Hmm. No NAS, using radtest or radclient to simulate what needs to happen. I created a single radacct record for a test user with a null stop time and I expect the auth to fail unless the group Simultaneous-Use is overwitten by a user specific radcheck attribute of the same name. This works: mysql> select * from radgroupcheck; +----+--------------------+------------------+----+-------+ | id | groupname | attribute | op | value | +----+--------------------+------------------+----+-------+ | 1 | Package2MB | Simultaneous-Use | = | 1 | mysql> select * from radcheck where username like 'test@livenet.bm'; +-----+-----------------+--------------------+----+---------+ | id | username | attribute | op | value | +-----+-----------------+--------------------+----+---------+ | 1 | test@livenet.bm | Cleartext-Password | := | test123 | | 584 | test@livenet.bm | Simultaneous-Use | := | 3 | mysql> select * from radusergroup where username like 'test@livenet.bm'; +-----------------+------------+----------+ | username | groupname | priority | +-----------------+------------+----------+ | test@livenet.bm | Package2MB | 1 | +-----------------+------------+----------+ But if the radcheck table doesn't have the Simultaneous-Use entry, the auth is allowed. Bill On 1/2/2017 3:26 PM, Alan DeKok wrote:

On Jan 2, 2017, at 2:25 PM, Bill Schoolfield <bill@billmax.com> wrote:

...

I have a client that wanted his customers limited to a single connection. So I implemented:

mysql> select * from radgroupcheck; +----+--------------------+------------------+----+-------+ | id | groupname | attribute | op | value | +----+--------------------+------------------+----+-------+ | 1 | Package2MB | Simultaneous-Use | := | 1 |

After some time and 100's of subscribers he now wants on a case by case (ie user) basis to allow multiple simultaneous sessions.

I thought I just add Simultaneous-Use to radcheck for those users and use the "appropriate" operators. That should work. If the NAS is sending accounting packets.

...

I can't seem to get this to work. I'm trying to avoid dropping the use of radgroupcheck and adding the Simultaneous-Use radcheck attribute to all users. WHat's going wrong?

...

Is this possible? What operators do I use? I used '=' in radgroupcheck and that succeeded in allowing the radcheck item to "override" the radgroupcheck item but the check fails if no radcheck item exists (as will be the case in many instances). Use ":=" for the operator.

Alan DeKok.

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

I assume the condition for simultaneous use is already met so no additional accounting record is needed to conduct the test. Perhaps I'm mistaken... I have looked at debug but it's difficult as lots of other (production) things are going on... Bill On 1/2/2017 3:46 PM, Alan DeKok wrote:

...

On Jan 2, 2017, at 4:44 PM, Bill Schoolfield <bill@billmax.com> wrote:

Hmm. No NAS, using radtest or radclient to simulate what needs to happen. You need to send accounting "start" packets, too. We should really have automated tests for this...

...

I created a single radacct record for a test user with a null stop time and I expect the auth to fail unless the group Simultaneous-Use is overwitten by a user specific radcheck attribute of the same name.

This works:

mysql> select * from radgroupcheck; +----+--------------------+------------------+----+-------+ | id | groupname | attribute | op | value | +----+--------------------+------------------+----+-------+ | 1 | Package2MB | Simultaneous-Use | = | 1 |

mysql> select * from radcheck where username like 'test@livenet.bm'; +-----+-----------------+--------------------+----+---------+ | id | username | attribute | op | value | +-----+-----------------+--------------------+----+---------+ | 1 | test@livenet.bm | Cleartext-Password | := | test123 | | 584 | test@livenet.bm | Simultaneous-Use | := | 3 |

mysql> select * from radusergroup where username like 'test@livenet.bm'; +-----------------+------------+----------+ | username | groupname | priority | +-----------------+------------+----------+ | test@livenet.bm | Package2MB | 1 | +-----------------+------------+----------+

But if the radcheck table doesn't have the Simultaneous-Use entry, the auth is allowed. As always, read the debug output to see what's going on.

Alan DeKok.

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html