Re: Help with Configuration
You don't understand me. I know that Disconnect a user with Coa is very easy. But the problem is how to make the termination happen after the user's time is expire. What I am doing now is using an external tool through disconnect.conf in mods-enabled. It contains: exec coa_disconnect { wait = yes program = “/usr/local/bin/coa_disconnect.sh %{User-Name}” shell_escape = yes } And also policy.d/disconnect.conf expire_disconnect { update control { &Tmp-Integer-0 := “%{sql:SELECT IF(expiration < NOW(), 1, 0) FROM rm_users WHERE username = ‘%{User-Name}’ and ppp = ‘1’ LIMIT 1}” } if (&control:Tmp-Integer-0 == 1 && !&reply:Class) { update reply { &Reply-Message := “Your session has expired - redirecting...” } coa_disconnect update control { &Tmp-Integer-0 := “%{sql:UPDATE rm_users SET ppp=‘0’ WHERE username=‘%{User-Name}’}” } } } في الاثنين، 24 نوفمبر 2025 في 10:58 م تمت كتابة ما يلي بواسطة Alexandre Le Noir <muhanadali27@gmail.com>:
The attached file is only a signature certificate.
في الاثنين، 24 نوفمبر 2025 في 10:16 م تمت كتابة ما يلي بواسطة Alan DeKok via Freeradius-Users <freeradius-users@lists.freeradius.org>:
On Nov 24, 2025, at 2:09 PM, Alexandre Le Noir <muhanadali27@gmail.com> wrote:
where is the instructions ?
Try reading my message:
See sites-available/coa-relay
That's a virtual server which makes it easy to disconnect users. You will need to follow the instructions in the comments in that file, but it should work.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Nov 24, 2025, at 3:03 PM, Alexandre Le Noir <muhanadali27@gmail.com> wrote:
You don't understand me. I know that Disconnect a user with Coa is very easy.
If I don't understand you, it's because you're not asking good questions. You asked how to disconnect a user, and I pointed you to a file which contains complete instructions for doing that. You then asked where the instructions were. This is not productive.
But the problem is how to make the termination happen after the user's time is expire.
You can use a cron job to find expired sessions and delete them from the SQL database. As I said in my first message, you can use SQL queries to update the SQL database. However, this only deletes the sessions from the SQL database. If the user is still online, the NAS will send accounting packets, and the SQL database will again show an open session for that user. If you're sending Session-Timeout in the Access-Accept to enforce expiry, then the NAS should enforce that. If you're not sending Session-Timeout, fix your configuration to send it. If the NAS is ignoring Session-Timeout, then throw the NAS in the garbage, and buy one that implements RADIUS properly. Session-Timeout has been defined for about 30 years, so any NAS which ignores it is completely broken.
What I am doing now is using an external tool
through disconnect.conf in mods-enabled.
That might work, but it's fragile. Part of the problem here is that it's now taken 3 messages for you to explain what you're actually doing. This is not helpful. If you ask a vague question, we can only reply with a vague answer. If you ask a GOOD question with details, the answer is likely to be more helpful. So your question is how to disconnect a user. You seem to have a solution in hand. Does it work? If so, you don't need to change it. If the solution doesn't work, then ask a question about WHY the solution doesn't work. Post the debug logs (as suggested in ALL of the documentation). Alan DeKok.
I apologize for not clarifying the questions and for asking too many useless questions about the topic. The solution works, but it is not at the required level, and Session-Timeout did not happen before. I will send you a copy of the configuration I am using. I am using Routerboard 1036 with the latest version, which is supposed to never have these problems, especially session repetition. The problem I haven't found a solution for yet is that when there is a power outage and the server shuts down and restarts, users in Radius remain connected to the previous session without terminating it and reconnect to a new session. This results in two sessions containing acctstoptime = Null. I have not yet been able to find the cause and solution to this problem. You say that you sent a file containing instructions, but the file is not in the attachments either. في الاثنين، 24 نوفمبر 2025 في 11:18 م تمت كتابة ما يلي بواسطة Alan DeKok via Freeradius-Users <freeradius-users@lists.freeradius.org>:
On Nov 24, 2025, at 3:03 PM, Alexandre Le Noir <muhanadali27@gmail.com> wrote:
You don't understand me. I know that Disconnect a user with Coa is very easy.
If I don't understand you, it's because you're not asking good questions. You asked how to disconnect a user, and I pointed you to a file which contains complete instructions for doing that. You then asked where the instructions were.
This is not productive.
But the problem is how to make the termination happen after the user's time is expire.
You can use a cron job to find expired sessions and delete them from the SQL database. As I said in my first message, you can use SQL queries to update the SQL database.
However, this only deletes the sessions from the SQL database. If the user is still online, the NAS will send accounting packets, and the SQL database will again show an open session for that user.
If you're sending Session-Timeout in the Access-Accept to enforce expiry, then the NAS should enforce that. If you're not sending Session-Timeout, fix your configuration to send it.
If the NAS is ignoring Session-Timeout, then throw the NAS in the garbage, and buy one that implements RADIUS properly. Session-Timeout has been defined for about 30 years, so any NAS which ignores it is completely broken.
What I am doing now is using an external tool
through disconnect.conf in mods-enabled.
That might work, but it's fragile.
Part of the problem here is that it's now taken 3 messages for you to explain what you're actually doing. This is not helpful. If you ask a vague question, we can only reply with a vague answer. If you ask a GOOD question with details, the answer is likely to be more helpful.
So your question is how to disconnect a user. You seem to have a solution in hand. Does it work? If so, you don't need to change it.
If the solution doesn't work, then ask a question about WHY the solution doesn't work. Post the debug logs (as suggested in ALL of the documentation).
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Nov 24, 2025, at 3:42 PM, Alexandre Le Noir <muhanadali27@gmail.com> wrote:
I apologize for not clarifying the questions and for asking too many useless questions about the topic.
Thanks, but there's no need to apologize. Just do the with thing.
The solution works, but it is not at the required level, and Session-Timeout did not happen before.
I don't know what that means,
I will send you a copy of the configuration I am using.
That isn't helpful.
I am using Routerboard 1036 with the latest version, which is supposed to never have these problems, especially session repetition.
Then ask the manufacturer to fix their product.
The problem I haven't found a solution for yet is that when there is a power outage and the server shuts down and restarts, users in Radius remain connected to the previous session without terminating it and reconnect to a new session.
The NAS is supposed to send an accounting packet which tells the server that it has rebooted.
This results in two sessions containing acctstoptime = Null.
Yes,
I have not yet been able to find the cause and solution to this problem.
But a NAS which works correctly.
You say that you sent a file containing instructions, but the file is not in the attachments either.
I told you to read a file. Are you clear that "sites-available" is a directory in the FreeRADIUS configuration directory? Alan DeKok.
How can i use checkrad with mikrotik ? i used nas from the DB في الاثنين، 24 نوفمبر 2025 في 11:55 م تمت كتابة ما يلي بواسطة Alan DeKok via Freeradius-Users <freeradius-users@lists.freeradius.org>:
On Nov 24, 2025, at 3:42 PM, Alexandre Le Noir <muhanadali27@gmail.com> wrote:
I apologize for not clarifying the questions and for asking too many useless questions about the topic.
Thanks, but there's no need to apologize. Just do the with thing.
The solution works, but it is not at the required level, and Session-Timeout did not happen before.
I don't know what that means,
I will send you a copy of the configuration I am using.
That isn't helpful.
I am using Routerboard 1036 with the latest version, which is supposed to never have these problems, especially session repetition.
Then ask the manufacturer to fix their product.
The problem I haven't found a solution for yet is that when there is a power outage and the server shuts down and restarts, users in Radius remain connected to the previous session without terminating it and reconnect to a new session.
The NAS is supposed to send an accounting packet which tells the server that it has rebooted.
This results in two sessions containing acctstoptime = Null.
Yes,
I have not yet been able to find the cause and solution to this problem.
But a NAS which works correctly.
You say that you sent a file containing instructions, but the file is not in the attachments either.
I told you to read a file. Are you clear that "sites-available" is a directory in the FreeRADIUS configuration directory?
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Alan DeKok -
Alexandre Le Noir