FreeRadius LDAP Simultaneous-Use more than 1
So after some configuration I was to make Freeradius work with MS AD using groups to modify vlan-id and everything seemed to be working great. I tested Simultaneous-Use with the following configuration and it was working but when I switch it to ":= 2" it fails to stop users after the second login. It stops users correctly if I set it to 1 but fails on two. I can see the user logins using radwho but it only ever shows 1 login. Do I have to use Mysql to use Simultaneous-Use if the value is greater than 1? /etc/freeradius/users DEFAULT Ldap-Group == "MS-AD-GROUP",Simultaneous-Use := 2 (works if set to 1) Fall-Through = NO From Paul Reilly
On Feb 20, 2015, at 10:21 AM, Reilly, Paul <preilly@eastpennsd.org> wrote:
So after some configuration I was to make Freeradius work with MS AD using groups to modify vlan-id and everything seemed to be working great. I tested Simultaneous-Use with the following configuration and it was working but when I switch it to ":= 2" it fails to stop users after the second login.
It should work, unless….
I can see the user logins using radwho but it only ever shows 1 login.
That explains why.
Do I have to use Mysql to use Simultaneous-Use if the value is greater than 1?
No. It might help in this case, because the SQL schema is a bit more flexible than radutmp. Ensure that the accounting packets have UNIQUE identifiers for each user. And… run in debugging mode to see what’s going on. Really. I can’t recommend that enough. Alan DeKok.
I been debugging it and I think it has to do with my client.conf settings nastype set to other not cisco. When I set it to cisco I am getting snmp errors which makes be believe checkrad isnt working properly. SNMP Error: Received SNMP response with error code error status: noSuchName index 1 (OID: 1.3.6.1.4.1.9.2.9.2.1.18.13) SNMPv1_Session (remote host: "172.23.160.4" [172.23.160.4].161) community: "radius_public" request ID: -515873683 PDU bufsize: 8000 bytes timeout: 2s retries: 5 backoff: 1) at /usr/sbin/checkrad line 227. checkrad: No SNMP answer from cisco. checkrad: not found! No I am getting accounting information in /var/log/freeradius/radacct/..... but I guess that doesn’t mean checkrad is working properly. From Paul Reilly Network Manager Technology Department East Penn School District -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+preilly=eastpennsd.org@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Friday, February 20, 2015 12:55 PM To: FreeRadius users mailing list Subject: Re: FreeRadius LDAP Simultaneous-Use more than 1 On Feb 20, 2015, at 10:21 AM, Reilly, Paul <preilly@eastpennsd.org> wrote:
So after some configuration I was to make Freeradius work with MS AD using groups to modify vlan-id and everything seemed to be working great. I tested Simultaneous-Use with the following configuration and it was working but when I switch it to ":= 2" it fails to stop users after the second login.
It should work, unless….
I can see the user logins using radwho but it only ever shows 1 login.
That explains why.
Do I have to use Mysql to use Simultaneous-Use if the value is greater than 1?
No. It might help in this case, because the SQL schema is a bit more flexible than radutmp. Ensure that the accounting packets have UNIQUE identifiers for each user. And… run in debugging mode to see what’s going on. Really. I can’t recommend that enough. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Feb 20, 2015, at 1:01 PM, Reilly, Paul <preilly@eastpennsd.org> wrote:
I been debugging it and I think it has to do with my client.conf settings nastype set to other not cisco.
No. That doesn’t matter.
When I set it to cisco I am getting snmp errors which makes be believe checkrad isnt working properly.
That doesn’t matter. I *said* you should ensure that the accounting packets have UNIQUE identifiers for each user. And run it in debugging mode. Do that.
No I am getting accounting information in /var/log/freeradius/radacct/…..
Which doesn’t matter.
but I guess that doesn’t mean checkrad is working properly.
It has nothing to do with checkrad. Alan DeKok.
I been using debug and trying to thin it out using grep so I can only see the acct_unique and radutmp sections. I logged into three devices and got the follow debug. It appears they do have different acct-unique-session-IDS root@radius:/etc/freeradius# freeradius -X |egrep "acct_unique|radutmp" including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/sradutmp Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" [radutmp] expand: /var/log/freeradius/radutmp -> /var/log/freeradius/radutmp [radutmp] expand: %{User-Name} -> preilly ++[radutmp] returns ok [acct_unique] Hashing 'NAS-Port = 13,Client-IP-Address = 172.23.160.4,NAS-IP-Address = 172.23.160.4,Acct-Session-Id = "54e785c9/58:b0:35:67:b6:ed/784384",User-Name = "preilly"' [acct_unique] Acct-Unique-Session-ID = "093989dd19d7eb62". ++[acct_unique] returns ok [radutmp] expand: /var/log/freeradius/radutmp -> /var/log/freeradius/radutmp [radutmp] expand: %{User-Name} -> preilly ++[radutmp] returns ok [radutmp] expand: /var/log/freeradius/radutmp -> /var/log/freeradius/radutmp [radutmp] expand: %{User-Name} -> preilly ++[radutmp] returns ok [acct_unique] Hashing 'NAS-Port = 13,Client-IP-Address = 172.23.160.4,NAS-IP-Address = 172.23.160.4,Acct-Session-Id = "54e7837a/60:33:4b:0a:35:7b/784066",User-Name = "preilly"' [acct_unique] Acct-Unique-Session-ID = "058942f27f35207f". ++[acct_unique] returns ok [radutmp] expand: /var/log/freeradius/radutmp -> /var/log/freeradius/radutmp [radutmp] expand: %{User-Name} -> preilly ++[radutmp] returns ok [radutmp] expand: /var/log/freeradius/radutmp -> /var/log/freeradius/radutmp [radutmp] expand: %{User-Name} -> preilly ++[radutmp] returns ok [acct_unique] Hashing 'NAS-Port = 13,Client-IP-Address = 172.23.160.4,NAS-IP-Address = 172.23.160.4,Acct-Session-Id = "54e783bd/24:a2:e1:d4:66:07/784107",User-Name = "preilly"' [acct_unique] Acct-Unique-Session-ID = "5fef811d321af9b8". ++[acct_unique] returns ok [radutmp] expand: /var/log/freeradius/radutmp -> /var/log/freeradius/radutmp [radutmp] expand: %{User-Name} -> preilly ++[radutmp] returns ok Currently have it set to Simultaneous-Use := 2 From Paul Reilly -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+preilly=eastpennsd.org@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Friday, February 20, 2015 1:16 PM To: FreeRadius users mailing list Subject: Re: FreeRadius LDAP Simultaneous-Use more than 1 On Feb 20, 2015, at 1:01 PM, Reilly, Paul <preilly@eastpennsd.org> wrote:
I been debugging it and I think it has to do with my client.conf settings nastype set to other not cisco.
No. That doesn’t matter.
When I set it to cisco I am getting snmp errors which makes be believe checkrad isnt working properly.
That doesn’t matter. I *said* you should ensure that the accounting packets have UNIQUE identifiers for each user. And run it in debugging mode. Do that.
No I am getting accounting information in /var/log/freeradius/radacct/…..
Which doesn’t matter.
but I guess that doesn’t mean checkrad is working properly.
It has nothing to do with checkrad. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Feb 20, 2015, at 2:16 PM, Reilly, Paul <preilly@eastpennsd.org> wrote:
I been using debug and trying to thin it out using grep so I can only see the acct_unique and radutmp sections. I logged into three devices and got the follow debug. It appears they do have different acct-unique-session-IDS
That’s nice, but not enough. The radutmp module uses fields like NAS-Port, etc. to create a unique *utmp* session. If the NAS sends the same information for all users, there will be only one radutmp entry. Configure sql for accounting, and simultaneous-use. Alan DeKok.
I will look up the sql configuration on Monday and start working through it. Sent from my iPhone
On Feb 21, 2015, at 9:00 AM, Alan DeKok <aland@deployingradius.com> wrote:
On Feb 20, 2015, at 2:16 PM, Reilly, Paul <preilly@eastpennsd.org> wrote:
I been using debug and trying to thin it out using grep so I can only see the acct_unique and radutmp sections. I logged into three devices and got the follow debug. It appears they do have different acct-unique-session-IDS
That’s nice, but not enough. The radutmp module uses fields like NAS-Port, etc. to create a unique *utmp* session. If the NAS sends the same information for all users, there will be only one radutmp entry.
Configure sql for accounting, and simultaneous-use.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Alan DeKok -
Reilly, Paul