Hey guys, Is it possible to set the expiration attribute to be of an offset type? Instead of entering an absolute date is it possible to enter the duration of which the user will be allowed from the first time that he logins? Say I set an offset of +30 days, and the user logins for the first time only 6 months from now. So once he login'ed once then the counter will start counting 30 days from his first login and then expire the account. Thanks.
liran tal wrote:
Is it possible to set the expiration attribute to be of an offset type?
No. Because something has to remember when the offset started.
Say I set an offset of +30 days, and the user logins for the first time only 6 months from now. So once he login'ed once then the counter will start counting 30 days from his first login and then expire the account.
Run a script on the first login that updates the DB with the proper expiration. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
Jan 23 10:32:46 radius freeradius[6262]: rlm_unix: [mjones]: invalid password Jan 23 10:32:46 radius freeradius[6262]: Login incorrect: [mjones/xxxxxx] (from client 192.8.137.103 port 0) Jan 23 10:32:46 radius freeradius[6260]: Login incorrect: [kjrumble/xxxxxx] (from client 192.8.136.106 port 0 cli ip:64.230.198.9:64.230.196.49:524c:393b:68f7:4f83:108974) Jan 23 10:32:47 radius freeradius[6261]: rlm_detail: Failed to aquire filelock for /usr/local/var/log/radius/radacct/detail-combined, giving up That is an exccert from our log this morning. Two users were denied access even though they supplied the correct username and password. This happens all the time exactly a few seconds prior to the filelock error. The file lock error is being generated because I use radrelay. I am running version 1.14. Any ideas on how I can fix this as denying users access is a big problem. Thanx in advance. Mark
Mark Jones wrote:
That is an exccert from our log this morning. Two users were denied access even though they supplied the correct username and password. This happens all the time exactly a few seconds prior to the filelock error. The file lock error is being generated because I use radrelay. I am running version 1.14.
The thing I don't understand is that the two messages are unrelated. The detail module isn't the unix module. Accounting is not authentication... If the messages appear close together a lot, that is suspicious. But I would think it's because of some *other* issue that's affecting both authentication & accounting, like the CPU load spiking on the machine. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
Here are more entries from yesterdays logs. i don't think its a quinsidensce Jan 23 08:26:45 radius freeradius[28054]: rlm_unix: [mjones]: invalid password Jan 23 08:26:45 radius freeradius[28054]: Login incorrect: [mjones/mjones] (from client 216.8.137.103 port 0) Jan 23 08:26:46 radius freeradius[28056]: rlm_detail: Failed to aquire filelock for /usr/local/var/log/radius/radacct/detail-combined, giving up -- Jan 23 09:49:46 radius freeradius[2289]: Login incorrect: [mjones/mjones] (from client 216.8.137.103 port 0) Jan 23 09:49:48 radius freeradius[2292]: rlm_detail: Failed to aquire filelock for /usr/local/var/log/radius/radacct/detail-combined, giving up -- Jan 23 10:32:46 radius freeradius[6262]: rlm_unix: [mjones]: invalid password Jan 23 10:32:46 radius freeradius[6262]: Login incorrect: [mjones/xxxxx] (from client 216.8.137.103 port 0) Jan 23 10:32:46 radius freeradius[6260]: Login incorrect: [kjrumble/xxxxxx] (from client 216.8.136.106 port 0 cli ip:64.230.198.9:64.230.196.49:524c:393b:68f7:4f83:108974) Jan 23 10:32:47 radius freeradius[6261]: rlm_detail: Failed to aquire filelock for /usr/local/var/log/radius/radacct/detail-combined, giving up -- Jan 23 14:10:47 radius freeradius[23198]: rlm_unix: [mjones]: invalid password Jan 23 14:10:47 radius freeradius[23198]: Login incorrect: [mjones/xxxxx] (from client 216.8.137.103 port 0) Jan 23 14:10:48 radius freeradius[23199]: rlm_detail: Failed to aquire filelock for /usr/local/var/log/radius/radacct/detail-combined, giving up -- Jan 23 14:42:47 radius freeradius[29576]: rlm_unix: [mjones]: invalid password Jan 23 14:42:47 radius freeradius[29576]: Login incorrect: [mjones/xxxxxx] (from client 216.8.137.103 port 0) Jan 23 14:42:49 radius freeradius[29577]: rlm_detail: Failed to aquire filelock for /usr/local/var/log/radius/radacct/detail-combined, giving up -- Jan 23 14:51:47 radius freeradius[29575]: Login incorrect: [mjones/xxxxxx] (from client 216.8.137.103 port 0) Jan 23 14:51:47 radius freeradius[29574]: rlm_detail: Failed to aquire filelock for /usr/local/var/log/radius/radacct/detail-combined, giving up -- Jan 23 23:09:49 radius freeradius[9667]: rlm_unix: [mjones]: invalid password Jan 23 23:09:49 radius freeradius[9667]: Login incorrect: [mjones/xxxxxx] (from client 216.8.137.103 port 0) Jan 23 23:09:49 radius freeradius[9666]: rlm_detail: Failed to aquire filelock for /usr/local/var/log/radius/radacct/detail-combined, giving up -- Jan 24 03:05:50 radius freeradius[9664]: rlm_unix: [mjones]: invalid password Jan 24 03:05:50 radius freeradius[9664]: Login incorrect: [mjones/xxxxxx] (from client 216.8.137.103 port 0) Jan 24 03:05:52 radius freeradius[9666]: rlm_detail: Failed to aquire filelock for /usr/local/var/log/radius/radacct/detail-combined, giving up -- Jan 24 04:48:51 radius freeradius[9664]: rlm_unix: [mjones]: invalid password Jan 24 04:48:51 radius freeradius[9664]: Login incorrect: [mjones/xxxxx] (from client 216.8.137.103 port 0) Jan 24 04:48:53 radius freeradius[9662]: rlm_detail: Failed to aquire filelock for /usr/local/var/log/radius/radacct/detail-combined, giving up ----- Original Message ----- From: "Alan DeKok" <aland@deployingradius.com> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Wednesday, January 24, 2007 2:35 AM Subject: Re: Small problem with authentication
Mark Jones wrote:
That is an exccert from our log this morning. Two users were denied access even though they supplied the correct username and password. This happens all the time exactly a few seconds prior to the filelock error. The file lock error is being generated because I use radrelay. I am running version 1.14.
The thing I don't understand is that the two messages are unrelated. The detail module isn't the unix module. Accounting is not authentication...
If the messages appear close together a lot, that is suspicious. But I would think it's because of some *other* issue that's affecting both authentication & accounting, like the CPU load spiking on the machine.
Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.5.432 / Virus Database: 268.17.8/648 - Release Date: 1/23/2007 11:04 AM
Mark Jones wrote:
Here are more entries from yesterdays logs. i don't think its a quinsidensce
Again, what ELSE is going on in the system? WHY is the detail module failing to acquire the file lock? Is the disk full? Is the CPU busy? Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
----- Original Message ----- From: "Alan DeKok" <aland@deployingradius.com> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Wednesday, January 24, 2007 10:08 AM Subject: Re: Small problem with authentication
Mark Jones wrote:
Here are more entries from yesterdays logs. i don't think its a quinsidensce
Again, what ELSE is going on in the system? This is a dedicated box to just radius. Load never exceeds 0.15 disk usage is less then 20 % on all volumes
WHY is the detail module failing to acquire the file lock? Is the disk full? Is the CPU busy?
I assume it is to do with radrelay.
Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.5.432 / Virus Database: 268.17.8/649 - Release Date: 1/23/2007 8:40 PM
Mark Jones wrote:
Again, what ELSE is going on in the system? This is a dedicated box to just radius. Load never exceeds 0.15 disk usage is less then 20 % on all volumes
OK...
WHY is the detail module failing to acquire the file lock? Is the disk full? Is the CPU busy?
I assume it is to do with radrelay.
That's just pointedly unhelpful. radrelay is the only other program locking the detail file, so it's not rocket science to come up with that statement. I'll say this: I've never seen the problem before. It MUST be something special on your system. I don't know what it is. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
I am not trying to be unhelpful. We have two new servers that we installed last fall and both are doing the exact same thing.I can give you as much info as you ask for. The only programs that access the detail file is radius and radrelay. I will attempt to catch it doing it while in debug mode to see if anymore info is available. Is there something you can suggest that I look at or any information that would be helpful to you? ----- Original Message ----- From: "Alan DeKok" <aland@deployingradius.com> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Wednesday, January 24, 2007 2:44 PM Subject: Re: Small problem with authentication
Mark Jones wrote:
Again, what ELSE is going on in the system? This is a dedicated box to just radius. Load never exceeds 0.15 disk usage is less then 20 % on all volumes
OK...
WHY is the detail module failing to acquire the file lock? Is the disk full? Is the CPU busy?
I assume it is to do with radrelay.
That's just pointedly unhelpful. radrelay is the only other program locking the detail file, so it's not rocket science to come up with that statement.
I'll say this: I've never seen the problem before. It MUST be something special on your system. I don't know what it is.
Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.5.432 / Virus Database: 268.17.8/649 - Release Date: 1/23/2007 8:40 PM
Mark Jones wrote:
I am not trying to be unhelpful. We have two new servers that we installed last fall and both are doing the exact same thing.I can give you as much info as you ask for.
The problem is I don't know what else to ask for. I've never seen this before, and I have no idea why the two problems would be related.
The only programs that access the detail file is radius and radrelay. I will attempt to catch it doing it while in debug mode to see if anymore info is available. Is there something you can suggest that I look at or any information that would be helpful to you?
Just the debug output, maybe. It might not be helpful, either. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
Mark Jones wrote:
WHY is the detail module failing to acquire the file lock? Is the disk full? Is the CPU busy?
I assume it is to do with radrelay.
Just a thought.... What file system are you using on the volume where the detail records are being stored? Locking on NFS volumes can cause problems if not done correctly. -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com
just a local volume on debian linux....at home at the moment so I can't login and check ----- Original Message ----- From: "Dennis Skinner" <dskinner@bluefrog.com> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Wednesday, January 24, 2007 4:49 PM Subject: Re: Small problem with authentication
Mark Jones wrote:
WHY is the detail module failing to acquire the file lock? Is the disk full? Is the CPU busy?
I assume it is to do with radrelay.
Just a thought.... What file system are you using on the volume where the detail records are being stored? Locking on NFS volumes can cause problems if not done correctly.
-- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.5.432 / Virus Database: 268.17.8/649 - Release Date: 1/23/2007 8:40 PM
Dennis Skinner wrote:
Mark Jones wrote:
WHY is the detail module failing to acquire the file lock? Is the disk full? Is the CPU busy? I assume it is to do with radrelay.
Just a thought.... What file system are you using on the volume where the detail records are being stored? Locking on NFS volumes can cause problems if not done correctly.
Maybe try "strace" on the radrelay process.
Interesting. I actually wouldn't want to go into involving scripts but this gets me curious - what would be the way to run a script on the first login? This is something freeradius related, isn't it? Thanks. On 1/23/07, Alan DeKok <aland@deployingradius.com> wrote:
liran tal wrote:
Is it possible to set the expiration attribute to be of an offset type?
No. Because something has to remember when the offset started.
Say I set an offset of +30 days, and the user logins for the first time only 6 months from now. So once he login'ed once then the counter will start counting 30 days from his first login and then expire the account.
Run a script on the first login that updates the DB with the proper expiration.
Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
liran tal wrote:
Interesting. I actually wouldn't want to go into involving scripts
Well, then you won't implement a solution, I guess.
but this gets me curious - what would be the way to run a script on the first login? This is something freeradius related, isn't it?
Uh... yes. See the docs for how to run scripts. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
Very nice, thank you Alan. On 1/28/07, Alan DeKok <aland@deployingradius.com> wrote:
liran tal wrote:
Interesting. I actually wouldn't want to go into involving scripts
Well, then you won't implement a solution, I guess.
but this gets me curious - what would be the way to run a script on the first login? This is something freeradius related, isn't it?
Uh... yes. See the docs for how to run scripts.
Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (5)
-
Alan DeKok -
Dennis Skinner -
liran tal -
Mark Jones -
Phil Mayers