Ivan, While you're at it, can you check up on my forth-coming paperwork grade for Statistics B class? :-) Regards, Liran. 2008/1/15 <tnt@kalik.co.yu>:

OK, can we see database entries for a user (and group he belongs to) and the debug of the access request? Or should I get my crystal ball back from the polisher?

Ivan Kalik Kalik Informatika ISP

Dana 15/1/2008, "Arlinelson Fernandes dos Santos" <cytron@pop.com.br> piše:

...

Yes! I did. And I put attributes into all tables ckeck and reply.-------------------------------------------------------------------------------- Did you put something in usergroup table to link users and groups? Ivan Kalik Kalik Informatika ISP Dana 14/1/2008, "Arlinelson Fernandes dos Santos": >Hi,I am usind freeradius 2.0 an need to load radcheck, radreply, >radgroupcheck and radgroupreply tables. But radcheck and radreply work. To load

...

radgroupcheck e need to set Fall-Through = Yes, but radgroupreply don't work. The >read_groups directive is 'Yes' but not appers in the radius debug mode.How >can I do freeradius load radgroupreply? I have the Simultaneous-Use attribut in >this table, I need to use this attribute to all users. Someone >please? > > >

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Hi Etienne, are you also limiting your users based on traffic usage ? Regards Keith Dovale -----Original Message----- From: freeradius-users-bounces+keith=hostworx.co.za@lists.freeradius.org [mailto:freeradius-users-bounces+keith=hostworx.co.za@lists.freeradius.org] On Behalf Of Etienne Pretorius Sent: Tuesday, January 15, 2008 6:30 PM To: FreeRadius users mailing list Subject: Possible Spam : Low Spam probability - : sqlcounter continue after failed match Hello List, I have managed to get sqlcounter working for tracking the octets in the accounting database. Could someone give me a hint as how I would say allow a user for group 'A' to use up their octets and if the user also belongs to group 'B' to then allow an addtional amount of octets (10%) for example. I actually only need a Fall-Though like attribute for the authorize section as I have both queries working individually but when the user fails to pass sqlcounter on a group 'A' bases, then the Access-Reject packet is sent without FreeRadius attempting to process group 'B' sqlcounter. Kind Regards Etienne Pretorius - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Etienne Pretorius wrote:

Hello List,

I have managed to get sqlcounter working for tracking the octets in the accounting database. Could someone give me a hint as how I would say allow a user for group 'A' to use up their octets and if the user also belongs to group 'B' to then allow an addtional amount of octets (10%) for example.

I actually only need a Fall-Though like attribute for the authorize section as I have both queries working individually but when the user fails to pass sqlcounter on a group 'A' bases, then the Access-Reject packet is sent without FreeRadius attempting to process group 'B' sqlcounter.

Kind Regards Etienne Pretorius

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Replying to my own question for others...

Please see Module Failover at http://wiki.freeradius.org/Fail-over Kind Regards Etienne Pretorius <http://www.kingsley.co.za>

There is a typo in usergroup table. Group is set as teste-pap, while other tables have group test-pap. Ivan Kalik Kalik Informatika ISP Dana 15/1/2008, "Arlinelson Fernandes dos Santos" <cytron@pop.com.br> piše:

Don't take your ball, not good. ;) Here's informations:## radcheck+----+-----------+--------------------+----+---------+| id | UserName | Attribute | op | Value |+----+-----------+--------------------+----+---------+| 3 | test-pap | Cleartext-Password | := | pw123 |+----+-----------+--------------------+----+---------+## radreply+----+-----------+---------------------+----+-------+| id | UserName | Attribute | op | Value |+----+-----------+---------------------+----+-------+| 6 | test-pap | Upstream-Speed | = | 800 || 7 | test-pap | Downstream-Speed | = | 800 |+----+-----------+---------------------+----+-------+## radgroupcheck+----+----------------+--------------------+----+-------+| id | GroupName | Attribute | op | Value |+----+----------------+--------------------+----+-------+| 5 | f_pppoe_250k | Auth-Type | = | PAP || 6 | f_pppoe_250k | Simultaneous-Use | = | 1 |+----+----------------+--------------------+----+-------+ ## radgroupreply +----+--------------+-----------------------+----+----------------------+| id | GroupName | Attribute | op | Value |+----+--------------+-----------------------+----+----------------------+| 13 | f_pppoe_250k | Framed-Protocol | = | PPP || 14 | f_pppoe_250k | Framed-MTU | = | 1492 || 15 | f_pppoe_250k | Framed-Compression | = | Van-Jacobsen-TCP-IP || 16 | f_pppoe_250k | Service-Type | = | Framed-User |+---+----------------+----------------------+----+----------------------+ ## radusergroup (same usergroup table in 1.3 version freeradius, I have both tables) +-----------+----------------+----------+ | UserName | GroupName | priority | +-----------+----------------+----------+ | teste-pap | f_pppoe_250k | 1 | +-----------+----------------+----------+ ## radiusd -X rad_recv: Access-Request packet from host 7.7.7.1 port 32790, id=163, length=73 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "test-pap" User-Password = "pw123" NAS-IP-Address = NAS-Port = 0 Processing the authorize section of radiusd.conf +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop radius_xlat: 'test-pap' rlm_sql (sql): sql_set_user escaped user --> 'test-pap' rlm_sql (sql): Reserving sql socket id: 3 radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'test-pap' ORDER BY id' ######## loading radcheck table ########## rlm_sql (sql): User found in radcheck table radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'test-pap' ORDER BY id' ####### loading radreply table ########## rlm_sql (sql): Released sql socket id: 3 #### if found "Fall-Through = Yes" attribute, radgroupcheck is loaded, but not radgroupreply ######### ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated +- group authorize returns updated rad_check_password: Found Auth-Type auth: type "PAP" Processing the authenticate section of radiusd.conf +- entering group PAP rlm_pap: login attempt with password ngc0bqi rlm_pap: Using clear text password. rlm_pap: User authenticated successfully ++[pap] returns ok +- group PAP returns ok Processing the post-auth section of radiusd.conf +- entering group post-auth rlm_sql (sql): Processing sql_postauth rlm_sql (sql): sql_set_user escaped user --> 'test-pap' radius_xlat: 'INSERT into radpostauth (id, user, pass, reply, date) values ('', 'test-pap', 'ngc0bqi', 'Access-Accept', '2008-01-15 20:33:58')' rlm_sql (sql) in sql_postauth: query is INSERT into radpostauth (id, user, pass, reply, date) values ('', 'test-pap', 'pw123', 'Access-Accept', '2008-01-15 20:33:58') rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok +- group post-auth returns ok Sending Access-Accept of id 163 to 7.7.7.1 port 32790 ############# Here is when radius server send "items reply" to radiusclient ################# Upstream-Speed = 800 ######## attribute in radreply ######## Downstream-Speed = 800 ###### attribute in radreply ######## Finished request 0 state 5 Going to the next request rad_recv: Accounting-Request packet from host 7.7.7.1 port 32790, id=164, length=101 Acct-Session-Id = "478D34D61E1F00" User-Name = "test-pap" Acct-Status-Type = Start Service-Type = Framed-User Framed-Protocol = PPP Acct-Authentic = RADIUS NAS-Port-Type = Virtual Framed-IP-Address = 7.7.7.123 NAS-IP-Address = 7.7.7.1 NAS-Port = 0 Acct-Delay-Time = 0 Processing the preacct section of radiusd.conf +- entering group preacct ++[preprocess] returns ok rlm_acct_unique: Hashing 'NAS-Port = 0,Framed-IP-Address = 7.7.7.123,NAS-IP-Address = 7.7.7.1,Acct-Session-Id = "478D34D61E1F00",User-Name = "test-pap"' rlm_acct_unique: Acct-Unique-Session-ID = "a5e052f9f07c2f6f". ++[acct_unique] returns ok +- group preacct returns ok Processing the accounting section of radiusd.conf +- entering group accounting radius_xlat: '/usr/local/var/log/radius/radacct/7.7.7.1/detail-20080115' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/7.7.7.1/detail-20080115 radius_xlat: 'Tue Jan 15 20:33:58 2008' ++[detail] returns ok radius_xlat: '/usr/local/var/log/radius/radutmp' radius_xlat: 'test-pap' ++[radutmp] returns ok radius_xlat: 'test-pap' rlm_sql (sql): sql_set_user escaped user --> 'test-pap' radius_xlat: 'INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('478D34D61E1F00', 'a5e052f9f07c2f6f', 'test-pap', '', '7.7.7.1', '0', 'Virtual', '2008-01-15 20:33:58', '0', '0', 'RADIUS', '', '', '0', '0', '', '', '', 'Framed-User', 'PPP', '7.7.7.123', '0', '0')' rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok radius_xlat: 'test-pap' attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated +- group accounting returns updated Sending Accounting-Response of id 164 to 7.7.7.1 port 32790 Finished request 1 state 6 Going to the next request Cleaning up request 1 ID 164 with timestamp +15 Waking up in 4 seconds... Cleaning up request 0 ID 163 with timestamp +15 Nothing to do. Sleeping until we see a request. ################################ In freeradius documentation say (http://wiki.freeradius.org/Rlm_sql): Search the radcheck table for any check attributes specific to the user If check attributes are found, and there's a match, pull the reply items from the radreply table for this user and add them to the reply Group processing then begins if any of the following conditions are met: The user IS NOT found in radcheck The user IS found in radcheck, but the check items don't match The user IS found in radcheck, the check items DO match AND Fall-Through is set in the radreply table The user IS found in radcheck, the check items DO match AND the read_groups directive is set to 'yes' If groups are to be processed for this user, the first thing that is done is the list of groups this user is a member of is pulled from the usergroup table ordered by the priority field. The priority field of the usergroup table allows us to control the order in which groups are processed, so that we can emulate the ordering in the users file. ################### My case matches with last condition, the user is found in radcheck, the check items DO match AND the read_groups directive is set to 'yes'. But... I've testing the read_groups and it don't work. I made an invalid directive and it is ignored by radiusd, it's not appers in debug log. read_groups don't too. I have testing the Fall-Through in radreply and it work, but don't load the radgroupreply table. I need this table, because its attributes are replied to radiusclient, and my scripts in NAS side can work it. Note: In freeradius 1.3 don't have read_groups directive, but all tables are loaded. -------------------------------------------------------------------------------- OK, can we see database entries for a user (and group he belongs to) and the debug of the access request? Or should I get my crystal ball back from the polisher? Ivan Kalik Kalik Informatika ISP Dana 15/1/2008, "Arlinelson Fernandes dos Santos" pi¹e:

...

Yes! I did. And I put attributes into all tables ckeck and reply.

---

Did you put something in usergroup table to link users and groups?

------------------------------------------------------------------------------------------------------ Acelerador POP Acelere a sua conexão discada em até 19 x. Use o Acelerador POP. É grátis, pegue já o seu. http://www.pop.com.br/acelerador

OK, since that's correct I had a look at the debug. You are not doing group checking at all. You have done something to sql.conf to break it. Go back to the original sql.conf and just alter the connection details (user, pass, server). Leave rest as it is (we will sort out sumultaneous use later). Default configuration will do group checking. Remove Auth-Type from the radcheck table - let the server sort it out. Put := as an operator for Simultaneous-Use. Ivan Kalik Kalik Informatika ISP Dana 16/1/2008, "Arlinelson Fernandes dos Santos" <cytron@pop.com.br> piše:

Sorry! I was writing this post and correcting the align spaces when press the "e" for accident. In my usergroup is test-pap. thanks.

Arlinelson Fernandes dos Santos wrote:

If you are using the freeradius version 2.0.0-pre1

Please upgrade to 2.0.0. It is *much* better. 2.0.0-pre1 is horrible in comparison to the final release. Alan DeKok.

Arlinelson Fernandes dos Santos wrote:

The pre1 version is buggy!!!

Yes... which is why 2.0.0 was released.

Now, I'm working to solver this: rlm_acct_unique: WARNING: Attribute Client-IP-Address was not found in request, unique ID MAY be inconsistent

Grab the latest version from CVS. It has this issue fixed. Alan DeKok.