Hello, I am trying to set up accounting to log commands entered into a switch. What log file will FreeRADIUS log the accounting commands too? Here is my config: Cisco 3550-EMI username tmb privilege 15 secret 5 <Removed> aaa new-model aaa authentication login default group radius local aaa authorization exec default group radius if-authenticated local aaa accounting exec default start-stop group radius aaa accounting commands 1 default stop-only group radius aaa session-id common ip radius source-interface Vlan60 radius-server host 10.0.0.1 auth-port 1812 acct-port 1813 radius-server key 7 <Removed> FreeRADIUS Config: ### Configure listening IP Socket sudo vim /usr/lib/systemd/system/freeradius.service ExecStart=/usr/sbin/freeradius -f $FREERADIUS_OPTIONS -i 10.0.0.1 -p 1812-1813 # Define Listening socket sudo vim /etc/freeradius/3.0/radiusd.conf listen { ipv4addr = 10.0.0.1, port = 1812, type = auth } listen { ipv4addr = 10.0.0.1, port = 1813, type = acct } ### Free RADIUS Configuration sudo vim /etc/freeradius/3.0/clients.conf client 10.0.0.0/8 { ipv4addr = 10.0.0.0/8 secret = FreeRadiusSecret#1 nastype = cisco shortname = Butter.net } ### FreeRADIUS User Config sudo vim /etc/freeradius/3.0/users tmb Cleartext-Password := "620978" Service-Type = NAS-Prompt-User, Cisco-AVPair = "shell:priv-lvl=15" # FreeRADIUS group config DEFAULT Group == "cisco-rw" Service-Type = NAS-Prompt-User, Cisco-AVPair == 'shell:priv-lvl=15', User-Name = tmb I see that both sockets have been bound: netstat -l -n | grep 181 udp 0 0 10.0.0.1:1812 0.0.0.0:* udp 0 0 10.0.0.1:1813 0.0.0.0:* I have AAA and RADIUS debugging enabled but it is not showing me anything. Core-3550-EMI-1#show debugging Load for five secs: 0%/0%; one minute: 0%; five minutes: 0% Time source is NTP, 22:34:52.993 Eastern Sun Apr 27 2025 General OS: AAA Accounting debugging is on Radius protocol debugging is on Radius packet protocol (accounting) debugging is on show log: 000621: Apr 27 22:34:09.147 Eastern: AAA/ACCT/EXEC(00000006): Pick method list 'default' 000622: Apr 27 22:34:09.147 Eastern: AAA/ACCT/SETMLIST(00000006): Handle 0, mlist 0250E700, Name default 000623: Apr 27 22:34:09.147 Eastern: Getting session id for EXEC(00000006) : db=23DA658 000624: Apr 27 22:34:09.147 Eastern: AAA/ACCT/EXEC(00000006): add, count 2 000625: Apr 27 22:34:09.147 Eastern: AAA/ACCT/EVENT/(00000006): EXEC UP 000626: Apr 27 22:34:09.151 Eastern: AAA/ACCT/EXEC(00000006): Queueing record is START 000627: Apr 27 22:34:09.151 Eastern: AAA/ACCT(00000006): Accounting method=radius (RADIUS) 000663: Apr 27 22:34:28.107 Eastern: AAA/ACCT/EXEC(00000006): START protocol reply FAIL 000664: Apr 27 22:34:28.107 Eastern: AAA/ACCT(00000006): Accounting method=NOT_SET 000631: Apr 27 22:34:09.151 Eastern: RADIUS/ENCODE: Best Local IP-Address 10.1.1.1 for Radius-Server 10.0.0.1 000632: Apr 27 22:34:09.151 Eastern: RADIUS(00000006): Send Accounting-Request to 10.0.0.1:1813 id 1646/11, len 90 000633: Apr 27 22:34:09.151 Eastern: RADIUS: authenticator 3A F3 6C 4B 06 17 9B 41 - 77 74 DB 8A 2E 94 2D 6C 000634: Apr 27 22:34:09.151 Eastern: RADIUS: Acct-Session-Id [44] 10 "00000006" 000635: Apr 27 22:34:09.151 Eastern: RADIUS: User-Name [1] 5 "tmb" 000636: Apr 27 22:34:09.151 Eastern: RADIUS: Acct-Authentic [45] 6 RADIUS [1] 000637: Apr 27 22:34:09.155 Eastern: RADIUS: Acct-Status-Type [40] 6 Start [1] 000638: Apr 27 22:34:09.155 Eastern: RADIUS: NAS-Port [5] 6 0 000639: Apr 27 22:34:09.155 Eastern: RADIUS: NAS-Port-Id [87] 6 "tty0" 000640: Apr 27 22:34:09.155 Eastern: RADIUS: NAS-Port-Type [61] 6 Async [0] 000641: Apr 27 22:34:09.155 Eastern: RADIUS: Calling-Station-Id [31] 7 "async" 000642: Apr 27 22:34:09.155 Eastern: RADIUS: Service-Type [6] 6 NAS Prompt [7] 000643: Apr 27 22:34:09.155 Eastern: RADIUS: NAS-IP-Address [4] 6 10.1.1.1 000644: Apr 27 22:34:09.155 Eastern: RADIUS: Acct-Delay-Time [41] 6 0 000645: Apr 27 22:34:09.155 Eastern: RADIUS(00000006): Started 5 sec timeout 000646: Apr 27 22:34:13.771 Eastern: RADIUS(00000006): Request timed out 000647: Apr 27 22:34:13.771 Eastern: RADIUS: acct-delay-time for 800043CC (at 80004420) now 4 000648: Apr 27 22:34:13.771 Eastern: RADIUS: Retransmit to (10.0.0.1:1812,1813) for id 1646/11 000649: Apr 27 22:34:13.771 Eastern: RADIUS(00000006): Started 5 sec timeout 000650: Apr 27 22:34:18.795 Eastern: RADIUS(00000006): Request timed out 000651: Apr 27 22:34:18.795 Eastern: RADIUS: acct-delay-time for 800043CC (at 80004420) now 9 000652: Apr 27 22:34:18.795 Eastern: RADIUS: Retransmit to (10.0.0.1:1812,1813) for id 1646/11 000653: Apr 27 22:34:18.795 Eastern: RADIUS(00000006): Started 5 sec timeout 000654: Apr 27 22:34:23.403 Eastern: RADIUS(00000006): Request timed out 000655: Apr 27 22:34:23.403 Eastern: RADIUS: acct-delay-time for 800043CC (at 80004420) now 14 000656: Apr 27 22:34:23.403 Eastern: RADIUS: Retransmit to (10.0.0.1:1812,1813) for id 1646/11 000657: Apr 27 22:34:23.403 Eastern: RADIUS(00000006): Started 5 sec timeout 000658: Apr 27 22:34:28.107 Eastern: RADIUS(00000006): Request timed out 000659: Apr 27 22:34:28.107 Eastern: RADIUS: acct-delay-time for 800043CC (at 80004420) now 18 000660: Apr 27 22:34:28.107 Eastern: RADIUS: No response from (10.0.0.1:1812,1813) for id 1646/11 000661: Apr 27 22:34:28.107 Eastern: RADIUS/DECODE: parse response no app start; FAIL 000662: Apr 27 22:34:28.107 Eastern: RADIUS/DECODE: parse response; FAIL 000765: Apr 27 22:43:56.532 Eastern: RADIUS: acct-delay-time for 80002DEC (at 80002E40) now 4 000766: Apr 27 22:43:56.532 Eastern: RADIUS: Retransmit to (10.0.0.1:1812,1813) for id 1646/13 000767: Apr 27 22:43:56.532 Eastern: RADIUS(00000007): Started 5 sec timeout Any ideas are appreciated! Thanks Tim -- ⢀⣴⠾⠻⢶⣦⠀ ⣾⠁⢠⠒⠀⣿⡁ Debian - The universal operating system ⢿⡄⠘⠷⠚⠋⠀ https://www.debian.org/ ⠈⠳⣄⠀⠀
On Sun, Apr 27, 2025 at 10:45 PM Timothy M Butterworth < timothy.m.butterworth@gmail.com> wrote:
Hello,
I am trying to set up accounting to log commands entered into a switch. What log file will FreeRADIUS log the accounting commands too?
Here is my config:
Cisco 3550-EMI username tmb privilege 15 secret 5 <Removed>
aaa new-model
aaa authentication login default group radius local aaa authorization exec default group radius if-authenticated local aaa accounting exec default start-stop group radius aaa accounting commands 1 default stop-only group radius
aaa session-id common
ip radius source-interface Vlan60 radius-server host 10.0.0.1 auth-port 1812 acct-port 1813 radius-server key 7 <Removed>
FreeRADIUS Config: ### Configure listening IP Socket sudo vim /usr/lib/systemd/system/freeradius.service ExecStart=/usr/sbin/freeradius -f $FREERADIUS_OPTIONS -i 10.0.0.1 -p 1812-1813
# Define Listening socket sudo vim /etc/freeradius/3.0/radiusd.conf
listen { ipv4addr = 10.0.0.1, port = 1812, type = auth }
listen { ipv4addr = 10.0.0.1, port = 1813, type = acct }
### Free RADIUS Configuration sudo vim /etc/freeradius/3.0/clients.conf
client 10.0.0.0/8 { ipv4addr = 10.0.0.0/8 secret = FreeRadiusSecret#1 nastype = cisco shortname = Butter.net }
### FreeRADIUS User Config sudo vim /etc/freeradius/3.0/users
tmb Cleartext-Password := "620978" Service-Type = NAS-Prompt-User, Cisco-AVPair = "shell:priv-lvl=15"
# FreeRADIUS group config
DEFAULT Group == "cisco-rw" Service-Type = NAS-Prompt-User, Cisco-AVPair == 'shell:priv-lvl=15', User-Name = tmb
I see that both sockets have been bound: netstat -l -n | grep 181 udp 0 0 10.0.0.1:1812 0.0.0.0:*
udp 0 0 10.0.0.1:1813 0.0.0.0:*
I have AAA and RADIUS debugging enabled but it is not showing me anything. Core-3550-EMI-1#show debugging Load for five secs: 0%/0%; one minute: 0%; five minutes: 0% Time source is NTP, 22:34:52.993 Eastern Sun Apr 27 2025
General OS: AAA Accounting debugging is on
Radius protocol debugging is on Radius packet protocol (accounting) debugging is on
show log: 000621: Apr 27 22:34:09.147 Eastern: AAA/ACCT/EXEC(00000006): Pick method list 'default' 000622: Apr 27 22:34:09.147 Eastern: AAA/ACCT/SETMLIST(00000006): Handle 0, mlist 0250E700, Name default 000623: Apr 27 22:34:09.147 Eastern: Getting session id for EXEC(00000006) : db=23DA658 000624: Apr 27 22:34:09.147 Eastern: AAA/ACCT/EXEC(00000006): add, count 2 000625: Apr 27 22:34:09.147 Eastern: AAA/ACCT/EVENT/(00000006): EXEC UP 000626: Apr 27 22:34:09.151 Eastern: AAA/ACCT/EXEC(00000006): Queueing record is START 000627: Apr 27 22:34:09.151 Eastern: AAA/ACCT(00000006): Accounting method=radius (RADIUS) 000663: Apr 27 22:34:28.107 Eastern: AAA/ACCT/EXEC(00000006): START protocol reply FAIL 000664: Apr 27 22:34:28.107 Eastern: AAA/ACCT(00000006): Accounting method=NOT_SET
000631: Apr 27 22:34:09.151 Eastern: RADIUS/ENCODE: Best Local IP-Address 10.1.1.1 for Radius-Server 10.0.0.1 000632: Apr 27 22:34:09.151 Eastern: RADIUS(00000006): Send Accounting-Request to 10.0.0.1:1813 id 1646/11, len 90 000633: Apr 27 22:34:09.151 Eastern: RADIUS: authenticator 3A F3 6C 4B 06 17 9B 41 - 77 74 DB 8A 2E 94 2D 6C 000634: Apr 27 22:34:09.151 Eastern: RADIUS: Acct-Session-Id [44] 10 "00000006" 000635: Apr 27 22:34:09.151 Eastern: RADIUS: User-Name [1] 5 "tmb" 000636: Apr 27 22:34:09.151 Eastern: RADIUS: Acct-Authentic [45] 6 RADIUS [1] 000637: Apr 27 22:34:09.155 Eastern: RADIUS: Acct-Status-Type [40] 6 Start [1] 000638: Apr 27 22:34:09.155 Eastern: RADIUS: NAS-Port [5] 6 0 000639: Apr 27 22:34:09.155 Eastern: RADIUS: NAS-Port-Id [87] 6 "tty0" 000640: Apr 27 22:34:09.155 Eastern: RADIUS: NAS-Port-Type [61] 6 Async [0] 000641: Apr 27 22:34:09.155 Eastern: RADIUS: Calling-Station-Id [31] 7 "async" 000642: Apr 27 22:34:09.155 Eastern: RADIUS: Service-Type [6] 6 NAS Prompt [7] 000643: Apr 27 22:34:09.155 Eastern: RADIUS: NAS-IP-Address [4] 6 10.1.1.1 000644: Apr 27 22:34:09.155 Eastern: RADIUS: Acct-Delay-Time [41] 6 0 000645: Apr 27 22:34:09.155 Eastern: RADIUS(00000006): Started 5 sec timeout 000646: Apr 27 22:34:13.771 Eastern: RADIUS(00000006): Request timed out 000647: Apr 27 22:34:13.771 Eastern: RADIUS: acct-delay-time for 800043CC (at 80004420) now 4 000648: Apr 27 22:34:13.771 Eastern: RADIUS: Retransmit to (10.0.0.1:1812,1813) for id 1646/11 000649: Apr 27 22:34:13.771 Eastern: RADIUS(00000006): Started 5 sec timeout 000650: Apr 27 22:34:18.795 Eastern: RADIUS(00000006): Request timed out 000651: Apr 27 22:34:18.795 Eastern: RADIUS: acct-delay-time for 800043CC (at 80004420) now 9 000652: Apr 27 22:34:18.795 Eastern: RADIUS: Retransmit to (10.0.0.1:1812,1813) for id 1646/11 000653: Apr 27 22:34:18.795 Eastern: RADIUS(00000006): Started 5 sec timeout 000654: Apr 27 22:34:23.403 Eastern: RADIUS(00000006): Request timed out 000655: Apr 27 22:34:23.403 Eastern: RADIUS: acct-delay-time for 800043CC (at 80004420) now 14 000656: Apr 27 22:34:23.403 Eastern: RADIUS: Retransmit to (10.0.0.1:1812,1813) for id 1646/11 000657: Apr 27 22:34:23.403 Eastern: RADIUS(00000006): Started 5 sec timeout 000658: Apr 27 22:34:28.107 Eastern: RADIUS(00000006): Request timed out 000659: Apr 27 22:34:28.107 Eastern: RADIUS: acct-delay-time for 800043CC (at 80004420) now 18 000660: Apr 27 22:34:28.107 Eastern: RADIUS: No response from ( 10.0.0.1:1812,1813) for id 1646/11 000661: Apr 27 22:34:28.107 Eastern: RADIUS/DECODE: parse response no app start; FAIL 000662: Apr 27 22:34:28.107 Eastern: RADIUS/DECODE: parse response; FAIL
000765: Apr 27 22:43:56.532 Eastern: RADIUS: acct-delay-time for 80002DEC (at 80002E40) now 4 000766: Apr 27 22:43:56.532 Eastern: RADIUS: Retransmit to (10.0.0.1:1812,1813) for id 1646/13 000767: Apr 27 22:43:56.532 Eastern: RADIUS(00000007): Started 5 sec timeout
Any ideas are appreciated!
I did a packet capture and I see the switch attempting to start the accounting session. sudo tshark -f 'port 1813' -n -i enx00e04c680daa Capturing on 'enx00e04c680daa' 1 0.000000000 10.1.1.1 → 10.0.0.1 RADIUS 132 Accounting-Request id=1 2 4.407728279 10.1.1.1 → 10.0.0.1 RADIUS 132 Accounting-Request id=1 3 9.431961736 10.1.1.1 → 10.0.0.1 RADIUS 132 Accounting-Request id=1 4 14.080108520 10.1.1.1 → 10.0.0.1 RADIUS 132 Accounting-Request id=1
Thanks
Tim
-- ⢀⣴⠾⠻⢶⣦⠀ ⣾⠁⢠⠒⠀⣿⡁ Debian - The universal operating system ⢿⡄⠘⠷⠚⠋⠀ https://www.debian.org/ ⠈⠳⣄⠀⠀
On Apr 27, 2025, at 10:45 PM, Timothy M Butterworth <timothy.m.butterworth@gmail.com> wrote:
I am trying to set up accounting to log commands entered into a switch. What log file will FreeRADIUS log the accounting commands too?
Read the configuration for the "default" virtual server. Or, run it in debugging mode, and see what files it uses.
Here is my config:
So, you've posted Cisco configuration, tiny bits of FreeRADIUS configuration, commands you ran, and packet dumps. Perhaps try posting the FreeRADIUS debug output as suggested by ALL of the documentation, including the message you get when you join the list? http://wiki.freeradius <http://wiki.freeradius/>.org/list-help We write the documentation to help people solve problems. If you ignore the documentation, it becomes very difficult to solve problems. Alan DeKok.
On Mon, Apr 28, 2025 at 10:23 AM Alan DeKok <aland@deployingradius.com> wrote:
On Apr 27, 2025, at 10:45 PM, Timothy M Butterworth < timothy.m.butterworth@gmail.com> wrote:
I am trying to set up accounting to log commands entered into a switch. What log file will FreeRADIUS log the accounting commands too?
Read the configuration for the "default" virtual server. Or, run it in debugging mode, and see what files it uses.
Here is my config:
So, you've posted Cisco configuration, tiny bits of FreeRADIUS configuration, commands you ran, and packet dumps.
Perhaps try posting the FreeRADIUS debug output as suggested by ALL of the documentation, including the message you get when you join the list?
http://wiki.freeradius <http://wiki.freeradius/>.org/list-help
We write the documentation to help people solve problems. If you ignore the documentation, it becomes very difficult to solve problems.
Alan DeKok.
Debug Output: (0) Received Access-Request Id 1 from 10.1.1.1:1645 to 10.0.0.1:1812 length 74 (0) User-Name = "tmb" (0) User-Password = "620978" (0) NAS-Port = 0 (0) NAS-Port-Id = "tty0" (0) NAS-Port-Type = Async (0) Calling-Station-Id = "async" (0) NAS-IP-Address = 10.1.1.1 (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /@\./) { (0) if (&User-Name =~ /@\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "tmb", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) files: users: Matched entry tmb at line 87 (0) files: EXPAND Hello, %{User-Name} (0) files: --> Hello, tmb (0) [files] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known good" Cleartext-Password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (0) post-auth { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name )) { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name )) -> FALSE (0) update { (0) No attributes updated for RHS &session-state: (0) } # update = noop (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) if (EAP-Key-Name && &reply:EAP-Session-Id) { (0) if (EAP-Key-Name && &reply:EAP-Session-Id) -> FALSE (0) } # post-auth = noop (0) Sent Access-Accept Id 1 from 10.0.0.1:1812 to 10.1.1.1:1645 length 81 (0) Service-Type = NAS-Prompt-User (0) Cisco-AVPair = "shell:priv-lvl=15" (0) Reply-Message = "Hello, tmb" (0) Finished request Waking up in 4.9 seconds. (1) Received Accounting-Request Id 1 from 10.1.1.1:1646 to 10.0.0.1:1813 length 90 (1) Acct-Session-Id = "00000001" (1) User-Name = "tmb" (1) Acct-Authentic = RADIUS (1) Acct-Status-Type = Start (1) NAS-Port = 0 (1) NAS-Port-Id = "tty0" (1) NAS-Port-Type = Async (1) Calling-Station-Id = "async" (1) Service-Type = NAS-Prompt-User (1) NAS-IP-Address = 10.1.1.1 (1) Acct-Delay-Time = 0 (1) Not sending reply to client. (1) Finished request (1) Cleaning up request packet ID 1 with timestamp +236 due to done Waking up in 4.9 seconds. (2) Received Accounting-Request Id 1 from 10.1.1.1:1646 to 10.0.0.1:1813 length 90 (2) Acct-Session-Id = "00000001" (2) User-Name = "tmb" (2) Acct-Authentic = RADIUS (2) Acct-Status-Type = Start (2) NAS-Port = 0 (2) NAS-Port-Id = "tty0" (2) NAS-Port-Type = Async (2) Calling-Station-Id = "async" (2) Service-Type = NAS-Prompt-User (2) NAS-IP-Address = 10.1.1.1 (2) Acct-Delay-Time = 4 (2) Not sending reply to client. (2) Finished request (2) Cleaning up request packet ID 1 with timestamp +240 due to done Waking up in 0.5 seconds. (0) Cleaning up request packet ID 1 with timestamp +236 due to cleanup_delay was reached Ready to process requests (3) Received Accounting-Request Id 1 from 10.1.1.1:1646 to 10.0.0.1:1813 length 90 (3) Acct-Session-Id = "00000001" (3) User-Name = "tmb" (3) Acct-Authentic = RADIUS (3) Acct-Status-Type = Start (3) NAS-Port = 0 (3) NAS-Port-Id = "tty0" (3) NAS-Port-Type = Async (3) Calling-Station-Id = "async" (3) Service-Type = NAS-Prompt-User (3) NAS-IP-Address = 10.1.1.1 (3) Acct-Delay-Time = 9 (3) Not sending reply to client. (3) Finished request (3) Cleaning up request packet ID 1 with timestamp +245 due to done Ready to process requests (4) Received Accounting-Request Id 1 from 10.1.1.1:1646 to 10.0.0.1:1813 length 90 (4) Acct-Session-Id = "00000001" (4) User-Name = "tmb" (4) Acct-Authentic = RADIUS (4) Acct-Status-Type = Start (4) NAS-Port = 0 (4) NAS-Port-Id = "tty0" (4) NAS-Port-Type = Async (4) Calling-Station-Id = "async" (4) Service-Type = NAS-Prompt-User (4) NAS-IP-Address = 10.1.1.1 (4) Acct-Delay-Time = 14 (4) Not sending reply to client. (4) Finished request (4) Cleaning up request packet ID 1 with timestamp +250 due to done Ready to process requests
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- ⢀⣴⠾⠻⢶⣦⠀ ⣾⠁⢠⠒⠀⣿⡁ Debian - The universal operating system ⢿⡄⠘⠷⠚⠋⠀ https://www.debian.org/ ⠈⠳⣄⠀⠀
On Apr 28, 2025, at 10:52 AM, Timothy M Butterworth <timothy.m.butterworth@gmail.com> wrote:
Debug Output: ... (2) Received Accounting-Request Id 1 from 10.1.1.1:1646 to 10.0.0.1:1813 length 90 (2) Acct-Session-Id = "00000001" (2) User-Name = "tmb" (2) Acct-Authentic = RADIUS (2) Acct-Status-Type = Start (2) NAS-Port = 0 (2) NAS-Port-Id = "tty0" (2) NAS-Port-Type = Async (2) Calling-Station-Id = "async" (2) Service-Type = NAS-Prompt-User (2) NAS-IP-Address = 10.1.1.1 (2) Acct-Delay-Time = 4 (2) Not sending reply to client. (2) Finished request (2) Cleaning up request packet ID 1 with timestamp +240 due to done Waking up in 0.5 seconds.
You deleted the entire server configuration related to accounting. Why? Use the default configuration. It works. Or, read the default configuration (as I suggested) to see where it logs data, and why. Then, configure it to do what you want. It is completely unproductive to install software, ignore the documentation, destroy the configuration, and then be surprised when it doesn't work. I suggest a different approach. Alan DeKok.
On Mon, Apr 28, 2025 at 11:08 AM Alan DeKok <aland@deployingradius.com> wrote:
On Apr 28, 2025, at 10:52 AM, Timothy M Butterworth < timothy.m.butterworth@gmail.com> wrote:
Debug Output: ... (2) Received Accounting-Request Id 1 from 10.1.1.1:1646 to 10.0.0.1:1813 length 90 (2) Acct-Session-Id = "00000001" (2) User-Name = "tmb" (2) Acct-Authentic = RADIUS (2) Acct-Status-Type = Start (2) NAS-Port = 0 (2) NAS-Port-Id = "tty0" (2) NAS-Port-Type = Async (2) Calling-Station-Id = "async" (2) Service-Type = NAS-Prompt-User (2) NAS-IP-Address = 10.1.1.1 (2) Acct-Delay-Time = 4 (2) Not sending reply to client. (2) Finished request (2) Cleaning up request packet ID 1 with timestamp +240 due to done Waking up in 0.5 seconds.
You deleted the entire server configuration related to accounting.
Why?
Use the default configuration. It works.
Or, read the default configuration (as I suggested) to see where it logs data, and why. Then, configure it to do what you want.
It is completely unproductive to install software, ignore the documentation, destroy the configuration, and then be surprised when it doesn't work.
I did not destroy the configuration. I am using the Debian default config plus the additions I made and posted above. Attached is the full config files.
I suggest a different approach.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- ⢀⣴⠾⠻⢶⣦⠀ ⣾⠁⢠⠒⠀⣿⡁ Debian - The universal operating system ⢿⡄⠘⠷⠚⠋⠀ https://www.debian.org/ ⠈⠳⣄⠀⠀
On Apr 28, 2025, at 11:58 AM, Timothy M Butterworth <timothy.m.butterworth@gmail.com> wrote:
I did not destroy the configuration. I am using the Debian default config plus the additions I made and posted above. Attached is the full config files.
As per the documentation: http://wiki.freeradius.org/list-help We do not need to see the configuration files. We DO need to see the debug output. ALL OF THE DEBUG OUTPUT. When the documentation says "post all of it and don't edit it", what that means is "post all of it and don't edit it". Plus, the debug output you posted makes it VERY clear that you edited the file sites-available/default, and removed everything related to accounting. Just read what you posted to the list. You will see: * receiving Access-Request * processing the Access-Request through all kinds of configuration, modules, etc. * replying to the Access-Request Then for accounting: * receiving Accounting-Request * nothing happens * no reply is sent to the client. Conclusion: you edited sites-available/default, and removed everything related to accounting. The debug output doesn't lie. Now stop arguing, and go fix the configuration. Use the default configuration. It works. Alan DeKok.
On Mon, Apr 28, 2025 at 12:19 PM Alan DeKok <aland@deployingradius.com> wrote:
On Apr 28, 2025, at 11:58 AM, Timothy M Butterworth < timothy.m.butterworth@gmail.com> wrote:
I did not destroy the configuration. I am using the Debian default config plus the additions I made and posted above. Attached is the full config files.
As per the documentation: http://wiki.freeradius.org/list-help
We do not need to see the configuration files.
We DO need to see the debug output.
ALL OF THE DEBUG OUTPUT.
When the documentation says "post all of it and don't edit it", what that means is "post all of it and don't edit it".
Plus, the debug output you posted makes it VERY clear that you edited the file sites-available/default, and removed everything related to accounting.
Just read what you posted to the list. You will see:
* receiving Access-Request * processing the Access-Request through all kinds of configuration, modules, etc. * replying to the Access-Request
Then for accounting:
* receiving Accounting-Request * nothing happens * no reply is sent to the client.
Conclusion: you edited sites-available/default, and removed everything related to accounting. The debug output doesn't lie.
I did not delete anything from sites available. I just edited the IP address and port as I previously did not modify this file. # This second "listen" section is for listening on the accounting # port, too. # listen { ipaddr = 10.0.0.1 # ipv6addr = :: port = 1813 type = acct # interface = eth0 # clients = per_socket_clients limit { # The number of packets received can be rate limited via the # "max_pps" configuration item. When it is set, the server # tracks the total number of packets received in the previous # second. If the count is greater than "max_pps", then the # new packet is silently discarded. This helps the server # deal with overload situations. # # The packets/s counter is tracked in a sliding window. This # means that the pps calculation is done for the second # before the current packet was received. NOT for the current # wall-clock second, and NOT for the previous wall-clock second. # # Useful values are 0 (no limit), or 100 to 10000. # Values lower than 100 will likely cause the server to ignore # normal traffic. Few systems are capable of handling more than # 10K packets/s. # # It is most useful for accounting systems. Set it to 50% # more than the normal accounting load, and you can be sure that # the server will never get overloaded # # max_pps = 0 # Only for "proto = tcp". These are ignored for "udp" sockets. # # idle_timeout = 0 # lifetime = 0 # max_connections = 0 } }
Now stop arguing, and go fix the configuration. Use the default configuration. It works.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- ⢀⣴⠾⠻⢶⣦⠀ ⣾⠁⢠⠒⠀⣿⡁ Debian - The universal operating system ⢿⡄⠘⠷⠚⠋⠀ https://www.debian.org/ ⠈⠳⣄⠀⠀
On Mon, Apr 28, 2025 at 12:19 PM Alan DeKok <aland@deployingradius.com> wrote:
On Apr 28, 2025, at 11:58 AM, Timothy M Butterworth < timothy.m.butterworth@gmail.com> wrote:
I did not destroy the configuration. I am using the Debian default config plus the additions I made and posted above. Attached is the full config files.
As per the documentation: http://wiki.freeradius.org/list-help
We do not need to see the configuration files.
We DO need to see the debug output.
ALL OF THE DEBUG OUTPUT.
When the documentation says "post all of it and don't edit it", what that means is "post all of it and don't edit it".
Plus, the debug output you posted makes it VERY clear that you edited the file sites-available/default, and removed everything related to accounting.
here is the complete debug: (0) Received Access-Request Id 1 from 10.1.1.1:1645 to 10.0.0.1:1812 length 74 (0) User-Name = "tmb" (0) User-Password = "620978" (0) NAS-Port = 0 (0) NAS-Port-Id = "tty0" (0) NAS-Port-Type = Async (0) Calling-Station-Id = "async" (0) NAS-IP-Address = 10.1.1.1 (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /@\./) { (0) if (&User-Name =~ /@\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "tmb", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) files: users: Matched entry tmb at line 87 (0) files: EXPAND Hello, %{User-Name} (0) files: --> Hello, tmb (0) [files] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known good" Cleartext-Password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (0) post-auth { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name )) { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name )) -> FALSE (0) update { (0) No attributes updated for RHS &session-state: (0) } # update = noop (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) if (EAP-Key-Name && &reply:EAP-Session-Id) { (0) if (EAP-Key-Name && &reply:EAP-Session-Id) -> FALSE (0) } # post-auth = noop (0) Sent Access-Accept Id 1 from 10.0.0.1:1812 to 10.1.1.1:1645 length 81 (0) Service-Type = NAS-Prompt-User (0) Cisco-AVPair = "shell:priv-lvl=15" (0) Reply-Message = "Hello, tmb" (0) Finished request Waking up in 4.9 seconds. (1) Received Accounting-Request Id 1 from 10.1.1.1:1646 to 10.0.0.1:1813 length 90 (1) Acct-Session-Id = "00000001" (1) User-Name = "tmb" (1) Acct-Authentic = RADIUS (1) Acct-Status-Type = Start (1) NAS-Port = 0 (1) NAS-Port-Id = "tty0" (1) NAS-Port-Type = Async (1) Calling-Station-Id = "async" (1) Service-Type = NAS-Prompt-User (1) NAS-IP-Address = 10.1.1.1 (1) Acct-Delay-Time = 0 (1) Not sending reply to client. (1) Finished request (1) Cleaning up request packet ID 1 with timestamp +203 due to done Waking up in 4.9 seconds. (2) Received Accounting-Request Id 1 from 10.1.1.1:1646 to 10.0.0.1:1813 length 90 (2) Acct-Session-Id = "00000001" (2) User-Name = "tmb" (2) Acct-Authentic = RADIUS (2) Acct-Status-Type = Start (2) NAS-Port = 0 (2) NAS-Port-Id = "tty0" (2) NAS-Port-Type = Async (2) Calling-Station-Id = "async" (2) Service-Type = NAS-Prompt-User (2) NAS-IP-Address = 10.1.1.1 (2) Acct-Delay-Time = 4 (2) Not sending reply to client. (2) Finished request (2) Cleaning up request packet ID 1 with timestamp +207 due to done Waking up in 0.7 seconds. (0) Cleaning up request packet ID 1 with timestamp +203 due to cleanup_delay was reached Ready to process requests (3) Received Accounting-Request Id 1 from 10.1.1.1:1646 to 10.0.0.1:1813 length 90 (3) Acct-Session-Id = "00000001" (3) User-Name = "tmb" (3) Acct-Authentic = RADIUS (3) Acct-Status-Type = Start (3) NAS-Port = 0 (3) NAS-Port-Id = "tty0" (3) NAS-Port-Type = Async (3) Calling-Station-Id = "async" (3) Service-Type = NAS-Prompt-User (3) NAS-IP-Address = 10.1.1.1 (3) Acct-Delay-Time = 9 (3) Not sending reply to client. (3) Finished request (3) Cleaning up request packet ID 1 with timestamp +212 due to done Ready to process requests (4) Received Accounting-Request Id 1 from 10.1.1.1:1646 to 10.0.0.1:1813 length 90 (4) Acct-Session-Id = "00000001" (4) User-Name = "tmb" (4) Acct-Authentic = RADIUS (4) Acct-Status-Type = Start (4) NAS-Port = 0 (4) NAS-Port-Id = "tty0" (4) NAS-Port-Type = Async (4) Calling-Station-Id = "async" (4) Service-Type = NAS-Prompt-User (4) NAS-IP-Address = 10.1.1.1 (4) Acct-Delay-Time = 14 (4) Not sending reply to client. (4) Finished request (4) Cleaning up request packet ID 1 with timestamp +217 due to done Ready to process requests
Just read what you posted to the list. You will see:
* receiving Access-Request * processing the Access-Request through all kinds of configuration, modules, etc. * replying to the Access-Request
Then for accounting:
* receiving Accounting-Request * nothing happens * no reply is sent to the client.
Conclusion: you edited sites-available/default, and removed everything related to accounting. The debug output doesn't lie.
Now stop arguing, and go fix the configuration. Use the default configuration. It works.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- ⢀⣴⠾⠻⢶⣦⠀ ⣾⠁⢠⠒⠀⣿⡁ Debian - The universal operating system ⢿⡄⠘⠷⠚⠋⠀ https://www.debian.org/ ⠈⠳⣄⠀⠀
On Mon, Apr 28, 2025 at 12:19 PM Alan DeKok <aland@deployingradius.com> wrote:
On Apr 28, 2025, at 11:58 AM, Timothy M Butterworth < timothy.m.butterworth@gmail.com> wrote:
I did not destroy the configuration. I am using the Debian default config plus the additions I made and posted above. Attached is the full config files.
As per the documentation: http://wiki.freeradius.org/list-help
We do not need to see the configuration files.
We DO need to see the debug output.
ALL OF THE DEBUG OUTPUT.
When the documentation says "post all of it and don't edit it", what that means is "post all of it and don't edit it".
Plus, the debug output you posted makes it VERY clear that you edited the file sites-available/default, and removed everything related to accounting.
Just read what you posted to the list. You will see:
* receiving Access-Request * processing the Access-Request through all kinds of configuration, modules, etc. * replying to the Access-Request
Then for accounting:
* receiving Accounting-Request * nothing happens * no reply is sent to the client.
Conclusion: you edited sites-available/default, and removed everything related to accounting. The debug output doesn't lie.
Now stop arguing, and go fix the configuration. Use the default configuration. It works.
Alan, Thanks for your help. I think I figured out what the root problem was. I installed freeradius-mysql by mistake. I purged all of the freeradius packages and reinstalled and now it works. Is there a way to get FreeRadius to log commands entered on a Cisco device? Right now I just get the following entries: Mon Apr 28 15:54:43 2025 Acct-Session-Id = "<Removed>" User-Name = "tmb" Acct-Authentic = RADIUS Acct-Terminate-Cause = User-Request Acct-Session-Time = 387 Acct-Status-Type = Stop NAS-Port = 0 NAS-Port-Id = "tty0" NAS-Port-Type = Async Calling-Station-Id = "async" Service-Type = NAS-Prompt-User NAS-IP-Address = 10.1.1.1 Acct-Delay-Time = 0 Event-Timestamp = "Apr 28 2025 15:54:43 EDT" Acct-Unique-Session-Id = "<Removed>" Timestamp = 1745870083 <http://voice.google.com/calls?a=nc,%2B11745870083> Thanks, Tim
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- ⢀⣴⠾⠻⢶⣦⠀ ⣾⠁⢠⠒⠀⣿⡁ Debian - The universal operating system ⢿⡄⠘⠷⠚⠋⠀ https://www.debian.org/ ⠈⠳⣄⠀⠀
On Apr 28, 2025, at 4:22 PM, Timothy M Butterworth <timothy.m.butterworth@gmail.com> wrote:
Thanks for your help. I think I figured out what the root problem was. I installed freeradius-mysql by mistake.
Installing that package doesn't edit sites-available/default and remove all accounting configuration. The only way the accounting configuration is deleted is if someone goes in and does it with a text editor.
I purged all of the freeradius packages and reinstalled and now it works.
i.e. you reverted the configuration to the default, as I had said at the start.
Is there a way to get FreeRadius to log commands entered on a Cisco device?
Does the Cisco device send accounting packets which log the commands entered? Perhaps read the Cisco documentation and see if there's a way to enable that behavior. Alan DeKok.
participants (2)
-
Alan DeKok -
Timothy M Butterworth