NAS restart without proper client logout on radius (mysql)
Hello all, I have a question: when a nas restart without sending client logout to the freeradius server the clients stay connected in radacct table (AcctStopTime=0). What can I do to solve this kind of problem? What could happen is that when a nas reboot my clients keep logged and when the nas start again they will get "You are already logged in" (simultaneous-use). -- Att, NATANIEL KLUG nata@cnett.com.br Cyber Nett - Internet Banda Larga www.cnett.com.br (42) 3635-2957 Rua Diogo Pinto, 1046, Centro Laranjeiras do Sul - PR Brasil - 85301-290 "... também os sábios possuem coração tangível e podem, por vezes, usar da ciência como meio de demonstrar impressões sentimentais de que muitos não os julgam suscetíveis." Visconde de Taunay -- Esta mensagem foi verificada pelo antivirus e antispam e acredita-se nao se tratar de nenhum dos dois. Sistema de email Cyber Nett - v2.0
If they are getting that message then nastype in clients.conf is set to "other" which disables checkrad script and the checks are made only against the database. Change the nastype to the vendor of your NAS (if it is supported). Or simply delete all open entries older that the time your NAS rebooted. Ivan Kalik Kalik Informatika ISP Dana 16/7/2007, "Nataniel Klug" <nata@cnett.com.br> piše:
Hello all,
I have a question: when a nas restart without sending client logout to the freeradius server the clients stay connected in radacct table (AcctStopTime=0). What can I do to solve this kind of problem? What could happen is that when a nas reboot my clients keep logged and when the nas start again they will get "You are already logged in" (simultaneous-use).
-- Att,
NATANIEL KLUG nata@cnett.com.br
Cyber Nett - Internet Banda Larga www.cnett.com.br (42) 3635-2957 Rua Diogo Pinto, 1046, Centro Laranjeiras do Sul - PR Brasil - 85301-290
"... também os sábios possuem coraçăo tangível e podem, por vezes, usar da cięncia como meio de demonstrar impressőes sentimentais de que muitos năo os julgam suscetíveis." Visconde de Taunay
-- Esta mensagem foi verificada pelo antivirus e antispam e acredita-se nao se tratar de nenhum dos dois.
Sistema de email Cyber Nett - v2.0
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
tnt@kalik.co.yu said:
Dana 16/7/2007, "Nataniel Klug" <nata@cnett.com.br> piše:
Hello all,
I have a question: when a nas restart without sending client logout to the freeradius server the clients stay connected in radacct table (AcctStopTime=0). What can I do to solve this kind of problem? What could happen is that when a nas reboot my clients keep logged and when the nas start again they will get "You are already logged in" (simultaneous-use).
If they are getting that message then nastype in clients.conf is set to "other" which disables checkrad script and the checks are made only against the database. Change the nastype to the vendor of your NAS (if it is supported). Or simply delete all open entries older that the time your NAS rebooted.
Shouldn't the NAS send one or both of accounting off/on, which (if the accounting_onoff_query is defined correctly) should set the AcctStopTime to "now()" (or %S depending on flavor)?
Ivan Kalik Kalik Informatika ISP
-- hugh
I don't think things like Mikrotik and Chillispot send such packets. I've never seen one from our Mikrotik which is rebotted once every week or two. I've never seen one from our Cisco either but that's because it hasn't been rebooted in last 18 months ;-) Ivan Kalik Kalik informatika ISP Dana 16/7/2007, "Hugh Messenger" <hugh@alaweb.com> piše:
tnt@kalik.co.yu said:
Dana 16/7/2007, "Nataniel Klug" <nata@cnett.com.br> piše:
Hello all,
I have a question: when a nas restart without sending client logout to the freeradius server the clients stay connected in radacct table (AcctStopTime=0). What can I do to solve this kind of problem? What could happen is that when a nas reboot my clients keep logged and when the nas start again they will get "You are already logged in" (simultaneous-use).
If they are getting that message then nastype in clients.conf is set to "other" which disables checkrad script and the checks are made only against the database. Change the nastype to the vendor of your NAS (if it is supported). Or simply delete all open entries older that the time your NAS rebooted.
Shouldn't the NAS send one or both of accounting off/on, which (if the accounting_onoff_query is defined correctly) should set the AcctStopTime to "now()" (or %S depending on flavor)?
Ivan Kalik Kalik Informatika ISP
-- hugh
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi Ivan, Now you get where I want to... I use Mikrotik RouterOS as NAS... What do you do when you need to reboot your Mikrotik? tnt@kalik.co.yu escreveu:
I don't think things like Mikrotik and Chillispot send such packets. I've never seen one from our Mikrotik which is rebotted once every week or two. I've never seen one from our Cisco either but that's because it hasn't been rebooted in last 18 months ;-)
Ivan Kalik Kalik informatika ISP
Dana 16/7/2007, "Hugh Messenger" <hugh@alaweb.com> piše:
tnt@kalik.co.yu said:
Dana 16/7/2007, "Nataniel Klug" <nata@cnett.com.br> piše:
Hello all,
I have a question: when a nas restart without sending client logout to the freeradius server the clients stay connected in radacct table (AcctStopTime=0). What can I do to solve this kind of problem? What could happen is that when a nas reboot my clients keep logged and when the nas start again they will get "You are already logged in" (simultaneous-use).
If they are getting that message then nastype in clients.conf is set to "other" which disables checkrad script and the checks are made only against the database. Change the nastype to the vendor of your NAS (if it is supported). Or simply delete all open entries older that the time your NAS rebooted.
Shouldn't the NAS send one or both of accounting off/on, which (if the accounting_onoff_query is defined correctly) should set the AcctStopTime to "now()" (or %S depending on flavor)?
Ivan Kalik Kalik Informatika ISP
-- hugh
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Esta mensagem foi verificada pelo antivirus e antispam e acredita-se nao se tratar de nenhum dos dois.
Sistema de email Cyber Nett - v2.0
-- Att, NATANIEL KLUG nata@cnett.com.br Cyber Nett - Internet Banda Larga www.cnett.com.br (42) 3635-2957 Rua Diogo Pinto, 1046, Centro Laranjeiras do Sul - PR Brasil - 85301-290 "... também os sábios possuem coraça~o tangível e podem, por vezes, usar da cie^ncia como meio de demonstrar impresso~es sentimentais de que muitos na~o os julgam suscetíveis." Visconde de Taunay -- Esta mensagem foi verificada pelo antivirus e antispam e acredita-se nao se tratar de nenhum dos dois. Sistema de email Cyber Nett - v2.0
If it's still responding (usually the router is responsive but wireless card is not) /system reboot or (more often) /system shutdown as you need to poke about the box. If it's frozen completely unplugging PoE does the trick. I close open accounting sessions - my wifi accouning is done with data rates so I need to have accounting updates configured (Acct-Interim-Interval) - if you are doing monthly subscription just wipe them off. When you get the desire to stamp on it just remember that you can buy a truckload of these for the price of one Cisco nad that you just found another reason why. Ivan Kalik Kalik Informatika ISP Dana 17/7/2007, "Nataniel Klug" <nata@cnett.com.br> piše:
Hi Ivan,
Now you get where I want to... I use Mikrotik RouterOS as NAS... What do you do when you need to reboot your Mikrotik?
tnt@kalik.co.yu escreveu:
I don't think things like Mikrotik and Chillispot send such packets. I've never seen one from our Mikrotik which is rebotted once every week or two. I've never seen one from our Cisco either but that's because it hasn't been rebooted in last 18 months ;-)
Ivan Kalik Kalik informatika ISP
Dana 16/7/2007, "Hugh Messenger" <hugh@alaweb.com> piše:
tnt@kalik.co.yu said:
Dana 16/7/2007, "Nataniel Klug" <nata@cnett.com.br> piše:
Hello all,
I have a question: when a nas restart without sending client logout to the freeradius server the clients stay connected in radacct table (AcctStopTime=0). What can I do to solve this kind of problem? What could happen is that when a nas reboot my clients keep logged and when the nas start again they will get "You are already logged in" (simultaneous-use).
If they are getting that message then nastype in clients.conf is set to "other" which disables checkrad script and the checks are made only against the database. Change the nastype to the vendor of your NAS (if it is supported). Or simply delete all open entries older that the time your NAS rebooted.
Shouldn't the NAS send one or both of accounting off/on, which (if the accounting_onoff_query is defined correctly) should set the AcctStopTime to "now()" (or %S depending on flavor)?
Ivan Kalik Kalik Informatika ISP
-- hugh
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/usershtml
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Esta mensagem foi verificada pelo antivirus e antispam e acredita-se nao se tratar de nenhum dos dois.
Sistema de email Cyber Nett - v2.0
-- Att,
NATANIEL KLUG nata@cnett.com.br
Cyber Nett - Internet Banda Larga www.cnett.com.br (42) 3635-2957 Rua Diogo Pinto, 1046, Centro Laranjeiras do Sul - PR Brasil - 85301-290
"... também os sábios possuem coraça~o tangível e podem, por vezes, usar da cie^ncia como meio de demonstrar impresso~es sentimentais de que muitos na~o os julgam suscetíveis." Visconde de Taunay
-- Esta mensagem foi verificada pelo antivirus e antispam e acredita-se nao se tratar de nenhum dos dois.
Sistema de email Cyber Nett - v2.0
On Tue 17 Jul 2007, tnt@kalik.co.yu wrote:
I don't think things like Mikrotik and Chillispot send such packets. I've never seen one from our Mikrotik which is rebotted once every week or two. I've never seen one from our Cisco either but that's because it hasn't been rebooted in last 18 months ;-)
You are correct the Chillispot does not send ON/OFF packets. I am going to write a mail to their list and request that they add this feature. You should request the same from Mikrotik . Cheers -- Peter Nixon http://peternixon.net/
You are correct the Chillispot does not send ON/OFF packets. I am going to write a mail to their list and request that they add this feature. You should request the same from Mikrotik .
Just did. :) http://forum.mikrotik.com/viewtopic.php?f=1&t=17171 As that post says, I never realized they didn't support ON/OFF as we've never had to reboot either of our Mtiks! I just "ass"umed they did support it.
Peter Nixon http://peternixon.net/
-- hugh
On Tue 17 Jul 2007, Peter Nixon wrote:
On Tue 17 Jul 2007, tnt@kalik.co.yu wrote:
I don't think things like Mikrotik and Chillispot send such packets. I've never seen one from our Mikrotik which is rebotted once every week or two. I've never seen one from our Cisco either but that's because it hasn't been rebooted in last 18 months ;-)
You are correct the Chillispot does not send ON/OFF packets. I am going to write a mail to their list and request that they add this feature. You should request the same from Mikrotik .
FYI CoovaChilli (http://coova.org/wiki/index.php/CoovaChilli) now supports Accounting ON/OFF packets in the SVN version. Thanks goes to David for his speedy patch. If/When this patch will get into the chillispot upstream code is a matter for conjecture. Cheers -- Peter Nixon http://peternixon.net/
On Monday 16 July 2007 12:37:08 Nataniel Klug wrote:
Hello all,
I have a question: when a nas restart without sending client logout to the freeradius server the clients stay connected in radacct table (AcctStopTime=0). What can I do to solve this kind of problem? What could happen is that when a nas reboot my clients keep logged and when the nas start again they will get "You are already logged in" (simultaneous-use).
Your NAS should send an Accounting-On packet which you can use to flag the existing connections as offline/disconnected. You can also use checkrad to confirm the session is active. Kevin Bonner
Hi Nataniel, If you have a NASty which doesn't send accounting-off when rebooting, I guess you have three options: 1) use "checkrad" script to test if the user is indeed logged in. The NASty should have a way to check for connected users or sessions by using snmp/telnet/etc. If you have many auth requests and many "NASty"s, it will consume a lot of CPU on both sides. Result: no angry customers, but high cpu usage and no billing 2) run every N minutes a script to get the list of connected users for every NASty. compare that list with the db entries and delete lost sessions from db. Result: low cpu usage, better billing (if your customers pay by time usage, you can still charge now() - N minutes - acct_start), but 'already logged in' will last N minutes (at most) 3) use petitiononline.com service to management with a subject "Network.Access.Server.TY must be replaced with Network.Access.Upgraded.Good.Hardware.TY". Result: no problems at all. using good hardware is always the best option. You can implement all three options IN THE SAME TIME to minimize the impact. Best regards, Claudiu Filip @: claudiu@globtel.ro Http://www.globtel.ro T:+40344880100 F:+40344880113 Monday, July 16, 2007, 7:37:08 PM, you wrote:
Hello all,
I have a question: when a nas restart without sending client logout to the freeradius server the clients stay connected in radacct table (AcctStopTime=0). What can I do to solve this kind of problem? What could happen is that when a nas reboot my clients keep logged and when the nas start again they will get "You are already logged in" (simultaneous-use).
participants (6)
-
Claudiu Filip -
Hugh Messenger -
Kevin Bonner -
Nataniel Klug -
Peter Nixon -
tnt＠kalik.co.yu