Configuring accounting on Freeradius server
Hello, I am running Freeradius Server version 2.1.10 on a debian machine (64 bit). I have a debian client (using pam_radius_auth) for authentication and accounting. My client can authenticate into the the radius server, however, I dont see any accounting being done. Attached is the radiusd -X output. Is there any configuration required for the pam_radius_auth.so? Also on the freeradius server, I uncommented a line from acct_users - root@debian:/etc/freeradius# cat acct_users # # $Id$ # # This is like the 'users' file, but it is processed only for # accounting packets. # # Select between different accounting methods based for example on the # Realm, the Huntgroup-Name or any combinaison of the attribute/value # pairs contained in an accounting packet. # #DEFAULT Realm == "foo.net", Acct-Type := sql_log.foo # #DEFAULT Huntgroup-Name == "wifi", Acct-Type := sql_log.wifi # #DEFAULT Client-IP-Address == 10.0.0.1, Acct-Type := sql_log.other # #DEFAULT Acct-Status-Type == Start, Acct-Type := sql_log.start # Replace the User-Name with the Stripped-User-Name, if it exists. # DEFAULT User-Name := "%{Stripped-User-Name:-%{User-Name}}" root@debian:/etc/freeradius# Thanks in advance.
Deepti kulkarni wrote:
I am running Freeradius Server version 2.1.10 on a debian machine (64 bit). I have a debian client (using pam_radius_auth) for authentication and accounting. My client can authenticate into the the radius server, however, I dont see any accounting being done.
Read the FAQ. This is answered there.
Is there any configuration required for the pam_radius_auth.so?
Like what? The PAM module has documentation. Do you have a specific question?
Also on the freeradius server, I uncommented a line from acct_users -
# Replace the User-Name with the Stripped-User-Name, if it exists. # DEFAULT User-Name := "%{Stripped-User-Name:-%{User-Name}}"
No, that doesn't do what you want. Delete that. It's not necessary. The server already does the right thing. Alan DeKok.
On Thu, Jan 31, 2013 at 1:43 PM, Alan DeKok <aland@deployingradius.com>wrote:
Deepti kulkarni wrote:
I am running Freeradius Server version 2.1.10 on a debian machine (64 bit). I have a debian client (using pam_radius_auth) for authentication and accounting. My client can authenticate into the the radius server, however, I dont see any accounting being done.
Read the FAQ. This is answered there.
Is there any configuration required for the pam_radius_auth.so?
Like what? The PAM module has documentation. Do you have a specific question?
Also on the freeradius server, I uncommented a line from acct_users -
# Replace the User-Name with the Stripped-User-Name, if it exists. # DEFAULT User-Name := "%{Stripped-User-Name:-%{User-Name}}"
No, that doesn't do what you want.
Delete that. It's not necessary. The server already does the right thing.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
The FAQ I looked at doesnt mention how-to configure accounting. Maybe I am looking at wrong place? http://wiki.freeradius.org/Home Also, for the PAM, do I need to enable accounting on the client as well? Is the client responsible for sending accounting packets to the freeradius server? Please let me know the FAQ link you are referring.
Deepti kulkarni wrote:
The FAQ I looked at doesnt mention how-to configure accounting. Maybe I am looking at wrong place? http://wiki.freeradius.org/Home
Does that look like the FAQ? There *IS* a FAQ link on that page. Read it. The FAQ describes what to do when you don't receive accounting data.
Also, for the PAM, do I need to enable accounting on the client as well?
No.
Is the client responsible for sending accounting packets to the freeradius server?
Yes.
Please let me know the FAQ link you are referring.
I fail to understand why it's difficult to go to "www.freeradius.org", and click on the "FAQ" link. Alan DeKok.
Thank you the answers. I see that my freeradius server is receiving accounting request when I use "radclient" and it logs it as well. As you said that the client is responsible for sending accounting requests to the server, I am new to radius server and PAM, so not sure how this is done (apart from using radclient)? Pointers here would be appreciated. Thanks On Fri, Feb 1, 2013 at 8:20 AM, Alan DeKok <aland@deployingradius.com>wrote:
Deepti kulkarni wrote:
The FAQ I looked at doesnt mention how-to configure accounting. Maybe I am looking at wrong place? http://wiki.freeradius.org/Home
Does that look like the FAQ? There *IS* a FAQ link on that page. Read it.
The FAQ describes what to do when you don't receive accounting data.
Also, for the PAM, do I need to enable accounting on the client as well?
No.
Is the client responsible for sending accounting packets to the freeradius server?
Yes.
Please let me know the FAQ link you are referring.
I fail to understand why it's difficult to go to "www.freeradius.org", and click on the "FAQ" link.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Deepti kulkarni wrote:
Thank you the answers. I see that my freeradius server is receiving accounting request when I use "radclient" and it logs it as well.
That's really not the point, is it? The point is whether or not the *production* client sends accounting packets.
As you said that the client is responsible for sending accounting requests to the server, I am new to radius server and PAM, so not sure how this is done (apart from using radclient)?
The PAM module doesn't do accounting. If you're using another NAS (switch, etc.) it should do accounting. Alan DeKok.
On Fri, Feb 1, 2013 at 5:50 PM, Alan DeKok <aland@deployingradius.com>wrote:
Deepti kulkarni wrote:
Thank you the answers. I see that my freeradius server is receiving accounting request when I use "radclient" and it logs it as well.
That's really not the point, is it? The point is whether or not the *production* client sends accounting packets.
As you said that the client is responsible for sending accounting requests to the server, I am new to radius server and PAM, so not sure how this is done (apart from using radclient)?
The PAM module doesn't do accounting.
If you're using another NAS (switch, etc.) it should do accounting.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
No, my "production" client is not sending any accounting packets. I am completely not sure how that can be set. Thanks
Dear everybody, i've got question about EAP/TLS and authentification for a client through a certificate ? I succeed setting up. But , i notice that freeradius matches client login with certificate CNAME. Is it possible to change it in order to match email instead of CNAME ? Best regards.
vazoumana fofana wrote:
i've got question about EAP/TLS and authentification for a client through a certificate ? I succeed setting up. But , i notice that freeradius matches client login with certificate CNAME. Is it possible to change it in order to match email instead of CNAME ?
Yes. Read the eap.conf file, and the raddb/sites-available/default. This is documented. Alan DeKok.
i begin setting up configuration. bit i got two problems : client with good certificate can be authenticated even if they're not in "users" file. I assume it's due to my code. Here is under authenticate section of default : Auth-Type eap { eap if ( "%{TLS-Client-Cert-Subject}" =~ /\/xxxxxxxx\// ) { if ( "%{TLS-Client-Cert-Subject}" =~ /\/xxxxxxxxxxx\// ) { ok } else { fail } It's like when condition is checked, it bypassed "users" file. Maybe, i must move these lines under authorize ? anyone to confirm it ? cheers
Date: Mon, 4 Feb 2013 10:32:22 -0500 From: aland@deployingradius.com To: freeradius-users@lists.freeradius.org Subject: Re: [EAP/TLS] Authenfication through a certificate
vazoumana fofana wrote:
i've got question about EAP/TLS and authentification for a client through a certificate ? I succeed setting up. But , i notice that freeradius matches client login with certificate CNAME. Is it possible to change it in order to match email instead of CNAME ?
Yes.
Read the eap.conf file, and the raddb/sites-available/default. This is documented.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
So my radius client was missing some configuration. Now the client sends accounting packets to the server. Thanks for the help on that. Deepti On Sun, Feb 3, 2013 at 7:56 PM, Alan DeKok <aland@deployingradius.com>wrote:
Deepti kulkarni wrote:
No, my "production" client is not sending any accounting packets. I am completely not sure how that can be set.
If the NAS documentation doesn't say how to configure accounting, then it doesn't do accounting.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
Deepti kulkarni -
vazoumana fofana