That is the utility that radiusd calls to check stale entries and in sql.conf you can enable deletion of such entries. Just make sure that such users are not listed as active by the hotspot. If NAS thinks they are still loged on, RADIUS can't do anything about it. Ivan Kalik Kalik Informatika ISP Dana 12/4/2007, "PD" <paul@ranahminang.net> piše:
On 4/12/2007, "tnt@kalik.co.yu" <tnt@kalik.co.yu> wrote:
+ what cause of this problem ? Either NAS thinks that users are still connected or your RADIUS server is not receiving Stop packages. If NAS (NAS not radacct table) shows users as connected you can add Idle-Timeout of about 5 minutes in user (or group) configuration. If RADIUS packets are not being received have a look at your network. NAS needs reliable connection to RADIUS server - you shouldn't have firewalls and such in the way.
Well... the problem only persist sometime.. let say once or two timeseveryday. The communication between Radius box and NAS using STP cable.
Currently we are still on development stage of hotspot system. Before implement them on big area, we found some problem, like explain above. When I log in and log out or shut the notebook down without logout, I can see both start and stop the record on radacct table,
I could not find the problem sources.. perhaps someone else has face the same problem ?
+ how to delete this entry daily (perhaps with crontab) Don't do that. Fix your server communication and then delete stale entries once.
Well.. with simultaneous-use:=1, the same user will not be able login anymore because radius see that he / she still online.
TIA
PD
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
checkrad work only for simultaneous detection not fix my stop time entry in sql it is possible to modify checkrad to fix sql stop time in radacct table ? tnt@kalik.co.yu wrote: If you are happy with reliability then fix checkrad and it will clean these random drops. That is the utility that radiusd calls to check stale entries and in sql.conf you can enable deletion of such entries. Just make sure that such users are not listed as active by the hotspot. If NAS thinks they are still loged on, RADIUS can't do anything about it. Ivan Kalik Kalik Informatika ISP Dana 12/4/2007, "PD" pi¹e:
On 4/12/2007, "tnt@kalik.co.yu" wrote:
+ what cause of this problem ? Either NAS thinks that users are still connected or your RADIUS server is not receiving Stop packages. If NAS (NAS not radacct table) shows users as connected you can add Idle-Timeout of about 5 minutes in user (or group) configuration. If RADIUS packets are not being received have a look at your network. NAS needs reliable connection to RADIUS server - you shouldn't have firewalls and such in the way.
Well... the problem only persist sometime.. let say once or two timeseveryday. The communication between Radius box and NAS using STP cable.
Currently we are still on development stage of hotspot system. Before implement them on big area, we found some problem, like explain above. When I log in and log out or shut the notebook down without logout, I can see both start and stop the record on radacct table,
I could not find the problem sources.. perhaps someone else has face the same problem ?
+ how to delete this entry daily (perhaps with crontab) Don't do that. Fix your server communication and then delete stale entries once.
Well.. with simultaneous-use:=1, the same user will not be able login anymore because radius see that he / she still online.
TIA
PD
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html $ cat ~/satish/url.txt System administrator ( Data Center ) please visit this site http://linux.tulipit.com --------------------------------- Check out what you're missing if you're not on Yahoo! Messenger
There is a line in (my)sql.conf: # Remove stale session if checkrad does not see a double login deletestalesessions = yes that enables it. I don't know if there is such an entry in mssql.conf. Ivan Kalik Kalik Informatika ISP Dana 12/4/2007, "satish patel" <linuxtrap@yahoo.co.in> piše:
checkrad work only for simultaneous detection not fix my stop time entry in sql
it is possible to modify checkrad to fix sql stop time in radacct table ?
tnt@kalik.co.yu wrote: If you are happy with reliability then fix checkrad and it will clean these random drops. That is the utility that radiusd calls to check stale entries and in sql.conf you can enable deletion of such entries. Just make sure that such users are not listed as active by the hotspot. If NAS thinks they are still loged on, RADIUS can't do anything about it.
Ivan Kalik Kalik Informatika ISP
Dana 12/4/2007, "PD" piše:
On 4/12/2007, "tnt@kalik.co.yu" wrote:
+ what cause of this problem ? Either NAS thinks that users are still connected or your RADIUS server is not receiving Stop packages. If NAS (NAS not radacct table) shows users as connected you can add Idle-Timeout of about 5 minutes in user (or group) configuration. If RADIUS packets are not being received have a look at your network. NAS needs reliable connection to RADIUS server - you shouldn't have firewalls and such in the way.
Well... the problem only persist sometime.. let say once or two timeseveryday. The communication between Radius box and NAS using STP cable.
Currently we are still on development stage of hotspot system. Before implement them on big area, we found some problem, like explain above. When I log in and log out or shut the notebook down without logout, I can see both start and stop the record on radacct table,
I could not find the problem sources.. perhaps someone else has face the same problem ?
+ how to delete this entry daily (perhaps with crontab) Don't do that. Fix your server communication and then delete stale entries once.
Well.. with simultaneous-use:=1, the same user will not be able login anymore because radius see that he / she still online.
TIA
PD
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
$ cat ~/satish/url.txt
System administrator ( Data Center )
please visit this site
--------------------------------- Check out what you're missing if you're not on Yahoo! Messenger
I have faceing same problem when some time NAS send ACCT-STOP packet and packet would be lost then user session would be open and next time whne user try to login he/she got error multilogin so that i have implement checkrad.pl script and check simultaneouse users through SNMP and it is working fine but i dont know why acct-stop packet lost I have one more query regarding idle-time out if i set idle-time out 5 min then user automaicaly disconnect if connection was idle but suppose NAS send acct-stop packet and packet will be lost then idle-time out work in this case PD <paul@ranahminang.net> wrote: On 4/12/2007, "tnt@kalik.co.yu" wrote:
+ what cause of this problem ? Either NAS thinks that users are still connected or your RADIUS server is not receiving Stop packages. If NAS (NAS not radacct table) shows users as connected you can add Idle-Timeout of about 5 minutes in user (or group) configuration. If RADIUS packets are not being received have a look at your network. NAS needs reliable connection to RADIUS server - you shouldn't have firewalls and such in the way.
Well... the problem only persist sometime.. let say once or two timeseveryday. The communication between Radius box and NAS using STP cable. Currently we are still on development stage of hotspot system. Before implement them on big area, we found some problem, like explain above. When I log in and log out or shut the notebook down without logout, I can see both start and stop the record on radacct table, I could not find the problem sources.. perhaps someone else has face the same problem ?
+ how to delete this entry daily (perhaps with crontab) Don't do that. Fix your server communication and then delete stale entries once.
Well.. with simultaneous-use:=1, the same user will not be able login anymore because radius see that he / she still online. TIA PD - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html $ cat ~/satish/url.txt System administrator ( Data Center ) please visit this site http://linux.tulipit.com --------------------------------- Check out what you're missing if you're not on Yahoo! Messenger
for a temp fix I would make your perl script ping said ip before checking for idle (perhaps a sleep timer) or you could simply have each supposed active ip pinged every 1 - 2 minutes by a seperate perl script. Would you mind posting your checkrad.pl script, Im a perl hacker myself :) On 4/12/07, satish patel <linuxtrap@yahoo.co.in> wrote:
I have faceing same problem when some time NAS send ACCT-STOP packet and packet would be lost then user session would be open and next time whne user try to login he/she got error multilogin so that i have implement checkrad.pl script and check simultaneouse users through SNMP and it is working fine but i dont know why acct-stop packet lost
I have one more query regarding idle-time out if i set idle-time out 5 min then user automaicaly disconnect if connection was idle but suppose NAS send acct-stop packet and packet will be lost then idle-time out work in this case
PD <paul@ranahminang.net> wrote: On 4/12/2007, "tnt@kalik.co.yu" wrote:
+ what cause of this problem ? Either NAS thinks that users are still connected or your RADIUS server is not receiving Stop packages. If NAS (NAS not radacct table) shows users as connected you can add Idle-Timeout of about 5 minutes in user (or group) configuration. If RADIUS packets are not being received have a look at your network. NAS needs reliable connection to RADIUS server - you shouldn't have firewalls and such in the way.
Well... the problem only persist sometime.. let say once or two timeseveryday. The communication between Radius box and NAS using STP cable.
Currently we are still on development stage of hotspot system. Before implement them on big area, we found some problem, like explain above. When I log in and log out or shut the notebook down without logout, I can see both start and stop the record on radacct table,
I could not find the problem sources.. perhaps someone else has face the same problem ?
+ how to delete this entry daily (perhaps with crontab) Don't do that. Fix your server communication and then delete stale entries once.
Well.. with simultaneous-use:=1, the same user will not be able login anymore because radius see that he / she still online.
TIA
PD
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
$ cat ~/satish/url.txt
System administrator ( Data Center )
please visit this site
________________________________ Check out what you're missing if you're not on Yahoo! Messenger - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
No. Idle-Timeout will work if NAS doesn't realize that user is not online any more. It doesn't help if stop packets are lost. Only checkrad or such routines that check user status with NAS will help there. Ivan Kalik Kalik Informatika ISP Dana 12/4/2007, "satish patel" <linuxtrap@yahoo.co.in> piše:
I have faceing same problem when some time NAS send ACCT-STOP packet and packet would be lost then user session would be open and next time whne user try to login he/she got error multilogin so that i have implement checkrad.pl script and check simultaneouse users through SNMP and it is working fine but i dont know why acct-stop packet lost
I have one more query regarding idle-time out if i set idle-time out 5 min then user automaicaly disconnect if connection was idle but suppose NAS send acct-stop packet and packet will be lost then idle-time out work in this case
PD <paul@ranahminang.net> wrote: On 4/12/2007, "tnt@kalik.co.yu" wrote:
+ what cause of this problem ? Either NAS thinks that users are still connected or your RADIUS server is not receiving Stop packages. If NAS (NAS not radacct table) shows users as connected you can add Idle-Timeout of about 5 minutes in user (or group) configuration. If RADIUS packets are not being received have a look at your network. NAS needs reliable connection to RADIUS server - you shouldn't have firewalls and such in the way.
Well... the problem only persist sometime.. let say once or two timeseveryday. The communication between Radius box and NAS using STP cable.
Currently we are still on development stage of hotspot system. Before implement them on big area, we found some problem, like explain above. When I log in and log out or shut the notebook down without logout, I can see both start and stop the record on radacct table,
I could not find the problem sources.. perhaps someone else has face the same problem ?
+ how to delete this entry daily (perhaps with crontab) Don't do that. Fix your server communication and then delete stale entries once.
Well.. with simultaneous-use:=1, the same user will not be able login anymore because radius see that he / she still online.
TIA
PD
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
$ cat ~/satish/url.txt
System administrator ( Data Center )
please visit this site
--------------------------------- Check out what you're missing if you're not on Yahoo! Messenger
Operator should be :=. Check first that you have sql checking enabled in radiusd.conf: # Session database, used for checking Simultaneous-Use. Either the radutmp # or rlm_sql module can handle this. # The rlm_sql module is *much* faster session { # radutmp # # See "Simultaneous Use Checking Querie" in sql.conf sql } Then set nastype in clients.conf to other. If it works after that, problem is most likely OID that checkrad uses. You will need to find the correct one for your NAS and alter it in checkrad. Then you can change other to cisco or whatever. Ivan Kalik Kalik Informatika ISP Dana 12/4/2007, "PD" <paul@ranahminang.net> piše:
Dear all,
We has the problem regarding the above subject... mysql> select * from radgroupcheck; +----+-----------+------------------+----+-------+ | id | GroupName | Attribute | op | Value | +----+-----------+------------------+----+-------+ | 1 | POSTPAID | Simultaneous-Use | == | 1 | | 2 | PREPAID | Simultaneous-Use | == | 1 | +----+-----------+------------------+----+-------+ 2 rows in set (0.01 sec) mysql> select * from usergroup; +----------+-----------+----------+ | UserName | GroupName | priority | +----------+-----------+----------+ | thomas | POSPAID | 1 | | christie | POSPAID | 1 | +----------+-----------+----------+ 2 rows in set (0.01 sec)
and at sql.conf.. ... # Uncomment simul_count_query to enable simultaneous use checking # simul_counT_query = "SELECT COUNT(*) FROM ${acct_table1} WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" simul_count_query = "SELECT COUNT(*) FROM ${acct_table1} WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingSta tionId, FramedProtocol FROM ${acct_table1} WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" ...
But.. the same user id still able to login at the same time on different terminal / pc
I already try to change the op on radcheck from '==' become ':=' or '=' but the same problem still persist
What could be wrong ?
TIA
PD
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Maybe we can add features that prevent the need for the HUP, and then remove support for HUP. That would be best, I think.
Do you have in mind a favorite technique for signaling daemons that the config files have changed? HUP is a common way to do it, but I'm sure there are other ways.
hi, I'm glad Milan Holub replied with a patch, thank you! Going back to the subject, a useful feature would be a periodical reload of certificate revocation lists and the users list. These two lists are prone to changing frequently in production environments: a production server usually has an otherwise stable configuration. I think nobody is willing to experiment on radiusd.conf during peak hours, on the other hand he will be busy adding/removing users or eventually certificate revocations if using EAP-TLS in the most advanced way. As for me, I was planning a CRL reload during off peak hours, so I guess I'll stick with just a full nighttime restart.
inverse wrote:
Going back to the subject, a useful feature would be a periodical reload of certificate revocation lists and the users list. These two lists are prone to changing frequently in production environments: a production server usually has an otherwise stable configuration.
That can be done with a fair amount of work.
As for me, I was planning a CRL reload during off peak hours, so I guess I'll stick with just a full nighttime restart.
For now, it's probably safest. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
Hi Alan, On Wed, Apr 11, 2007 at 03:45:18PM +0200, Alan DeKok wrote:
Milan Holub wrote:
somewhere in this list there was already mentioned that current CVS version causes segmentation fault when received HUP signal(kill -HUP pid) - depending on the configuration it may survive 1st HUP and then it dies with 1st radius request/2nd HUP).
To back up a bit, *why* are you HUPing the server?
==> main reason for HUP is for me when the configuration gets updated ==> yes it could be restarted as well but consider following: - we are keeping NAS entries in DB. - these entries are edited by operation guys via web interface - when a new NAS entry is added then we need to reload/restart freeradius - we reload freeradius using SNMP write query(can be done via web interface as well; without need of ssh to radius server) ==> using this approach simplifies "daily configuration" tasks on freeradius and I believe it's secure enough(snmp write allowed only from management machine) and elegant(as opposed to executing remote commands from within management server using ssh for example) In general when restarting the server you might loose some radius packets(especially on high loaded server), don't you? Thus I thing from this point of view HUP feature is useful and should be kept.
Maybe we can add features that prevent the need for the HUP, and then remove support for HUP. That would be best, I think.
==> what do you imagine under these "features"? Basically I thought HUP is good for reloading config files when one does not want to bring the server down but wants to bring into effect some minor config change. ==> is there any other use of HUP?
Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Please advise. Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------
Milan Holub wrote:
- we are keeping NAS entries in DB.
Then the server should re-load them via reading the DB.
- these entries are edited by operation guys via web interface - when a new NAS entry is added then we need to reload/restart freeradius - we reload freeradius using SNMP write query(can be done via web interface as well; without need of ssh to radius server)
If the server automatically discovers NAS changes from the DB, then the server doesn't need to be reloaded. i.e. You're changing *one* thing: a NAS. You're then telling the server to reload *everything*. That's where the expense and complexity comes in.
In general when restarting the server you might loose some radius packets(especially on high loaded server), don't you?
It's possible.
==> what do you imagine under these "features"? Basically I thought HUP is good for reloading config files when one does not want to bring the server down but wants to bring into effect some minor config change.
I am trying to say that there are OTHER ways to perform some minor config change than HUP. HUP should be the *last* resort.
==> is there any other use of HUP?
No. HUP is *only* to notify the server of configuration changes. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
O/H Alan DeKok έγραψε:
Milan Holub wrote:
- we are keeping NAS entries in DB.
Then the server should re-load them via reading the DB.
- these entries are edited by operation guys via web interface - when a new NAS entry is added then we need to reload/restart freeradius - we reload freeradius using SNMP write query(can be done via web interface as well; without need of ssh to radius server)
If the server automatically discovers NAS changes from the DB, then the server doesn't need to be reloaded.
i.e. You're changing *one* thing: a NAS. You're then telling the server to reload *everything*. That's where the expense and complexity comes in.
The problem is: You add one NAS. But you need to update the clients list. To do that you have to lock the clients list for write and make sure no one reads it. That means you have to stop accepting requests and wait for already present ones to finish. Afterwards you just have to start accepting requests again. The same more or less applies to changes on module configuration (CRLs for TLS, users for the files module). You have to reload the module and in the meantime make sure no one uses it (and the best way to do that is by stop accepting requests). This all sounds like the work done on a HUP so i don't see any major differences.
In general when restarting the server you might loose some radius packets(especially on high loaded server), don't you?
It's possible.
==> what do you imagine under these "features"? Basically I thought HUP is good for reloading config files when one does not want to bring the server down but wants to bring into effect some minor config change.
I am trying to say that there are OTHER ways to perform some minor config change than HUP. HUP should be the *last* resort.
==> is there any other use of HUP?
No. HUP is *only* to notify the server of configuration changes.
Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (9)
-
Alan DeKok -
Ethan Dicks -
inverse -
Jacob Jarick -
Kostas Kalevras -
Milan Holub -
PD -
satish patel -
tnt＠kalik.co.yu