Hello, 2 identical servers (CentOS release 5 (Final) running FreeRADIUS Version 1.1.3 with MySQL (Ver 14.12 Distrib 5.0.22) MySQL on both - master and slave to each other 2 NASes authenticate and do accounting to either FreeRadius server. checkrad is used to handle Simultaneous Logins How can I set up to check Simultaneous Logins against of both NASes? For example, a user goes through NAS1, freeradius server checks only that NAS1 if the user is connected. How can I make it to check against of both NASes? Thank you for your help in advance. Irina
Irina wrote:
How can I set up to check Simultaneous Logins against of both NASes?
Take a closer look at the default sql.conf and the "session" section towards the bottom of radiusd.conf. You will also need an entry in users or radcheck to actually check it. See the docs dir in the tarball. -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com
Hello Dennis, Thank you for your reply. Checked in radiusd.conf, in "session" section I do use sql for Simultaneous. Checked in sql.conf, there are 2 queries for Simultaneous: "simul_count_query" and "simul_verify_query". Are they both needed to get Simultaneous working? A question would be more about "simul_verify_query". Is it used for Simultaneous as well? If only "simul_count_query" is used for Simultaneous, it does check by UserName. I therefore don't need to change anything in here, do I? Simultaneous with MySQL is working, I think. My question was if a user connects through NAS1, then authentication goes through radius server, radius sees the user is connected (AcctStopTime = 0), it then uses "checkrad" to check against NAS1 if the user is actually still connected. The problem is we have 2 NASes. How can I check if a user is connected (or not connected) on NAS1 and NAS2? Sorry if I confused you with my English (I wish it was better :-)) Kindest Regards, Irina Kalachnikova Systems Programmer NetAccess Systems Inc. irina@nas.net ===========================
Irina wrote:
How can I set up to check Simultaneous Logins against of both NASes?
Take a closer look at the default sql.conf and the "session" section towards the bottom of radiusd.conf. You will also need an entry in users or radcheck to actually check it. See the docs dir in the tarball.
-- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com
Checked in sql.conf, there are 2 queries for Simultaneous: "simul_count_query" and "simul_verify_query". Are they both needed to get Simultaneous working?
No. If you set your nastype to "other" in clents.conf verify query won't be used.
A question would be more about "simul_verify_query". Is it used for Simultaneous as well?
Yes, if you specify nastype other than "other" (oh, dear; I am sure this can be put better). Then that query will get parameters for checkrad to query NAS about the existance of that session.
I therefore don't need to change anything in here, do I?
No, you don't. It will all work fine with two clents as well.
The problem is we have 2 NASes. How can I check if a user is connected (or not connected) on NAS1 and NAS2?
simul_count_query will get all open sessions. simul_verify_query will get to what NAS and port those sessions are bound to. checkrad will then query appropriate NAS for each session to check if it is still open. It will all work fine - as long as checkrad script works for you. There might be trouble with Cisco clients as the OID in checkrad is a bit dated. Ivan Kalik Kalik Informatika ISP
Thanks so much. It makes a perfect sense. I now understand that the NAS (that the user has been connected on) will be pulled out of MySQL with simul_verify_query and checked against of that NAS, not the one that a user is trying to connect through.
There might be trouble with Cisco clients as the OID in checkrad is a bit dated. Can you explain a little more. We do have 2 Cisco. Checkrad itself works fine, I can see it in checkrad.log
Thank you again. Irina ============ ----- Original Message ----- From: <tnt@kalik.co.yu> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Tuesday, June 12, 2007 5:21 PM Subject: Re: To check Simultaneous against 2 NASes
Checked in sql.conf, there are 2 queries for Simultaneous: "simul_count_query" and "simul_verify_query". Are they both needed to get Simultaneous working?
No. If you set your nastype to "other" in clents.conf verify query won't be used.
A question would be more about "simul_verify_query". Is it used for Simultaneous as well?
Yes, if you specify nastype other than "other" (oh, dear; I am sure this can be put better). Then that query will get parameters for checkrad to query NAS about the existance of that session.
I therefore don't need to change anything in here, do I?
No, you don't. It will all work fine with two clents as well.
The problem is we have 2 NASes. How can I check if a user is connected (or not connected) on NAS1 and NAS2?
simul_count_query will get all open sessions. simul_verify_query will get to what NAS and port those sessions are bound to. checkrad will then query appropriate NAS for each session to check if it is still open.
It will all work fine - as long as checkrad script works for you. There might be trouble with Cisco clients as the OID in checkrad is a bit dated.
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
There are reports on the list that on odd occasion Simultaneous-Use dosn't work with Cisco NAS. Turns out that sometimes OID in checkrad needs to be changed. But if it works ... Ivan Kalik Kalik Informatika ISP Dana 12/6/2007, "Irina" <irina@nas.net> piše:
Thanks so much. It makes a perfect sense. I now understand that the NAS (that the user has been connected on) will be pulled out of MySQL with simul_verify_query and checked against of that NAS, not the one that a user is trying to connect through.
There might be trouble with Cisco clients as the OID in checkrad is a bit dated. Can you explain a little more. We do have 2 Cisco. Checkrad itself works fine, I can see it in checkrad.log
Thank you again. Irina ============
----- Original Message ----- From: <tnt@kalik.co.yu> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Tuesday, June 12, 2007 5:21 PM Subject: Re: To check Simultaneous against 2 NASes
Checked in sql.conf, there are 2 queries for Simultaneous: "simul_count_query" and "simul_verify_query". Are they both needed to get Simultaneous working?
No. If you set your nastype to "other" in clents.conf verify query won't be used.
A question would be more about "simul_verify_query". Is it used for Simultaneous as well?
Yes, if you specify nastype other than "other" (oh, dear; I am sure this can be put better). Then that query will get parameters for checkrad to query NAS about the existance of that session.
I therefore don't need to change anything in here, do I?
No, you don't. It will all work fine with two clents as well.
The problem is we have 2 NASes. How can I check if a user is connected (or not connected) on NAS1 and NAS2?
simul_count_query will get all open sessions. simul_verify_query will get to what NAS and port those sessions are bound to. checkrad will then query appropriate NAS for each session to check if it is still open.
It will all work fine - as long as checkrad script works for you. There might be trouble with Cisco clients as the OID in checkrad is a bit dated.
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Dennis Skinner -
Irina -
tnt＠kalik.co.yu