rlm_sqlcounter: Max-Daily-Session.
Hi, I have to follow this tutorial to get the the session limit working. But looking at the debug output it seems the sql counter is not executed. No Session-Timeout is sent to NAS as well. Accounting is working fine. I can see all the accounting information radacct time. Here is my configuration. Please let me know if I should provide more information. Jake He FreeRADIUS V. 3 mods-enabled/sqlcounter sqlcounter noresetcounter { sql_module_instance = sql #dialect = ${sql_module_instance}.dialect dialect = mysql counter_name = Daily-Session-Time check_name = Max-Daily-Session reply_name = Session-Timeout key = User-Name reset = never query = “SELECT SUM(AcctSessionTime) FROM radacct where UserName=’%{%k}’” } sites-enabled/default: authorize { preprocess chap mschap suffix eap files sql pap noresetcounter } radcheck: Max-Daily-Session:=60 for the user bob
Do the following STEP 1: nano counters.conf sqlcounter dailycounter { counter-name = "Daily-Session-Time" check-name = "Max-Daily-Session" reply-name = "Session-Timeout" sqlmod-inst = "sql" key = "User-Name" reset = "daily" cache-size = 5000 query = "SELECT SUM(acctsessiontime) FROM radacct WHERE username = '%{%k}' AND acctstarttime BETWEEN FROM_UNIXTIME('%b') AND FROM_UNIXTIME('%e')" } STEP 2: nano radiusd.conf instantiate { dailycounter } STEP 3: nano sites-available/default authorize { dailycounter } STEP 4: accounting { sql } STEP 5: LOOK, THIS MUST BE *CHECK & REPLY* ITEM NOT CHECK ONLY. BOB IS ALLOWED FOR 60 MINUTES, VALUE IS IN SECONDS. Max-Daily-Session := 3600 STEP 6: Restart Radius Daemon RM -- On Mon, May 12, 2014 at 11:28 AM, * <zhex900@gmail.com> wrote:
Hi,
I have to follow this tutorial to get the the session limit working. But looking at the debug output it seems the sql counter is not executed. No Session-Timeout is sent to NAS as well.
Accounting is working fine. I can see all the accounting information radacct time.
Here is my configuration. Please let me know if I should provide more information.
Jake He
FreeRADIUS V. 3
mods-enabled/sqlcounter
sqlcounter noresetcounter { sql_module_instance = sql #dialect = ${sql_module_instance}.dialect dialect = mysql counter_name = Daily-Session-Time check_name = Max-Daily-Session reply_name = Session-Timeout key = User-Name reset = never query = “SELECT SUM(AcctSessionTime) FROM radacct where UserName=’%{%k}’” }
sites-enabled/default:
authorize {
preprocess chap mschap suffix eap files sql pap noresetcounter }
radcheck: Max-Daily-Session:=60 for the user bob
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi, I followed your instructions. Now I get the following errors: (2) [-sql] = ok (2) [expiration] = noop (2) [logintime] = noop (2) WARNING: pap : Auth-Type already set. Not setting to PAP (2) [pap] = noop (2) dailycounter : Entering module authorize code (2) ERROR: dailycounter : %{sql:SELECT SUM(acctsessiontime) FROM radacct WHERE username = '%{User-Name}' AND acctstarttime BETWEEN FROM_UNIXTIME('%b') AND FROM_UNIXTIME('%e')} (2) ERROR: dailycounter : ^ Invalid variable expansion (2) [dailycounter] = fail (2) } # authorize = fail (2) Using Post-Auth-Type Reject /etc/freeradius/mods-enabled/sqlcounter sqlcounter dailycounter{ counter_name = "Daily-Session-Time" check_name = "Max-Daily-Session" reply_name = "Session-Timeout" sql_module_instance = "sql" key = "User-Name" reset = "daily" cache-size = 5000 query = "SELECT SUM(acctsessiontime) FROM radacct WHERE username = '%{${ key}}' AND acctstarttime BETWEEN FROM_UNIXTIME('%b') AND FROM_UNIXTIME('%e')" } On Mon, May 12, 2014 at 11:27 PM, Russell Mike <radius.sir@gmail.com> wrote:
Do the following
STEP 1:
nano counters.conf
sqlcounter dailycounter {
counter-name = "Daily-Session-Time"
check-name = "Max-Daily-Session"
reply-name = "Session-Timeout"
sqlmod-inst = "sql"
key = "User-Name"
reset = "daily"
cache-size = 5000
query = "SELECT SUM(acctsessiontime) FROM radacct WHERE username = '%{%k}' AND acctstarttime BETWEEN FROM_UNIXTIME('%b') AND FROM_UNIXTIME('%e')"
}
STEP 2:
nano radiusd.conf
instantiate {
dailycounter
}
STEP 3:
nano sites-available/default
authorize {
dailycounter
}
STEP 4:
accounting {
sql
}
STEP 5: LOOK, THIS MUST BE *CHECK & REPLY* ITEM NOT CHECK ONLY. BOB IS ALLOWED FOR 60 MINUTES, VALUE IS IN SECONDS.
Max-Daily-Session := 3600
STEP 6: Restart Radius Daemon RM --
On Mon, May 12, 2014 at 11:28 AM, * <zhex900@gmail.com> wrote:
Hi,
I have to follow this tutorial to get the the session limit working. But looking at the debug output it seems the sql counter is not executed. No Session-Timeout is sent to NAS as well.
Accounting is working fine. I can see all the accounting information radacct time.
Here is my configuration. Please let me know if I should provide more information.
Jake He
FreeRADIUS V. 3
mods-enabled/sqlcounter
sqlcounter noresetcounter { sql_module_instance = sql #dialect = ${sql_module_instance}.dialect dialect = mysql counter_name = Daily-Session-Time check_name = Max-Daily-Session reply_name = Session-Timeout key = User-Name reset = never query = “SELECT SUM(AcctSessionTime) FROM radacct where UserName=’%{%k}’” }
sites-enabled/default:
authorize {
preprocess chap mschap suffix eap files sql pap noresetcounter }
radcheck: Max-Daily-Session:=60 for the user bob
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 13 May 2014, at 02:31, * <zhex900@gmail.com> wrote:
Hi,
I followed your instructions. Now I get the following errors:
(2) [-sql] = ok (2) [expiration] = noop (2) [logintime] = noop (2) WARNING: pap : Auth-Type already set. Not setting to PAP (2) [pap] = noop (2) dailycounter : Entering module authorize code (2) ERROR: dailycounter : %{sql:SELECT SUM(acctsessiontime) FROM radacct WHERE username = '%{User-Name}' AND acctstarttime BETWEEN FROM_UNIXTIME('%b') AND FROM_UNIXTIME('%e')} (2) ERROR: dailycounter : ^ Invalid variable expansion (2) [dailycounter] = fail (2) } # authorize = fail (2) Using Post-Auth-Type Reject
/etc/freeradius/mods-enabled/sqlcounter
sqlcounter dailycounter{ counter_name = "Daily-Session-Time" check_name = "Max-Daily-Session" reply_name = "Session-Timeout" sql_module_instance = "sql" key = "User-Name" reset = "daily" cache-size = 5000 query = "SELECT SUM(acctsessiontime) FROM radacct WHERE username = '%{${ key}}' AND acctstarttime BETWEEN FROM_UNIXTIME('%b') AND FROM_UNIXTIME('%e')" }
We fixed quite a few issues with the sqlcounter module in 3.0.3, it should all work now. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
You mean I need to upgrade to 3.0.3? On Tue, May 13, 2014 at 3:19 PM, Arran Cudbard-Bell < a.cudbardb@freeradius.org> wrote:
On 13 May 2014, at 02:31, * <zhex900@gmail.com> wrote:
Hi,
I followed your instructions. Now I get the following errors:
(2) [-sql] = ok (2) [expiration] = noop (2) [logintime] = noop (2) WARNING: pap : Auth-Type already set. Not setting to PAP (2) [pap] = noop (2) dailycounter : Entering module authorize code (2) ERROR: dailycounter : %{sql:SELECT SUM(acctsessiontime) FROM radacct WHERE username = '%{User-Name}' AND acctstarttime BETWEEN FROM_UNIXTIME('%b') AND FROM_UNIXTIME('%e')} (2) ERROR: dailycounter : ^ Invalid variable expansion (2) [dailycounter] = fail (2) } # authorize = fail (2) Using Post-Auth-Type Reject
/etc/freeradius/mods-enabled/sqlcounter
sqlcounter dailycounter{ counter_name = "Daily-Session-Time" check_name = "Max-Daily-Session" reply_name = "Session-Timeout" sql_module_instance = "sql" key = "User-Name" reset = "daily" cache-size = 5000 query = "SELECT SUM(acctsessiontime) FROM radacct WHERE username = '%{${ key}}' AND acctstarttime BETWEEN FROM_UNIXTIME('%b') AND FROM_UNIXTIME('%e')" }
We fixed quite a few issues with the sqlcounter module in 3.0.3, it should all work now.
-Arran
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi, Thank you for your patience. I am very happy someone can help me. Now I made some progress. I find out what the problem is now. In the query you provided I need to put quotes around radacct. Like this: query = "SELECT IFNULL(TIME_TO_SEC(TIMEDIFF(NOW(), MIN(AcctStartTime))),0) FROM *`radacct` *WHERE UserName='%{%k}' ORDER BY AcctStartTime LIMIT 1;" Now, have one more problem. My NAS (Mikrotik) is not receiving the Session-Timout. I cannot see it in the NAS log. I only can see Acct-Session-Time. Therefore it is not terminating the session. For testing I have set the time limit to 60 seconds. Freeradius is sending it: (2) dailycounter : Sent Reply-Item for user hello, Type=Session-Timeout, value=60 (2) [dailycounter] = ok Sending Access-Challenge of id 232 from 10.1.1.2 port 135 to 27.33.228.125 port 47097 Session-Timeout = 60 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x543a9074553889da6f504855ab4e7a4b (2) Finished request 2. I did not put anything in the radreply for the user. When I did put Session-Timeout=60 in radreply, I still cannot see it in the NAS log. Is it my a problem with NAS configuration? What should I do now? Jake He On Tue, May 13, 2014 at 5:12 PM, Arran Cudbard-Bell < a.cudbardb@freeradius.org> wrote:
On 13 May 2014, at 08:46, * <zhex900@gmail.com> wrote:
You mean I need to upgrade to 3.0.3?
yes.
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Tue, May 13, 2014 at 12:30 PM, * <zhex900@gmail.com> wrote:
Hi,
Thank you for your patience. I am very happy someone can help me. Now I made some progress.
I find out what the problem is now. In the query you provided I need to put quotes around radacct. Like this: query = "SELECT IFNULL(TIME_TO_SEC(TIMEDIFF(NOW(), MIN(AcctStartTime))),0) FROM *`radacct` *WHERE UserName='%{%k}' ORDER BY AcctStartTime LIMIT 1;"
Okay, good, there was error in username veritable as well in your previous query ('%{%k}' ). Anyways. happy it worked !!
Now, have one more problem.
My NAS (Mikrotik) is not receiving the Session-Timout. I cannot see it in the NAS log. I only can see Acct-Session-Time. Therefore it is not terminating the session. For testing I have set the time limit to 60 seconds.
Freeradius is sending it:
(2) dailycounter : Sent Reply-Item for user hello, Type=Session-Timeout, value=60 (2) [dailycounter] = ok
Sending Access-Challenge of id 232 from 10.1.1.2 port 135 to 27.33.228.125 port 47097 Session-Timeout = 60 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x543a9074553889da6f504855ab4e7a4b (2) Finished request 2.
I did not put anything in the radreply for the user. When I did put Session-Timeout=60 in radreply, I still cannot see it in the NAS log.
Is it my a problem with NAS configuration?
What should I do now?
The way FreeRADIUS works is that, it does not disconnect users him self. But rather tells the NAS to disconnect user. if i say that, how FreeRADIUS would tell NAS to disconnect user ? using REPLY ITEM. So put "Session-Timeout" in Reply as well. You said even if you add "Session-Timeout" in reply make no difference, no problem leave "Session-Timeout" in reply-item, it must to be there. And you have more than one problem. 60 seconds are too less, minimum test should be done with 600 seconds for better results. FreeRADIUS is now fine. Configure your NAS properly NOTE: Check item is for FreeRADIUS. reply item is for NAS. Thanks / Regards --RM
Jake He
On Tue, May 13, 2014 at 5:12 PM, Arran Cudbard-Bell < a.cudbardb@freeradius.org> wrote:
On 13 May 2014, at 08:46, * <zhex900@gmail.com> wrote:
You mean I need to upgrade to 3.0.3?
yes.
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi, I have set my reply item Session-Timeout := 600 for the user bob. I can see the radius sending the Session-Timeout to NAS. But the radius get a "*eap_peap : Got tunneled reply code 11." *My NAS is receiving other Access-Challenge requests but not this one. I tried to find out what code 11 but I cannot find a simple answer. Do I need to configure my inner-tunnel? Jake He *Sending Access-Challenge of id 155 from 10.1.1.2 port 135 to 27.33.228.125 port 45095* * Session-Timeout := 600* * Idle-Timeout := 30* * EAP-Message = 0x010200061920* * Message-Authenticator = 0x00000000000000000000000000000000* * State = 0xb77514c3b6770d58e310744eea16afdc* *(1) Finished request 1.* (8) [pap] = noop (8) } # authorize = updated (8) Found Auth-Type = EAP (8) # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel (8) authenticate { (8) eap : Expiring EAP session with state 0x7b061f337b0e0549 (8) eap : Finished EAP session with state 0x7b061f337b0e0549 (8) eap : Previous EAP request found for state 0x7b061f337b0e0549, released from the list (8) eap : Peer sent MSCHAPv2 (26) (8) eap : EAP MSCHAPv2 (26) (8) eap : Calling eap_mschapv2 to process EAP data (8) eap_mschapv2 : # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel (8) eap_mschapv2 : Auth-Type MS-CHAP { (8) mschap : Found Cleartext-Password, hashing to create LM-Password (8) mschap : Found Cleartext-Password, hashing to create NT-Password (8) mschap : Creating challenge hash with username: bob (8) mschap : Client is using MS-CHAPv2 for bob, we need NT-Password (8) mschap : adding MS-CHAPv2 MPPE keys (8) [mschap] = ok (8) } # Auth-Type MS-CHAP = ok MSCHAP Success (8) eap : New EAP session, adding 'State' attribute to reply 0x7b061f337a0f0549 (8) [eap] = handled (8) } # authenticate = handled } # server inner-tunnel *(8) eap_peap : Got tunneled reply code 11* * Session-Timeout := 600* * Idle-Timeout := 30* * EAP-Message = 0x010900331a0308002e533d32374134353837324635433545353846434334433734383546333732324530414444373730393738* * Message-Authenticator = 0x00000000000000000000000000000000* * State = 0x7b061f337a0f0549d125cd93a8b94882* (8) eap_peap : Got tunneled reply RADIUS code 11 Session-Timeout := 600 Idle-Timeout := 30 EAP-Message = 0x010900331a0308002e533d32374134353837324635433545353846434334433734383546333732324530414444373730393738 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7b061f337a0f0549d125cd93a8b94882 (8) eap_peap : Got tunneled Access-Challenge (8) eap : New EAP session, adding 'State' attribute to reply 0xb77514c3bf7c0d58 (8) [eap] = handled (8) } # authenticate = handled On Tue, May 13, 2014 at 9:32 PM, Russell Mike <radius.sir@gmail.com> wrote:
On Tue, May 13, 2014 at 12:30 PM, * <zhex900@gmail.com> wrote:
Hi,
Thank you for your patience. I am very happy someone can help me. Now I made some progress.
I find out what the problem is now. In the query you provided I need to put quotes around radacct. Like this: query = "SELECT IFNULL(TIME_TO_SEC(TIMEDIFF(NOW(), MIN(AcctStartTime))),0) FROM *`radacct` *WHERE UserName='%{%k}' ORDER BY AcctStartTime LIMIT 1;"
Okay, good, there was error in username veritable as well in your previous query ('%{%k}' ). Anyways. happy it worked !!
Now, have one more problem.
My NAS (Mikrotik) is not receiving the Session-Timout. I cannot see it in the NAS log. I only can see Acct-Session-Time. Therefore it is not terminating the session. For testing I have set the time limit to 60 seconds.
Freeradius is sending it:
(2) dailycounter : Sent Reply-Item for user hello, Type=Session-Timeout, value=60 (2) [dailycounter] = ok
Sending Access-Challenge of id 232 from 10.1.1.2 port 135 to 27.33.228.125 port 47097 Session-Timeout = 60 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x543a9074553889da6f504855ab4e7a4b (2) Finished request 2.
I did not put anything in the radreply for the user. When I did put Session-Timeout=60 in radreply, I still cannot see it in the NAS log.
Is it my a problem with NAS configuration?
What should I do now?
The way FreeRADIUS works is that, it does not disconnect users him self. But rather tells the NAS to disconnect user. if i say that, how FreeRADIUS would tell NAS to disconnect user ? using REPLY ITEM. So put "Session-Timeout" in Reply as well. You said even if you add "Session-Timeout" in reply make no difference, no problem leave "Session-Timeout" in reply-item, it must to be there. And you have more than one problem. 60 seconds are too less, minimum test should be done with 600 seconds for better results.
FreeRADIUS is now fine. Configure your NAS properly
NOTE: Check item is for FreeRADIUS. reply item is for NAS.
Thanks / Regards
--RM
Jake He
On Tue, May 13, 2014 at 5:12 PM, Arran Cudbard-Bell < a.cudbardb@freeradius.org> wrote:
On 13 May 2014, at 08:46, * <zhex900@gmail.com> wrote:
You mean I need to upgrade to 3.0.3?
yes.
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
* wrote:
I have set my reply item Session-Timeout := 600 for the user bob. I can see the radius sending the Session-Timeout to NAS. But the radius get a "*eap_peap : Got tunneled reply code 11." *My NAS is receiving other Access-Challenge requests but not this one.
I doubt that very much. EAP and RADIUS just don't work that way. What's probably happening is that the reply makes it back to the NAS, which then sends it to the supplicant. The supplicant doesn't like the reply, so it drops the EAP connection.
I tried to find out what code 11 but I cannot find a simple answer.
Do I need to configure my inner-tunnel?
The default configuration for inner-tunnel works. Alan DeKok.
Hi, So it's a configuration issue with my NAS right? Does it have to do with enabling connection termination on my NAS. Sorry for asking a non radius question here. I want to find the right direction to work on. http://wiki.mikrotik.com/wiki/Manual:RADIUS_Client#Connection_Terminating_fr... Thanks Jake He On 14/05/2014 8:25 AM, "Alan DeKok" <aland@deployingradius.com> wrote:
* wrote:
I have set my reply item Session-Timeout := 600 for the user bob. I can see the radius sending the Session-Timeout to NAS. But the radius get a "*eap_peap : Got tunneled reply code 11." *My NAS is receiving other Access-Challenge requests but not this one.
I doubt that very much. EAP and RADIUS just don't work that way.
What's probably happening is that the reply makes it back to the NAS, which then sends it to the supplicant. The supplicant doesn't like the reply, so it drops the EAP connection.
I tried to find out what code 11 but I cannot find a simple answer.
Do I need to configure my inner-tunnel?
The default configuration for inner-tunnel works.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi, i am sure you are doing all that in LAB, why complex? try with PAP at least to make sure stuff works. And then configure EAP later. don't do anything to inner-tunnel. Thanks / Regards On Tue, May 13, 2014 at 11:39 PM, * <zhex900@gmail.com> wrote:
Hi,
I have set my reply item Session-Timeout := 600 for the user bob. I can see the radius sending the Session-Timeout to NAS. But the radius get a "*eap_peap : Got tunneled reply code 11." *My NAS is receiving other Access-Challenge requests but not this one.
I tried to find out what code 11 but I cannot find a simple answer.
Do I need to configure my inner-tunnel?
Jake He
*Sending Access-Challenge of id 155 from 10.1.1.2 port 135 to 27.33.228.125 port 45095* * Session-Timeout := 600* * Idle-Timeout := 30* * EAP-Message = 0x010200061920* * Message-Authenticator = 0x00000000000000000000000000000000* * State = 0xb77514c3b6770d58e310744eea16afdc* *(1) Finished request 1.*
(8) [pap] = noop (8) } # authorize = updated (8) Found Auth-Type = EAP (8) # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel (8) authenticate { (8) eap : Expiring EAP session with state 0x7b061f337b0e0549 (8) eap : Finished EAP session with state 0x7b061f337b0e0549 (8) eap : Previous EAP request found for state 0x7b061f337b0e0549, released from the list (8) eap : Peer sent MSCHAPv2 (26) (8) eap : EAP MSCHAPv2 (26) (8) eap : Calling eap_mschapv2 to process EAP data (8) eap_mschapv2 : # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel (8) eap_mschapv2 : Auth-Type MS-CHAP { (8) mschap : Found Cleartext-Password, hashing to create LM-Password (8) mschap : Found Cleartext-Password, hashing to create NT-Password (8) mschap : Creating challenge hash with username: bob (8) mschap : Client is using MS-CHAPv2 for bob, we need NT-Password (8) mschap : adding MS-CHAPv2 MPPE keys (8) [mschap] = ok (8) } # Auth-Type MS-CHAP = ok MSCHAP Success (8) eap : New EAP session, adding 'State' attribute to reply 0x7b061f337a0f0549 (8) [eap] = handled (8) } # authenticate = handled } # server inner-tunnel *(8) eap_peap : Got tunneled reply code 11* * Session-Timeout := 600* * Idle-Timeout := 30* * EAP-Message = 0x010900331a0308002e533d32374134353837324635433545353846434334433734383546333732324530414444373730393738* * Message-Authenticator = 0x00000000000000000000000000000000* * State = 0x7b061f337a0f0549d125cd93a8b94882* (8) eap_peap : Got tunneled reply RADIUS code 11 Session-Timeout := 600 Idle-Timeout := 30 EAP-Message = 0x010900331a0308002e533d32374134353837324635433545353846434334433734383546333732324530414444373730393738 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7b061f337a0f0549d125cd93a8b94882 (8) eap_peap : Got tunneled Access-Challenge (8) eap : New EAP session, adding 'State' attribute to reply 0xb77514c3bf7c0d58 (8) [eap] = handled (8) } # authenticate = handled
On Tue, May 13, 2014 at 9:32 PM, Russell Mike <radius.sir@gmail.com>wrote:
On Tue, May 13, 2014 at 12:30 PM, * <zhex900@gmail.com> wrote:
Hi,
Thank you for your patience. I am very happy someone can help me. Now I made some progress.
I find out what the problem is now. In the query you provided I need to put quotes around radacct. Like this: query = "SELECT IFNULL(TIME_TO_SEC(TIMEDIFF(NOW(), MIN(AcctStartTime))),0) FROM *`radacct` *WHERE UserName='%{%k}' ORDER BY AcctStartTime LIMIT 1;"
Okay, good, there was error in username veritable as well in your previous query ('%{%k}' ). Anyways. happy it worked !!
Now, have one more problem.
My NAS (Mikrotik) is not receiving the Session-Timout. I cannot see it in the NAS log. I only can see Acct-Session-Time. Therefore it is not terminating the session. For testing I have set the time limit to 60 seconds.
Freeradius is sending it:
(2) dailycounter : Sent Reply-Item for user hello, Type=Session-Timeout, value=60 (2) [dailycounter] = ok
Sending Access-Challenge of id 232 from 10.1.1.2 port 135 to 27.33.228.125 port 47097 Session-Timeout = 60 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x543a9074553889da6f504855ab4e7a4b (2) Finished request 2.
I did not put anything in the radreply for the user. When I did put Session-Timeout=60 in radreply, I still cannot see it in the NAS log.
Is it my a problem with NAS configuration?
What should I do now?
The way FreeRADIUS works is that, it does not disconnect users him self. But rather tells the NAS to disconnect user. if i say that, how FreeRADIUS would tell NAS to disconnect user ? using REPLY ITEM. So put "Session-Timeout" in Reply as well. You said even if you add "Session-Timeout" in reply make no difference, no problem leave "Session-Timeout" in reply-item, it must to be there. And you have more than one problem. 60 seconds are too less, minimum test should be done with 600 seconds for better results.
FreeRADIUS is now fine. Configure your NAS properly
NOTE: Check item is for FreeRADIUS. reply item is for NAS.
Thanks / Regards
--RM
Jake He
On Tue, May 13, 2014 at 5:12 PM, Arran Cudbard-Bell < a.cudbardb@freeradius.org> wrote:
On 13 May 2014, at 08:46, * <zhex900@gmail.com> wrote:
You mean I need to upgrade to 3.0.3?
yes.
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi Russell, I changed the authorisation method on my device to EAP-TTLS, I could not get PAP to work. Now Session-Timeout is received by NAS. No more code 11. But for some reason MikroTik does not terminate the session after the assigned time. I made post in http://forum.mikrotik.com/viewtopic.php?f=2&t=84986&p=426217#p426217. I will try to upgrade RouterOS to 6.12. Apart from this don't know what else to do. Thank you for your kind help. Jake He On Wed, May 14, 2014 at 6:16 PM, Russell Mike <radius.sir@gmail.com> wrote:
Hi,
i am sure you are doing all that in LAB, why complex? try with PAP at least to make sure stuff works. And then configure EAP later. don't do anything to inner-tunnel.
Thanks / Regards
On Tue, May 13, 2014 at 11:39 PM, * <zhex900@gmail.com> wrote:
Hi,
I have set my reply item Session-Timeout := 600 for the user bob. I can see the radius sending the Session-Timeout to NAS. But the radius get a "*eap_peap : Got tunneled reply code 11." *My NAS is receiving other Access-Challenge requests but not this one.
I tried to find out what code 11 but I cannot find a simple answer.
Do I need to configure my inner-tunnel?
Jake He
*Sending Access-Challenge of id 155 from 10.1.1.2 port 135 to 27.33.228.125 port 45095* * Session-Timeout := 600* * Idle-Timeout := 30* * EAP-Message = 0x010200061920* * Message-Authenticator = 0x00000000000000000000000000000000* * State = 0xb77514c3b6770d58e310744eea16afdc* *(1) Finished request 1.*
(8) [pap] = noop (8) } # authorize = updated (8) Found Auth-Type = EAP (8) # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel (8) authenticate { (8) eap : Expiring EAP session with state 0x7b061f337b0e0549 (8) eap : Finished EAP session with state 0x7b061f337b0e0549 (8) eap : Previous EAP request found for state 0x7b061f337b0e0549, released from the list (8) eap : Peer sent MSCHAPv2 (26) (8) eap : EAP MSCHAPv2 (26) (8) eap : Calling eap_mschapv2 to process EAP data (8) eap_mschapv2 : # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel (8) eap_mschapv2 : Auth-Type MS-CHAP { (8) mschap : Found Cleartext-Password, hashing to create LM-Password (8) mschap : Found Cleartext-Password, hashing to create NT-Password (8) mschap : Creating challenge hash with username: bob (8) mschap : Client is using MS-CHAPv2 for bob, we need NT-Password (8) mschap : adding MS-CHAPv2 MPPE keys (8) [mschap] = ok (8) } # Auth-Type MS-CHAP = ok MSCHAP Success (8) eap : New EAP session, adding 'State' attribute to reply 0x7b061f337a0f0549 (8) [eap] = handled (8) } # authenticate = handled } # server inner-tunnel *(8) eap_peap : Got tunneled reply code 11* * Session-Timeout := 600* * Idle-Timeout := 30* * EAP-Message = 0x010900331a0308002e533d32374134353837324635433545353846434334433734383546333732324530414444373730393738* * Message-Authenticator = 0x00000000000000000000000000000000* * State = 0x7b061f337a0f0549d125cd93a8b94882* (8) eap_peap : Got tunneled reply RADIUS code 11 Session-Timeout := 600 Idle-Timeout := 30 EAP-Message = 0x010900331a0308002e533d32374134353837324635433545353846434334433734383546333732324530414444373730393738 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7b061f337a0f0549d125cd93a8b94882 (8) eap_peap : Got tunneled Access-Challenge (8) eap : New EAP session, adding 'State' attribute to reply 0xb77514c3bf7c0d58 (8) [eap] = handled (8) } # authenticate = handled
On Tue, May 13, 2014 at 9:32 PM, Russell Mike <radius.sir@gmail.com>wrote:
On Tue, May 13, 2014 at 12:30 PM, * <zhex900@gmail.com> wrote:
Hi,
Thank you for your patience. I am very happy someone can help me. Now I made some progress.
I find out what the problem is now. In the query you provided I need to put quotes around radacct. Like this: query = "SELECT IFNULL(TIME_TO_SEC(TIMEDIFF(NOW(), MIN(AcctStartTime))),0) FROM *`radacct` *WHERE UserName='%{%k}' ORDER BY AcctStartTime LIMIT 1;"
Okay, good, there was error in username veritable as well in your previous query ('%{%k}' ). Anyways. happy it worked !!
Now, have one more problem.
My NAS (Mikrotik) is not receiving the Session-Timout. I cannot see it in the NAS log. I only can see Acct-Session-Time. Therefore it is not terminating the session. For testing I have set the time limit to 60 seconds.
Freeradius is sending it:
(2) dailycounter : Sent Reply-Item for user hello, Type=Session-Timeout, value=60 (2) [dailycounter] = ok
Sending Access-Challenge of id 232 from 10.1.1.2 port 135 to 27.33.228.125 port 47097 Session-Timeout = 60 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x543a9074553889da6f504855ab4e7a4b (2) Finished request 2.
I did not put anything in the radreply for the user. When I did put Session-Timeout=60 in radreply, I still cannot see it in the NAS log.
Is it my a problem with NAS configuration?
What should I do now?
The way FreeRADIUS works is that, it does not disconnect users him self. But rather tells the NAS to disconnect user. if i say that, how FreeRADIUS would tell NAS to disconnect user ? using REPLY ITEM. So put "Session-Timeout" in Reply as well. You said even if you add "Session-Timeout" in reply make no difference, no problem leave "Session-Timeout" in reply-item, it must to be there. And you have more than one problem. 60 seconds are too less, minimum test should be done with 600 seconds for better results.
FreeRADIUS is now fine. Configure your NAS properly
NOTE: Check item is for FreeRADIUS. reply item is for NAS.
Thanks / Regards
--RM
Jake He
On Tue, May 13, 2014 at 5:12 PM, Arran Cudbard-Bell < a.cudbardb@freeradius.org> wrote:
On 13 May 2014, at 08:46, * <zhex900@gmail.com> wrote:
You mean I need to upgrade to 3.0.3?
yes.
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Try hard, it would work. it is important that accounting is logged in MySQL DB and check weather sql is enable "sites-available/default" accouting { sql } Thanks On Thu, May 15, 2014 at 1:09 PM, * <zhex900@gmail.com> wrote:
Hi Russell,
I changed the authorisation method on my device to EAP-TTLS, I could not get PAP to work. Now Session-Timeout is received by NAS. No more code 11. But for some reason MikroTik does not terminate the session after the assigned time.
I made post in http://forum.mikrotik.com/viewtopic.php?f=2&t=84986&p=426217#p426217. I will try to upgrade RouterOS to 6.12. Apart from this don't know what else to do.
Thank you for your kind help.
Jake He
On Wed, May 14, 2014 at 6:16 PM, Russell Mike <radius.sir@gmail.com>wrote:
Hi,
i am sure you are doing all that in LAB, why complex? try with PAP at least to make sure stuff works. And then configure EAP later. don't do anything to inner-tunnel.
Thanks / Regards
On Tue, May 13, 2014 at 11:39 PM, * <zhex900@gmail.com> wrote:
Hi,
I have set my reply item Session-Timeout := 600 for the user bob. I can see the radius sending the Session-Timeout to NAS. But the radius get a "*eap_peap : Got tunneled reply code 11." *My NAS is receiving other Access-Challenge requests but not this one.
I tried to find out what code 11 but I cannot find a simple answer.
Do I need to configure my inner-tunnel?
Jake He
*Sending Access-Challenge of id 155 from 10.1.1.2 port 135 to 27.33.228.125 port 45095* * Session-Timeout := 600* * Idle-Timeout := 30* * EAP-Message = 0x010200061920* * Message-Authenticator = 0x00000000000000000000000000000000* * State = 0xb77514c3b6770d58e310744eea16afdc* *(1) Finished request 1.*
(8) [pap] = noop (8) } # authorize = updated (8) Found Auth-Type = EAP (8) # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel (8) authenticate { (8) eap : Expiring EAP session with state 0x7b061f337b0e0549 (8) eap : Finished EAP session with state 0x7b061f337b0e0549 (8) eap : Previous EAP request found for state 0x7b061f337b0e0549, released from the list (8) eap : Peer sent MSCHAPv2 (26) (8) eap : EAP MSCHAPv2 (26) (8) eap : Calling eap_mschapv2 to process EAP data (8) eap_mschapv2 : # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel (8) eap_mschapv2 : Auth-Type MS-CHAP { (8) mschap : Found Cleartext-Password, hashing to create LM-Password (8) mschap : Found Cleartext-Password, hashing to create NT-Password (8) mschap : Creating challenge hash with username: bob (8) mschap : Client is using MS-CHAPv2 for bob, we need NT-Password (8) mschap : adding MS-CHAPv2 MPPE keys (8) [mschap] = ok (8) } # Auth-Type MS-CHAP = ok MSCHAP Success (8) eap : New EAP session, adding 'State' attribute to reply 0x7b061f337a0f0549 (8) [eap] = handled (8) } # authenticate = handled } # server inner-tunnel *(8) eap_peap : Got tunneled reply code 11* * Session-Timeout := 600* * Idle-Timeout := 30* * EAP-Message = 0x010900331a0308002e533d32374134353837324635433545353846434334433734383546333732324530414444373730393738* * Message-Authenticator = 0x00000000000000000000000000000000* * State = 0x7b061f337a0f0549d125cd93a8b94882* (8) eap_peap : Got tunneled reply RADIUS code 11 Session-Timeout := 600 Idle-Timeout := 30 EAP-Message = 0x010900331a0308002e533d32374134353837324635433545353846434334433734383546333732324530414444373730393738 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7b061f337a0f0549d125cd93a8b94882 (8) eap_peap : Got tunneled Access-Challenge (8) eap : New EAP session, adding 'State' attribute to reply 0xb77514c3bf7c0d58 (8) [eap] = handled (8) } # authenticate = handled
On Tue, May 13, 2014 at 9:32 PM, Russell Mike <radius.sir@gmail.com>wrote:
On Tue, May 13, 2014 at 12:30 PM, * <zhex900@gmail.com> wrote:
Hi,
Thank you for your patience. I am very happy someone can help me. Now I made some progress.
I find out what the problem is now. In the query you provided I need to put quotes around radacct. Like this: query = "SELECT IFNULL(TIME_TO_SEC(TIMEDIFF(NOW(), MIN(AcctStartTime))),0) FROM *`radacct` *WHERE UserName='%{%k}' ORDER BY AcctStartTime LIMIT 1;"
Okay, good, there was error in username veritable as well in your previous query ('%{%k}' ). Anyways. happy it worked !!
Now, have one more problem.
My NAS (Mikrotik) is not receiving the Session-Timout. I cannot see it in the NAS log. I only can see Acct-Session-Time. Therefore it is not terminating the session. For testing I have set the time limit to 60 seconds.
Freeradius is sending it:
(2) dailycounter : Sent Reply-Item for user hello, Type=Session-Timeout, value=60 (2) [dailycounter] = ok
Sending Access-Challenge of id 232 from 10.1.1.2 port 135 to 27.33.228.125 port 47097 Session-Timeout = 60 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x543a9074553889da6f504855ab4e7a4b (2) Finished request 2.
I did not put anything in the radreply for the user. When I did put Session-Timeout=60 in radreply, I still cannot see it in the NAS log.
Is it my a problem with NAS configuration?
What should I do now?
The way FreeRADIUS works is that, it does not disconnect users him self. But rather tells the NAS to disconnect user. if i say that, how FreeRADIUS would tell NAS to disconnect user ? using REPLY ITEM. So put "Session-Timeout" in Reply as well. You said even if you add "Session-Timeout" in reply make no difference, no problem leave "Session-Timeout" in reply-item, it must to be there. And you have more than one problem. 60 seconds are too less, minimum test should be done with 600 seconds for better results.
FreeRADIUS is now fine. Configure your NAS properly
NOTE: Check item is for FreeRADIUS. reply item is for NAS.
Thanks / Regards
--RM
Jake He
On Tue, May 13, 2014 at 5:12 PM, Arran Cudbard-Bell < a.cudbardb@freeradius.org> wrote:
On 13 May 2014, at 08:46, * <zhex900@gmail.com> wrote:
> You mean I need to upgrade to 3.0.3?
yes.
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Accounting is working fine. All the information are logged. I think radius is working fine. Do I need to setup PPP AAA at the NAS? http://wiki.mikrotik.com/wiki/Manual:PPP_AAA On Thu, May 15, 2014 at 11:23 PM, Russell Mike <radius.sir@gmail.com> wrote:
Try hard, it would work. it is important that accounting is logged in MySQL DB and check weather sql is enable "sites-available/default"
accouting { sql }
Thanks
On Thu, May 15, 2014 at 1:09 PM, * <zhex900@gmail.com> wrote:
Hi Russell,
I changed the authorisation method on my device to EAP-TTLS, I could not get PAP to work. Now Session-Timeout is received by NAS. No more code 11. But for some reason MikroTik does not terminate the session after the assigned time.
I made post in http://forum.mikrotik.com/viewtopic.php?f=2&t=84986&p=426217#p426217. I will try to upgrade RouterOS to 6.12. Apart from this don't know what else to do.
Thank you for your kind help.
Jake He
On Wed, May 14, 2014 at 6:16 PM, Russell Mike <radius.sir@gmail.com>wrote:
Hi,
i am sure you are doing all that in LAB, why complex? try with PAP at least to make sure stuff works. And then configure EAP later. don't do anything to inner-tunnel.
Thanks / Regards
On Tue, May 13, 2014 at 11:39 PM, * <zhex900@gmail.com> wrote:
Hi,
I have set my reply item Session-Timeout := 600 for the user bob. I can see the radius sending the Session-Timeout to NAS. But the radius get a "*eap_peap : Got tunneled reply code 11." *My NAS is receiving other Access-Challenge requests but not this one.
I tried to find out what code 11 but I cannot find a simple answer.
Do I need to configure my inner-tunnel?
Jake He
*Sending Access-Challenge of id 155 from 10.1.1.2 port 135 to 27.33.228.125 port 45095* * Session-Timeout := 600* * Idle-Timeout := 30* * EAP-Message = 0x010200061920* * Message-Authenticator = 0x00000000000000000000000000000000* * State = 0xb77514c3b6770d58e310744eea16afdc* *(1) Finished request 1.*
(8) [pap] = noop (8) } # authorize = updated (8) Found Auth-Type = EAP (8) # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel (8) authenticate { (8) eap : Expiring EAP session with state 0x7b061f337b0e0549 (8) eap : Finished EAP session with state 0x7b061f337b0e0549 (8) eap : Previous EAP request found for state 0x7b061f337b0e0549, released from the list (8) eap : Peer sent MSCHAPv2 (26) (8) eap : EAP MSCHAPv2 (26) (8) eap : Calling eap_mschapv2 to process EAP data (8) eap_mschapv2 : # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel (8) eap_mschapv2 : Auth-Type MS-CHAP { (8) mschap : Found Cleartext-Password, hashing to create LM-Password (8) mschap : Found Cleartext-Password, hashing to create NT-Password (8) mschap : Creating challenge hash with username: bob (8) mschap : Client is using MS-CHAPv2 for bob, we need NT-Password (8) mschap : adding MS-CHAPv2 MPPE keys (8) [mschap] = ok (8) } # Auth-Type MS-CHAP = ok MSCHAP Success (8) eap : New EAP session, adding 'State' attribute to reply 0x7b061f337a0f0549 (8) [eap] = handled (8) } # authenticate = handled } # server inner-tunnel *(8) eap_peap : Got tunneled reply code 11* * Session-Timeout := 600* * Idle-Timeout := 30* * EAP-Message = 0x010900331a0308002e533d32374134353837324635433545353846434334433734383546333732324530414444373730393738* * Message-Authenticator = 0x00000000000000000000000000000000* * State = 0x7b061f337a0f0549d125cd93a8b94882* (8) eap_peap : Got tunneled reply RADIUS code 11 Session-Timeout := 600 Idle-Timeout := 30 EAP-Message = 0x010900331a0308002e533d32374134353837324635433545353846434334433734383546333732324530414444373730393738 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7b061f337a0f0549d125cd93a8b94882 (8) eap_peap : Got tunneled Access-Challenge (8) eap : New EAP session, adding 'State' attribute to reply 0xb77514c3bf7c0d58 (8) [eap] = handled (8) } # authenticate = handled
On Tue, May 13, 2014 at 9:32 PM, Russell Mike <radius.sir@gmail.com>wrote:
On Tue, May 13, 2014 at 12:30 PM, * <zhex900@gmail.com> wrote:
Hi,
Thank you for your patience. I am very happy someone can help me. Now I made some progress.
I find out what the problem is now. In the query you provided I need to put quotes around radacct. Like this: query = "SELECT IFNULL(TIME_TO_SEC(TIMEDIFF(NOW(), MIN(AcctStartTime))),0) FROM *`radacct` *WHERE UserName='%{%k}' ORDER BY AcctStartTime LIMIT 1;"
Okay, good, there was error in username veritable as well in your previous query ('%{%k}' ). Anyways. happy it worked !!
Now, have one more problem.
My NAS (Mikrotik) is not receiving the Session-Timout. I cannot see it in the NAS log. I only can see Acct-Session-Time. Therefore it is not terminating the session. For testing I have set the time limit to 60 seconds.
Freeradius is sending it:
(2) dailycounter : Sent Reply-Item for user hello, Type=Session-Timeout, value=60 (2) [dailycounter] = ok
Sending Access-Challenge of id 232 from 10.1.1.2 port 135 to 27.33.228.125 port 47097 Session-Timeout = 60 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x543a9074553889da6f504855ab4e7a4b (2) Finished request 2.
I did not put anything in the radreply for the user. When I did put Session-Timeout=60 in radreply, I still cannot see it in the NAS log.
Is it my a problem with NAS configuration?
What should I do now?
The way FreeRADIUS works is that, it does not disconnect users him self. But rather tells the NAS to disconnect user. if i say that, how FreeRADIUS would tell NAS to disconnect user ? using REPLY ITEM. So put "Session-Timeout" in Reply as well. You said even if you add "Session-Timeout" in reply make no difference, no problem leave "Session-Timeout" in reply-item, it must to be there. And you have more than one problem. 60 seconds are too less, minimum test should be done with 600 seconds for better results.
FreeRADIUS is now fine. Configure your NAS properly
NOTE: Check item is for FreeRADIUS. reply item is for NAS.
Thanks / Regards
--RM
Jake He
On Tue, May 13, 2014 at 5:12 PM, Arran Cudbard-Bell < a.cudbardb@freeradius.org> wrote:
> > On 13 May 2014, at 08:46, * <zhex900@gmail.com> wrote: > > > You mean I need to upgrade to 3.0.3? > > yes. > > Arran Cudbard-Bell <a.cudbardb@freeradius.org> > FreeRADIUS Development Team > > FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2 > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi, Does Session-Timeout attribute needs to be in Access-Accept? Currently my radius send Session-Timeout in Access-Challenge. If so, how I do configure the radius to send Session-Timeout in Access-Accept? Jake He
Hi, I kind of know what the problem is now. Hopefully, I am heading in the right direction. This post<http://freeradius.1045715.n5.nabble.com/Sending-an-attribute-with-the-Access-Accept-instead-of-Access-Challenge-td3338454.html> gave me some ideas. I added the following in inner-tunnel. How do I set the value of the Session-Timeout attribute correctly? update outer.reply { User-Name = "%{request:User-Name}" Session-timeout = "%{request:Session-timeout}" } But the radiusd -X shows Session-timeout = 0 (7) update outer.reply { (7) expand: "%{request:User-Name}" -> 'bob' (7) User-Name = "bob" (7) expand: "%{request:Session-timeout}" -> '' (7) *Session-timeout = 0* (7) } # update outer.reply = noop (7) } # post-auth = ok } # server inner-tunnel Thanks Jake He On Fri, May 16, 2014 at 12:42 PM, * <zhex900@gmail.com> wrote:
Hi,
Does Session-Timeout attribute needs to be in Access-Accept? Currently my radius send Session-Timeout in Access-Challenge.
If so, how I do configure the radius to send Session-Timeout in Access-Accept?
Jake He
Hi, It finally worked. Only for EAP-TTLS. EAP-PEAP still does not send Session-Timeout in Access-Accept. This is what I did. Comment out these lines in inner-tunnel. update outer.reply { User-Name = "%{request:User-Name}" Session-timeout = "%{request:Session-timeout}" } vi eap in /etc/freeradius/mods-enabled use_tunneled_reply = yes for everything. Thank you for helping me. Jake He On Fri, May 16, 2014 at 6:02 PM, * <zhex900@gmail.com> wrote:
Hi,
I kind of know what the problem is now. Hopefully, I am heading in the right direction. This post<http://freeradius.1045715.n5.nabble.com/Sending-an-attribute-with-the-Access-Accept-instead-of-Access-Challenge-td3338454.html> gave me some ideas.
I added the following in inner-tunnel. How do I set the value of the Session-Timeout attribute correctly?
update outer.reply { User-Name = "%{request:User-Name}" Session-timeout = "%{request:Session-timeout}" }
But the radiusd -X shows Session-timeout = 0
(7) update outer.reply { (7) expand: "%{request:User-Name}" -> 'bob' (7) User-Name = "bob" (7) expand: "%{request:Session-timeout}" -> '' (7) *Session-timeout = 0* (7) } # update outer.reply = noop (7) } # post-auth = ok } # server inner-tunnel
Thanks
Jake He
On Fri, May 16, 2014 at 12:42 PM, * <zhex900@gmail.com> wrote:
Hi,
Does Session-Timeout attribute needs to be in Access-Accept? Currently my radius send Session-Timeout in Access-Challenge.
If so, how I do configure the radius to send Session-Timeout in Access-Accept?
Jake He
Hi, i really do not know what is going on there, you do not need to do this to disconnect user, this i unlang coding. used to manipulate replies. perhaps some expert can help you. i am really not very good in that. Thanks On Fri, May 16, 2014 at 10:02 AM, * <zhex900@gmail.com> wrote:
Hi,
I kind of know what the problem is now. Hopefully, I am heading in the right direction. This post<http://freeradius.1045715.n5.nabble.com/Sending-an-attribute-with-the-Access-Accept-instead-of-Access-Challenge-td3338454.html> gave me some ideas.
I added the following in inner-tunnel. How do I set the value of the Session-Timeout attribute correctly?
update outer.reply { User-Name = "%{request:User-Name}" Session-timeout = "%{request:Session-timeout}" }
But the radiusd -X shows Session-timeout = 0
(7) update outer.reply { (7) expand: "%{request:User-Name}" -> 'bob' (7) User-Name = "bob" (7) expand: "%{request:Session-timeout}" -> '' (7) *Session-timeout = 0* (7) } # update outer.reply = noop (7) } # post-auth = ok } # server inner-tunnel
Thanks
Jake He
On Fri, May 16, 2014 at 12:42 PM, * <zhex900@gmail.com> wrote:
Hi,
Does Session-Timeout attribute needs to be in Access-Accept? Currently my radius send Session-Timeout in Access-Challenge.
If so, how I do configure the radius to send Session-Timeout in Access-Accept?
Jake He
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi On Tue, May 13, 2014 at 1:31 AM, * <zhex900@gmail.com> wrote:
Hi,
I followed your instructions. Now I get the following errors:
(2) [-sql] = ok (2) [expiration] = noop (2) [logintime] = noop (2) WARNING: pap : Auth-Type already set. Not setting to PAP (2) [pap] = noop (2) dailycounter : Entering module authorize code (2) ERROR: dailycounter : %{sql:SELECT SUM(acctsessiontime) FROM radacct WHERE username = '%{User-Name}' AND acctstarttime BETWEEN FROM_UNIXTIME('%b') AND FROM_UNIXTIME('%e')} (2) ERROR: dailycounter : ^ Invalid variable expansion (2) [dailycounter] = fail (2) } # authorize = fail (2) Using Post-Auth-Type Reject
/etc/freeradius/mods-enabled/sqlcounter
sqlcounter dailycounter{ counter_name = "Daily-Session-Time" check_name = "Max-Daily-Session" reply_name = "Session-Timeout" sql_module_instance = "sql" key = "User-Name" reset = "daily" cache-size = 5000 query = "SELECT SUM(acctsessiontime) FROM radacct WHERE username = '%{${ key}}' AND acctstarttime BETWEEN FROM_UNIXTIME('%b') AND FROM_UNIXTIME('%e')" }
Could you please make sure if the above query is in one line or use "\" to break the line. it is indicating some wrong expression in the query. carefully check your daily counter. it would work.
On Mon, May 12, 2014 at 11:27 PM, Russell Mike <radius.sir@gmail.com>wrote:
Do the following
STEP 1:
nano counters.conf
sqlcounter dailycounter {
counter-name = "Daily-Session-Time"
check-name = "Max-Daily-Session"
reply-name = "Session-Timeout"
sqlmod-inst = "sql"
key = "User-Name"
reset = "daily"
cache-size = 5000
query = "SELECT SUM(acctsessiontime) FROM radacct WHERE username = '%{%k}' AND acctstarttime BETWEEN FROM_UNIXTIME('%b') AND FROM_UNIXTIME('%e')"
}
STEP 2:
nano radiusd.conf
instantiate {
dailycounter
}
STEP 3:
nano sites-available/default
authorize {
dailycounter
}
STEP 4:
accounting {
sql
}
STEP 5: LOOK, THIS MUST BE *CHECK & REPLY* ITEM NOT CHECK ONLY. BOB IS ALLOWED FOR 60 MINUTES, VALUE IS IN SECONDS.
Max-Daily-Session := 3600
STEP 6: Restart Radius Daemon RM --
On Mon, May 12, 2014 at 11:28 AM, * <zhex900@gmail.com> wrote:
Hi,
I have to follow this tutorial to get the the session limit working. But looking at the debug output it seems the sql counter is not executed. No Session-Timeout is sent to NAS as well.
Accounting is working fine. I can see all the accounting information radacct time.
Here is my configuration. Please let me know if I should provide more information.
Jake He
FreeRADIUS V. 3
mods-enabled/sqlcounter
sqlcounter noresetcounter { sql_module_instance = sql #dialect = ${sql_module_instance}.dialect dialect = mysql counter_name = Daily-Session-Time check_name = Max-Daily-Session reply_name = Session-Timeout key = User-Name reset = never query = “SELECT SUM(AcctSessionTime) FROM radacct where UserName=’%{%k}’” }
sites-enabled/default:
authorize {
preprocess chap mschap suffix eap files sql pap noresetcounter }
radcheck: Max-Daily-Session:=60 for the user bob
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I checked, it is in one line. I have attached the sqlcounter file. Jake He On Tue, May 13, 2014 at 3:55 PM, Russell Mike <radius.sir@gmail.com> wrote:
Hi
On Tue, May 13, 2014 at 1:31 AM, * <zhex900@gmail.com> wrote:
Hi,
I followed your instructions. Now I get the following errors:
(2) [-sql] = ok (2) [expiration] = noop (2) [logintime] = noop (2) WARNING: pap : Auth-Type already set. Not setting to PAP (2) [pap] = noop (2) dailycounter : Entering module authorize code (2) ERROR: dailycounter : %{sql:SELECT SUM(acctsessiontime) FROM radacct WHERE username = '%{User-Name}' AND acctstarttime BETWEEN FROM_UNIXTIME('%b') AND FROM_UNIXTIME('%e')} (2) ERROR: dailycounter : ^ Invalid variable expansion (2) [dailycounter] = fail (2) } # authorize = fail (2) Using Post-Auth-Type Reject
/etc/freeradius/mods-enabled/sqlcounter
sqlcounter dailycounter{ counter_name = "Daily-Session-Time" check_name = "Max-Daily-Session" reply_name = "Session-Timeout" sql_module_instance = "sql" key = "User-Name" reset = "daily" cache-size = 5000 query = "SELECT SUM(acctsessiontime) FROM radacct WHERE username = '%{${ key}}' AND acctstarttime BETWEEN FROM_UNIXTIME('%b') AND FROM_UNIXTIME('%e')" }
Could you please make sure if the above query is in one line or use "\" to break the line. it is indicating some wrong expression in the query. carefully check your daily counter. it would work.
On Mon, May 12, 2014 at 11:27 PM, Russell Mike <radius.sir@gmail.com>wrote:
Do the following
STEP 1:
nano counters.conf
sqlcounter dailycounter {
counter-name = "Daily-Session-Time"
check-name = "Max-Daily-Session"
reply-name = "Session-Timeout"
sqlmod-inst = "sql"
key = "User-Name"
reset = "daily"
cache-size = 5000
query = "SELECT SUM(acctsessiontime) FROM radacct WHERE username = '%{%k}' AND acctstarttime BETWEEN FROM_UNIXTIME('%b') AND FROM_UNIXTIME('%e')"
}
STEP 2:
nano radiusd.conf
instantiate {
dailycounter
}
STEP 3:
nano sites-available/default
authorize {
dailycounter
}
STEP 4:
accounting {
sql
}
STEP 5: LOOK, THIS MUST BE *CHECK & REPLY* ITEM NOT CHECK ONLY. BOB IS ALLOWED FOR 60 MINUTES, VALUE IS IN SECONDS.
Max-Daily-Session := 3600
STEP 6: Restart Radius Daemon RM --
On Mon, May 12, 2014 at 11:28 AM, * <zhex900@gmail.com> wrote:
Hi,
I have to follow this tutorial to get the the session limit working. But looking at the debug output it seems the sql counter is not executed. No Session-Timeout is sent to NAS as well.
Accounting is working fine. I can see all the accounting information radacct time.
Here is my configuration. Please let me know if I should provide more information.
Jake He
FreeRADIUS V. 3
mods-enabled/sqlcounter
sqlcounter noresetcounter { sql_module_instance = sql #dialect = ${sql_module_instance}.dialect dialect = mysql counter_name = Daily-Session-Time check_name = Max-Daily-Session reply_name = Session-Timeout key = User-Name reset = never query = “SELECT SUM(AcctSessionTime) FROM radacct where UserName=’%{%k}’” }
sites-enabled/default:
authorize {
preprocess chap mschap suffix eap files sql pap noresetcounter }
radcheck: Max-Daily-Session:=60 for the user bob
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
it is important to take your time, look and work carefully. i sent you correct counter but you did not use it. I can still see wrong query in your "dailycounter" file, use this counter. i also indicated in my mail earlier that there is something wrong in the query. You did not check it ? compare with my email i sent earlier ? this is not good. Put your little efforts as well before you can solve this problem. sqlcounter dailycounter{ counter_name = "Daily-Session-Time" check_name = "Max-Daily-Session" reply_name = "Session-Timeout" sql_module_instance = "sql" key = "User-Name" reset = "daily" cache-size = 5000 query = "SELECT IFNULL(TIME_TO_SEC(TIMEDIFF(NOW(), MIN(AcctStartTime))),0) FROM radacct WHERE UserName='%{%k}' ORDER BY AcctStartTime LIMIT 1;" } Thanks / --RM On Tue, May 13, 2014 at 8:08 AM, * <zhex900@gmail.com> wrote:
I checked, it is in one line. I have attached the sqlcounter file.
Jake He
On Tue, May 13, 2014 at 3:55 PM, Russell Mike <radius.sir@gmail.com>wrote:
Hi
On Tue, May 13, 2014 at 1:31 AM, * <zhex900@gmail.com> wrote:
Hi,
I followed your instructions. Now I get the following errors:
(2) [-sql] = ok (2) [expiration] = noop (2) [logintime] = noop (2) WARNING: pap : Auth-Type already set. Not setting to PAP (2) [pap] = noop (2) dailycounter : Entering module authorize code (2) ERROR: dailycounter : %{sql:SELECT SUM(acctsessiontime) FROM radacct WHERE username = '%{User-Name}' AND acctstarttime BETWEEN FROM_UNIXTIME('%b') AND FROM_UNIXTIME('%e')} (2) ERROR: dailycounter : ^ Invalid variable expansion (2) [dailycounter] = fail (2) } # authorize = fail (2) Using Post-Auth-Type Reject
/etc/freeradius/mods-enabled/sqlcounter
sqlcounter dailycounter{ counter_name = "Daily-Session-Time" check_name = "Max-Daily-Session" reply_name = "Session-Timeout" sql_module_instance = "sql" key = "User-Name" reset = "daily" cache-size = 5000 query = "SELECT SUM(acctsessiontime) FROM radacct WHERE username = '%{${ key}}' AND acctstarttime BETWEEN FROM_UNIXTIME('%b') AND FROM_UNIXTIME('%e')" }
Could you please make sure if the above query is in one line or use "\" to break the line. it is indicating some wrong expression in the query. carefully check your daily counter. it would work.
On Mon, May 12, 2014 at 11:27 PM, Russell Mike <radius.sir@gmail.com>wrote:
Do the following
STEP 1:
nano counters.conf
sqlcounter dailycounter {
counter-name = "Daily-Session-Time"
check-name = "Max-Daily-Session"
reply-name = "Session-Timeout"
sqlmod-inst = "sql"
key = "User-Name"
reset = "daily"
cache-size = 5000
query = "SELECT SUM(acctsessiontime) FROM radacct WHERE username = '%{%k}' AND acctstarttime BETWEEN FROM_UNIXTIME('%b') AND FROM_UNIXTIME('%e')"
}
STEP 2:
nano radiusd.conf
instantiate {
dailycounter
}
STEP 3:
nano sites-available/default
authorize {
dailycounter
}
STEP 4:
accounting {
sql
}
STEP 5: LOOK, THIS MUST BE *CHECK & REPLY* ITEM NOT CHECK ONLY. BOB IS ALLOWED FOR 60 MINUTES, VALUE IS IN SECONDS.
Max-Daily-Session := 3600
STEP 6: Restart Radius Daemon RM --
On Mon, May 12, 2014 at 11:28 AM, * <zhex900@gmail.com> wrote:
Hi,
I have to follow this tutorial to get the the session limit working. But looking at the debug output it seems the sql counter is not executed. No Session-Timeout is sent to NAS as well.
Accounting is working fine. I can see all the accounting information radacct time.
Here is my configuration. Please let me know if I should provide more information.
Jake He
FreeRADIUS V. 3
mods-enabled/sqlcounter
sqlcounter noresetcounter { sql_module_instance = sql #dialect = ${sql_module_instance}.dialect dialect = mysql counter_name = Daily-Session-Time check_name = Max-Daily-Session reply_name = Session-Timeout key = User-Name reset = never query = “SELECT SUM(AcctSessionTime) FROM radacct where UserName=’%{%k}’” }
sites-enabled/default:
authorize {
preprocess chap mschap suffix eap files sql pap noresetcounter }
radcheck: Max-Daily-Session:=60 for the user bob
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (5)
-
* -
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Arran Cudbard-Bell -
Russell Mike