Hi, I'm experiencing problems with Simultaneous-Use and MySQL. Due I have two freeradius servers, I cannot use for accounting radutmp because if a radius gets a stop packet and the start one went to the other radius the driver fails, so all accounting is based on MySQL. The MySQL queries that the radius perform are the followings (using standard sql.conf file with simul_count_query uncommented, the file is attached) 1- authorize_check_query (gets the Simultaneous-Use := 1) 2- authorize_group_check_query 3- authorize_reply_query 4- authorize_group_reply_query 5- simul_count_query 6- postauth_query 7- accounting_start_query 8- accounting_update_query (updates the radacct table with the IP address from the pool) If I try to connect with the same user and the previous conection still established, this is the sequence of queries: 1- authorize_check_query 2- authorize_group_check_query 3- authorize_reply_query 4- authorize_group_reply_query 5- simul_count_query **returns 1** 6- simul_verify_query 7- accounting stop query **performs a stop in the previously established session** 8- postauth_query 9- accounting_start_query 10- accounting_update_query (updates the radacct table with the IP address from the pool) I think either simul_verify_query is wrong or there is something wrong with sql.conf. I've attached it. If I change Simultaneous-Use := 0 the user cannot connect as I should behave and the logs reports "Auth: Multiple logins (max 0)" Freeradius and freeradius-mysql are etch/testing packages Debian official packages (version 1.0.4-2) Any help would be appreciated, thanks in advance -- David
"David M." <radius@mantxado.com> wrote:
If I try to connect with the same user and the previous conection still established, this is the sequence of queries: 1- authorize_check_query 2- authorize_group_check_query 3- authorize_reply_query 4- authorize_group_reply_query 5- simul_count_query **returns 1** 6- simul_verify_query 7- accounting stop query **performs a stop in the previously established session**
That's nice. What does debugging mode say? ALWAYS run the server in debugging mode to track down these kinds of problems. There is NO OTHER WAY to solve the problem. Alan DeKok.
Hi, Debug mode does not reveal further information, what I've noticed I didn't before :( is checkrad is used to verify if the connection is still established, despite simul_verify_query result. I've set up the SNMP community in naspasswd file and radius polls NAS in order to check active sessions and now it is working fine. My doubt/question is: checkrad is always used to Simultaneous-Use checking? Is it not possible to use radacct table instead of SNMP polling? Regards, David
"David M." <radius at mantxado.com> wrote:
If I try to connect with the same user and the previous conection still established, this is the sequence of queries: 1- authorize_check_query 2- authorize_group_check_query 3- authorize_reply_query 4- authorize_group_reply_query 5- simul_count_query **returns 1** 6- simul_verify_query 7- accounting stop query **performs a stop in the previously established session**
That's nice. What does debugging mode say?
ALWAYS run the server in debugging mode to track down these kinds of problems. There is NO OTHER WAY to solve the problem.
Alan DeKok.
-- David
"David M." <radius@mantxado.com> wrote:
Debug mode does not reveal further information, what I've noticed I didn't before :( is checkrad is used to verify if the connection is still established, despite simul_verify_query result.
Yes. Because the accounting stop packets may have been lost.
I've set up the SNMP community in naspasswd file and radius polls NAS in order to check active sessions and now it is working fine.
Uh, that's done by checkrad.
My doubt/question is: checkrad is always used to Simultaneous-Use checking? Is it not possible to use radacct table instead of SNMP polling?
Yes. Set the "nastype" to "other". And when the system misses an accounting stop packet, the user won't be able to log in again. Alan DeKok.
On Oct 14, 2005, at 2:35 PM, Alan DeKok wrote:
My doubt/question is: checkrad is always used to Simultaneous-Use checking? Is it not possible to use radacct table instead of SNMP polling?
Yes. Set the "nastype" to "other".
And when the system misses an accounting stop packet, the user won't be able to log in again.
Alan DeKok.
I use a timestamp column in my radacct table instead of checkrad and SNMP. So far it works fine. If last packet older than e.g. 15 min (3-5.. times Interval-time) ... the session is most probably lost. Gunther
Hello, El Viernes 14 Octubre 2005 20:35, Alan DeKok escribió:
"David M." <radius@mantxado.com> wrote:
Debug mode does not reveal further information, what I've noticed I didn't before :( is checkrad is used to verify if the connection is still established, despite simul_verify_query result.
Yes. Because the accounting stop packets may have been lost. That's right, actually I'm experiencing problems related with Stop packets that produce errors in MySQL driver I've to check, now I think checkrad is the best solution, furthermore in case SNMP timeout allows authorizes the new connection which IMO is desiderable.
My doubt/question is: checkrad is always used to Simultaneous-Use checking? Is it not possible to use radacct table instead of SNMP polling? Yes. Set the "nastype" to "other". Great.
Thanks a lot for your help. -- David Manchado Ing Sistemas EUROCIBER e: david.manchado@eurociber.es t: +34 911830209 / +34902902977 f: +34 911831109
participants (3)
-
Alan DeKok -
David M. -
Gunther