rlm_postgresql , accounting and Framed-IP-Address
Hello I'm having some problems when accounting with postgreSQL. I'm using FreeRadius 1.1.3 with sqlippool and postgresql. Authentication is done via PAM to a LDAP server. Some authorization is done with LDAP (pool assignment, profiles...). I would like to use accounting and simultaneous use check with postgreSQL. It seems that everything is working well.. But for some reason I don't get the assigned IP in my accounting tables whenever the user is logged. I just get it whenever the user is disconnected. I would like to have that info in real-time for debugging purposes. This is my postgresql.sql related config: ---- sql_user_name = "%{Stripped-User-Name:-%{User-Name}}" accounting_start_query = "INSERT into ${acct_table1} \ (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctAuthentic, \ ConnectInfo_start, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay ) \ values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', \ '%{NAS-Port}', '%{NAS-Port-Type}', ('%S'::timestamp - '%{Acct-Delay-Time:-0}'::interval), '%{Acct-Authentic}', '%{Connect-Info}', \ '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', \ NULLIF('%{reply:Framed-IP-Address}', '')::inet, '%{Acct-Delay-Time:-0}')" ---- The %{reply:Framed-IP-Address} or %{Framed-IP-Address} isn't xlated at all... SQL module is executed after sqlippool, so, that variable should be available. The logs: --- rlm_sql (sql): Reserving sql socket id: 2 radius_xlat: 'BEGIN' rlm_sql_postgresql: query: BEGIN rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: affected rows = radius_xlat: 'UPDATE radippool SET expiry_time = 'now'::timestamp(0) + '3600 second'::interval WHERE nasipaddress = '10.15.208.103' AND pool_name = 'Pool-VODA-IPdina'' rlm_sql_postgresql: query: UPDATE radippool SET expiry_time = 'now'::timestamp(0) + '3600 second'::interval WHERE nasipaddress = ' 10.15.208.103' AND pool_name = 'Pool-VODA-IPdina' rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: affected rows = 2 radius_xlat: 'COMMIT' rlm_sql_postgresql: query: COMMIT rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): Released sql socket id: 2 modcall[accounting]: module "sqlippool" returns ok for request 6 radius_xlat: 'vodafone.dinamica@junta' rlm_sql (sql): sql_set_user escaped user --> 'vodafone.dinamica@junta' radius_xlat: 'INSERT into radacct ??(AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctAuthentic, ??ConnectInfo_start, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay ) ??values('45D09AA81E8F00', '55addd923467ad3f', 'vodafone.dinamica@junta', '', '10.15.208.103', ??'0', 'Async', ('2007-02-12 17:51:15'::timestamp - '0'::interval), 'RADIUS', '', ??'', '10.15.208.106', 'Framed-User', 'PPP', ??NULLIF('', '')::inet, '0')' radius_xlat: '/var/log/freeradius/sqltrace.sql' rlm_sql (sql): Reserving sql socket id: 1 rlm_sql_postgresql: query: INSERT into radacct ??(AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctAuthentic, ??ConnectInfo_start, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay ) ??values('45D09AA81E8F00', '55addd923467ad3f', ' vodafone.dinamica@junta', '', '10.15.208.103', ??'0', 'Async', ('2007-02-12 17:51:15'::timestamp - '0'::interval), 'RADIUS', '', ??'', '10.15.208.106', 'Framed-User', 'PPP', ??NULLIF('', '')::inet, '0') rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: affected rows = 1 rlm_sql (sql): Released sql socket id: 1 modcall[accounting]: module "sql" returns ok for request 6 --- The assigned IP is 10.247.254.3 (or 10.247.254.5)... The relevant part in radiusd.conf ---- accounting { sqlippool sql } ------------- By the way.. The username is not stripped, and @junta appears in the logs after the xlat call :/ what am I doing wrong? Thanks
Francisco Gimeno wrote:
The %{reply:Framed-IP-Address} or %{Framed-IP-Address} isn't xlated at all... SQL module is executed after sqlippool, so, that variable should be available.
Nop. Accounting replies contain NO attributes, therefore reply:Anything is invalid/empty. For accounting queries to log the IP address, your NAS must send the Framed-IP-Address attribute in the accounting request. If it doesn't (as it must not be) you can't log it. Consult the documentation for your NAS. You've undoubtedly taken that reply:Framed-IP-Address from the "post-auth" query where it is valid.
hello.. Thanks for your answer!... then, how could I put the IP there? Is the post-auth hook the right place? 2007/2/12, Phil Mayers <p.mayers@imperial.ac.uk>:
Francisco Gimeno wrote:
The %{reply:Framed-IP-Address} or %{Framed-IP-Address} isn't xlated at all... SQL module is executed after sqlippool, so, that variable should be available.
Nop. Accounting replies contain NO attributes, therefore reply:Anything is invalid/empty.
For accounting queries to log the IP address, your NAS must send the Framed-IP-Address attribute in the accounting request. If it doesn't (as it must not be) you can't log it.
Consult the documentation for your NAS.
You've undoubtedly taken that reply:Framed-IP-Address from the "post-auth" query where it is valid.
Francisco Gimeno wrote:
hello.. Thanks for your answer!...
then, how could I put the IP there? Is the post-auth hook the right place?
Yes, if you execute an SQL query in the post-auth section it can use %{reply:Framed-IP-Address}
2007/2/12, Phil Mayers < p.mayers@imperial.ac.uk <mailto:p.mayers@imperial.ac.uk>>:
Francisco Gimeno wrote: > > The %{reply:Framed-IP-Address} or %{Framed-IP-Address} isn't xlated at > all... SQL module is executed after sqlippool, so, that variable should > be available.
Nop. Accounting replies contain NO attributes, therefore reply:Anything is invalid/empty.
For accounting queries to log the IP address, your NAS must send the Framed-IP-Address attribute in the accounting request. If it doesn't (as it must not be) you can't log it.
Consult the documentation for your NAS.
You've undoubtedly taken that reply:Framed-IP-Address from the "post-auth" query where it is valid.
------------------------------------------------------------------------
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Francisco Gimeno -
Phil Mayers