Freeradius 3.0.15 x OpenLDAP (auth) x MySQL (acct): Limit Simultaneous Use
Hi All, I am currently attempting to set up FreeRadius 3.x to limit simultaneous connection based on a User's LDAP Group. For example, people in the Employee LDAP Group get 2 connections. After extensive research, I have surmised the best way to do so is to use a SQL DB for Accounting, which I currently have all set up. Unless LDAP can be used for Accounting? As it stands, I can query how many active connections a User has (simul_count_query) from the radacct table of my local MySQL radius DB, so now I am trying to figure out how to *set* and *enforce* the Simultaneous-Use attribute. Where I am caught up is the LDAP x SQL interfacing regarding the Simultaneous-Use attribute. How and where does FreeRadius look for this attribute? Does this have to be in LDAP for the Group/User and FreeRadius queries for it or can I define within my FreeRadius configs somewhere? Most examples say to enforce it on a per-user basis by using the Users file, but what about SQL on a large scale? I've been scouring over the documentation with no luck. Again, LDAP is enabled and working. SQL Accounting is enabled and logging activity. Something I did notice was that radacct is NOT getting the groupname column when I run: *simul_count_query* Help will be much appreciated. Thanks, -- -- Jon
Hi, On 9/6/2018 6:41 PM, Jon Battista wrote:
As it stands, I can query how many active connections a User has (simul_count_query) from the radacct table of my local MySQL radius DB, so now I am trying to figure out how to *set* and *enforce* the Simultaneous-Use attribute. Although we use SQL, we enforced a default value of that attribute in the users file by adding the following to the end of /etc/raddb/users
# don't allow users to log in more than once by default DEFAULT Simultaneous-Use := 1 Fall-Through = 1 Those settings allowed us to set a global default value for Simultaneous-Use for users who otherwise do not have Simultaneous-Use defined through a user attribute or a group attribute.
On Sep 6, 2018, at 9:41 PM, Jon Battista <jonbattista@gmail.com> wrote:
I am currently attempting to set up FreeRadius 3.x to limit simultaneous connection based on a User's LDAP Group. For example, people in the Employee LDAP Group get 2 connections.
After extensive research, I have surmised the best way to do so is to use a SQL DB for Accounting, which I currently have all set up. Unless LDAP can be used for Accounting?
No.
As it stands, I can query how many active connections a User has (simul_count_query) from the radacct table of my local MySQL radius DB, so now I am trying to figure out how to *set* and *enforce* the Simultaneous-Use attribute.
You set the Simultaneous-Use attribute, and the server does the enforcement. https://wiki.freeradius.org/guide/SQL%20HOWTO Look for "Simultaneous-Use"
Where I am caught up is the LDAP x SQL interfacing regarding the Simultaneous-Use attribute.
How and where does FreeRadius look for this attribute?
You set it when the user is logging in. e.g. when the server receives an Access-Request packet. You can set it just like any other attribute.
Does this have to be in LDAP for the Group/User and FreeRadius queries for it
That can work.
or can I define within my FreeRadius configs somewhere?
That can work, too. It all depends what you want.
Most examples say to enforce it on a per-user basis by using the Users file, but what about SQL on a large scale?
It can be set in SQL, too. Are you using SQL for other authorization? If not, don't set it there. Set it in LDAP, or set it in another place.
I've been scouring over the documentation with no luck. Again, LDAP is enabled and working. SQL Accounting is enabled and logging activity. Something I did notice was that radacct is NOT getting the groupname column when I run: *simul_count_query*
The groupname column in radacct isn't used. Alan DeKok.
Thanks for the replies,
As it stands, I can query how many active connections a User has
(simul_count_query) from the radacct table of my local MySQL radius DB, so now I am trying to figure out how to *set* and *enforce* the Simultaneous-Use attribute. You set the Simultaneous-Use attribute, and the server does the enforcement. https://wiki.freeradius.org/guide/SQL%20HOWTO Look for "Simultaneous-Use"
All that doc says to do is have SQL in the Session section. It doesn't say where to define the Simultaneous-Use attribute.
Where I am caught up is the LDAP x SQL interfacing regarding the
Simultaneous-Use attribute.
How and where does FreeRadius look for this attribute? You set it when the user is logging in. e.g. when the server receives an Access-Request packet. You can set it just like any other attribute.
I have defined the Simultaneous-Use attribute in my Users file like so: DEFAULT LDAP-Group == "Squad" Auth-Type := Accept, Simultaneous-Use := 1
Does this have to be in LDAP for the Group/User and FreeRadius queries for it That can work.
or can I define within my FreeRadius configs somewhere? That can work, too. It all depends what you want.
If I can define it in the FreeRadius configs, such as the Users file, that is fine.
Most examples say to enforce it on
a per-user basis by using the Users file, but what about SQL on a large scale? It can be set in SQL, too. Are you using SQL for other authorization? If not, don't set it there. Set it in LDAP, or set it in another place.
I am not using SQL for Authorization, just Accounting and Session. With the Simultaneous-Use attribute set in my User file, shouldn't FreeRadius check the auth from my User against the list of rules? Flagging positive for LDAP Group == "Squad" and then setting the Simultaneous-Use := 1. That is not working. How would I check to see if Simultaneous-Use was set properly? On Fri, Sep 7, 2018 at 4:06 AM Alan DeKok <aland@deployingradius.com> wrote:
On Sep 6, 2018, at 9:41 PM, Jon Battista <jonbattista@gmail.com> wrote:
I am currently attempting to set up FreeRadius 3.x to limit simultaneous connection based on a User's LDAP Group. For example, people in the Employee LDAP Group get 2 connections.
After extensive research, I have surmised the best way to do so is to use a SQL DB for Accounting, which I currently have all set up. Unless LDAP can be used for Accounting?
No.
As it stands, I can query how many active connections a User has (simul_count_query) from the radacct table of my local MySQL radius DB, so now I am trying to figure out how to *set* and *enforce* the Simultaneous-Use attribute.
You set the Simultaneous-Use attribute, and the server does the enforcement.
https://wiki.freeradius.org/guide/SQL%20HOWTO
Look for "Simultaneous-Use"
Where I am caught up is the LDAP x SQL interfacing regarding the Simultaneous-Use attribute.
How and where does FreeRadius look for this attribute?
You set it when the user is logging in. e.g. when the server receives an Access-Request packet.
You can set it just like any other attribute.
Does this have to be in LDAP for the Group/User and FreeRadius queries for it
That can work.
or can I define within my FreeRadius configs somewhere?
That can work, too. It all depends what you want.
Most examples say to enforce it on a per-user basis by using the Users file, but what about SQL on a large scale?
It can be set in SQL, too.
Are you using SQL for other authorization? If not, don't set it there. Set it in LDAP, or set it in another place.
I've been scouring over the documentation with no luck. Again, LDAP is enabled and working. SQL Accounting is enabled and logging activity. Something I did notice was that radacct is NOT getting the groupname column when I run: *simul_count_query*
The groupname column in radacct isn't used.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- -- Jon
On Sep 7, 2018, at 5:47 PM, Jon Battista <jonbattista@gmail.com> wrote:
All that doc says to do is have SQL in the Session section. It doesn't say where to define the Simultaneous-Use attribute.
Because as I said, it can be set anywhere.
I have defined the Simultaneous-Use attribute in my Users file like so: DEFAULT LDAP-Group == "Squad" Auth-Type := Accept, Simultaneous-Use := 1
No, that's wrong. You can't just invent syntax and expect it to work. You need to read the comments in the file you're editing. Or, the documentation for that file. Or, the debug output. The debug output *will* produce warnings that tell you the above entry is wrong. Alan DeKok.
I have defined the Simultaneous-Use attribute in my Users file like so: DEFAULT LDAP-Group == "Squad" Auth-Type := Accept, Simultaneous-Use := 1 No, that's wrong. You can't just invent syntax and expect it to work. You need to read the comments in the file you're editing. Or, the documentation for that file. Or, the debug output. The debug output *will* produce warnings that tell you the above entry is wrong.
Okay, I realized that after I responded. So I have the following set in my *user (mods-config/files/authorize)* file: DEFAULT Ldap-Group == "Squad", Simultaneous-Use := 1 Auth-Type := Accept What does setting this Check Item do exactly? Will it call *checkrad *which will query *radgroupcheck* to see if it has the following entry: |1 | dialup | Simultaneous-Use | := | 1| When is *simul_check_query* called? I've read through the comments. I am not sure what I am missing. Thanks, On Sat, Sep 8, 2018 at 5:49 AM Alan DeKok <aland@deployingradius.com> wrote:
On Sep 7, 2018, at 5:47 PM, Jon Battista <jonbattista@gmail.com> wrote:
All that doc says to do is have SQL in the Session section. It doesn't
say
where to define the Simultaneous-Use attribute.
Because as I said, it can be set anywhere.
I have defined the Simultaneous-Use attribute in my Users file like so: DEFAULT LDAP-Group == "Squad" Auth-Type := Accept, Simultaneous-Use := 1
No, that's wrong. You can't just invent syntax and expect it to work. You need to read the comments in the file you're editing. Or, the documentation for that file. Or, the debug output. The debug output *will* produce warnings that tell you the above entry is wrong.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- -- Jon
On Sep 10, 2018, at 6:48 PM, Jon Battista <jonbattista@gmail.com> wrote:
So I have the following set in my *user (mods-config/files/authorize)* file:
DEFAULT Ldap-Group == "Squad", Simultaneous-Use := 1 Auth-Type := Accept
Again, that's still wrong. The "Auth-Type" has to go on the first line, with the other check items. The subsequent lines are attributes for the reply. This is documented extensively in the server.
What does setting this Check Item do exactly?
It tells the server to limit the number of simultaneous logins that a user can have
Will it call *checkrad *which will query *radgroupcheck* to see if it has the following entry:
checkrad never calls radgroupcheck. If you want to know how Simultaneous-Use works, it's documented: https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/doc/configuratio...
|1 | dialup | Simultaneous-Use | := | 1|
When is *simul_check_query* called?
When necessary. Read the debug output to see.
I've read through the comments. I am not sure what I am missing.
The server comes with extensive man pages and other documentation. Reading just the comments isn't helpful. Alan DeKok.
On Sep 10, 2018, at 6:48 PM, Jon Battista <jonbattista@gmail.com> wrote:
So I have the following set in my *user (mods-config/files/authorize)* file:
DEFAULT Ldap-Group == "Squad", Simultaneous-Use := 1 Auth-Type := Accept Again, that's still wrong. The "Auth-Type" has to go on the first line, with the other check items. The subsequent lines are attributes for the reply. This is documented extensively in the server.
Okay, but freeradius still runs! It doesn't complain.
What does setting this Check Item do exactly? It tells the server to limit the number of simultaneous logins that a user can have
Will it call *checkrad *which will query *radgroupcheck* to see if it has the following entry: checkrad never calls radgroupcheck. If you want to know how Simultaneous-Use works, it's documented:
https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/doc/configuratio...
|1 | dialup | Simultaneous-Use | := | 1|
When is *simul_check_query* called?
When necessary. Read the debug output to see.
I've read through the comments. I am not sure what I am missing. The server comes with extensive man pages and other documentation. Reading just the comments isn't helpful.
I have been going back and forth over this documentation for days. I have seemingly done everything it says, yet there is no trace in my debug output that it is checking for simultaneous use. Is this syntax correct? DEFAULT Ldap-Group == "Squad", Simultaneous-Use := 1, Auth-Type := Accept cisco-avpair = "shell:priv-lvl=15", Tunnel-Medium-Type = 6, Tunnel-Private-Group-ID = 3, Tunnel-Type = VLAN Does there have to be an entry in radgroupcheck for my LDAP group "Squad" since I have set Simultaneous-Use := 1 in my user file? Again, I have looked over all the documentation. My debug output has nothing about Simultaneous-Use in it. Accounting is enabled on my Wireless Controller. SQL is set for accounting and session in sites-enabled/default. All authentications are logged in the radacct table of my MySQL DB. Even if I explicitly set the attribute for my user "service" in my user file (service Simultaneous-Use := 1) it doesnt work. It like it's not actually running the simul_check_query. How does the Session section play into all this? Thanks, On Mon, Sep 10, 2018 at 4:32 PM Alan DeKok <aland@deployingradius.com> wrote:
On Sep 10, 2018, at 6:48 PM, Jon Battista <jonbattista@gmail.com> wrote:
So I have the following set in my *user (mods-config/files/authorize)* file:
DEFAULT Ldap-Group == "Squad", Simultaneous-Use := 1 Auth-Type := Accept
Again, that's still wrong. The "Auth-Type" has to go on the first line, with the other check items.
The subsequent lines are attributes for the reply. This is documented extensively in the server.
What does setting this Check Item do exactly?
It tells the server to limit the number of simultaneous logins that a user can have
Will it call *checkrad *which will query *radgroupcheck* to see if it has the following entry:
checkrad never calls radgroupcheck.
If you want to know how Simultaneous-Use works, it's documented:
https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/doc/configuratio...
|1 | dialup | Simultaneous-Use | := | 1|
When is *simul_check_query* called?
When necessary. Read the debug output to see.
I've read through the comments. I am not sure what I am missing.
The server comes with extensive man pages and other documentation. Reading just the comments isn't helpful.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- -- Jon
On Sep 11, 2018, at 10:59 AM, Jon Battista <jonbattista@gmail.com> wrote:
Okay, but freeradius still runs! It doesn't complain.
As I said repeatedly, it *does* complain when you run it in debug mode. You've gone out of your way to avoid reading the debug output, to avoid reading the "users" file that you're editing, as it has both documentation about what to do AND lots of examples. Instead of learning from your mistakes, you keep complaining that the server doesn't do what you expect. That's unfriendly.
I have been going back and forth over this documentation for days. I have seemingly done everything it says, yet there is no trace in my debug output that it is checking for simultaneous use.
Since you're not posting the debug output here as suggested pretty much everywhere, there isn't much we can do to help you.
Does there have to be an entry in radgroupcheck for my LDAP group "Squad" since I have set Simultaneous-Use := 1 in my user file?
No.
Again, I have looked over all the documentation. My debug output has nothing about Simultaneous-Use in it.
If only there were experts who could read the debug output and tell you what it means. Oh well. I guess it's impossible to fix. Alan DeKok.
participants (3)
-
Alan DeKok -
Jon Battista -
Michael Ducharme