Stale sessions and simultaneous use issue
Hi all! I had configured MySQL to store sessions of the users and I have a lots of records with wrong acctsessiontime value because NAS are sent Accounting On/Off packets and the database is update with the actual timestamp. I change deletestalesessions = no in sql.conf but the database is update too. What is the function of this parameter? There are some attribute to avoid stale sessions? I remember Idle-Timeout attribute but if the NAS isn't live the server never kill that session right? Thanks for all. Kings regards. Fernando.
The role of "deletestalesessions" parameter is to delete the record if checkrad script returns 0. Nevertheless, for it to work, you need to enable SNMP in your NAS, because checkrad script tries to connect through SNMP. Checkrad script is responsible for avoiding stale sessions. It works like this: - user tries to log in. - if there is a stale session in the database, run checkrad script - checkrad script connects to the NAS (through snmp) and list active users. - if checkrad sees the user, it returns 1. This tells freeradius to reject the authentication. In the log files, u will see "multiple logins" - if checkrad does'nt see the user, it returns 0. This tells freeradius do accept the login If for some reason, NAS does'nt send Acct-stop packet, you need to close the session in the database yourself. I wrote a script to do that. In fact, I based my script on coovachilli's script. Clayton A. Alves <http://claytonaalves.github.com> *claytonaalves* +55 66 9233-3406 2014-04-15 7:09 GMT-04:00 Fernando Pizarro <feanpg@gmail.com>:
Hi all!
I had configured MySQL to store sessions of the users and I have a lots of records with wrong acctsessiontime value because NAS are sent Accounting On/Off packets and the database is update with the actual timestamp.
I change deletestalesessions = no in sql.conf but the database is update too. What is the function of this parameter?
There are some attribute to avoid stale sessions? I remember Idle-Timeout attribute but if the NAS isn't live the server never kill that session right?
Thanks for all. Kings regards. Fernando. - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
On 04/15/2014 01:09 PM, Fernando Pizarro wrote:
Hi all!
I had configured MySQL to store sessions of the users and I have a lots of records with wrong acctsessiontime value because NAS are sent Accounting On/Off packets and the database is update with the actual timestamp.
Values in acctsessiontime, acctstarttime, acctstoptime etc. are all send by NAS, they are not not generated by freeradius. (Acct-Session-Time attribute and such)
I change deletestalesessions = no in sql.conf but the database is update too. What is the function of this parameter?
IIRC, records of such sessions will be overriden (sql update), so no new inserts will occur. However, how it works, depends on unique session id, the one in sql where condition rather than one sent by NAS. I have a hunch you mixed up that unique id:) Then you get updates on existing records and possibly override acctsessiontime.
There are some attribute to avoid stale sessions? I remember Idle-Timeout attribute but if the NAS isn't live the server never kill that session right?
Right. Again, first you need a way to identify user. Username is a good start;) Then, sort all user's sessions by acctstarttime. Only last one can have null acctstoptime. However, be very careful before deleting all other stale sessions. For even with acctstoptime empty, their acctsessiontime, bytesthis and octetsthat may and should get updated with interim packets. IOW, they stil may provide useful information for billing. Regards...
Fernando Pizarro wrote:
I had configured MySQL to store sessions of the users and I have a lots of records with wrong acctsessiontime value because NAS are sent Accounting On/Off packets and the database is update with the actual timestamp.
Please be clear: Accounting On/Off is used when the NAS reboots. Accounting Start / Stop is used when a user logs in.
I change deletestalesessions = no in sql.conf but the database is update too. What is the function of this parameter?
The comments in sql.conf explain what it does.
There are some attribute to avoid stale sessions? I remember Idle-Timeout attribute but if the NAS isn't live the server never kill that session right?
Tell your NAS to send accounting packets. Set Session-Timeout, and record it in SQL. Then if you don't see an Accounting Stop after Session-Timeout, you can *usually* delete the stale session. But some NAS equipment ignores Session-Timeout. This is RADIUS. It's very imperfect. Alan DeKok.
El 15/04/14 15:02, Alan DeKok escribió:
Fernando Pizarro wrote:
I had configured MySQL to store sessions of the users and I have a lots of records with wrong acctsessiontime value because NAS are sent Accounting On/Off packets and the database is update with the actual timestamp.
Please be clear: Accounting On/Off is used when the NAS reboots. Accounting Start / Stop is used when a user logs in.
I change deletestalesessions = no in sql.conf but the database is update too. What is the function of this parameter?
The comments in sql.conf explain what it does.
There are some attribute to avoid stale sessions? I remember Idle-Timeout attribute but if the NAS isn't live the server never kill that session right?
Tell your NAS to send accounting packets.
Set Session-Timeout, and record it in SQL. Then if you don't see an Accounting Stop after Session-Timeout, you can *usually* delete the stale session.
But some NAS equipment ignores Session-Timeout. This is RADIUS. It's very imperfect.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi all and thanks for answer! My first problem is the Accounting On/Off packet update *all* records of the NAS with the current timestamp as acctstoptime, acctterminatecause are "Nas-Reboot". I'm thinking how to modify accounting_onoff_query to adapt it to my requirements. I'm using hostapd as NAS and I need study how works roaming and session id of the clients and how to store that information on the database. I think the best solution is configure SNMP on the NAS and use checkrad to verify the user is connected it but I need read a lot information about that. Hostapd supports Session-Timeout but I can't use it, I'm using Expiration when I need close the connection at some user. Thanks all to clarify me deletestalesessions parameter too. Regards. Fernando.
El 15/04/14 18:59, Alan DeKok escribió:
Fernando Pizarro wrote:
My first problem is the Accounting On/Off packet update *all* records of the NAS with the current timestamp as acctstoptime, acctterminatecause are "Nas-Reboot".
That is now Accounting On/Off packets are supposed to work.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Sorry, I meant that the acctstoptime is the current timestamp and the acctsessiontime is acctstoptime less acctstarttime of all records and that is my problem. I have stale sessions even of days between start and stop accounting records and I search the better solution to avoid that. I'll change accounting_onoff_query to doesn't update acctsessiontime or add some seconds perhaps. Thanks for all. Regards. Fernando.
On 04/15/2014 06:40 PM, Fernando Pizarro wrote:
My first problem is the Accounting On/Off packet update *all* records of the NAS with the current timestamp as acctstoptime, acctterminatecause are "Nas-Reboot". I'm thinking how to modify accounting_onoff_query to adapt it to my requirements.
I get it. But it's supposed to work that way. (all records for restarted NAS with null stoptime) Silly but you don't get any timestamp with accounting-off packet, right? Then I guess ntpd slave on both radius and nas machines would fix acctsessiontime.
I'm using hostapd as NAS and I need study how works roaming and session id of the clients and how to store that information on the database.
Uh hostapd:) It's fuzzy; lots of basic howtos to make things work, but lacks precise docs. Guess you'll spend a lot of time with radiusd -X output, have fun;) Regards...
participants (4)
-
Alan DeKok -
Clayton Alves -
Fernando Pizarro -
Josip Almasi