Freeradius with daily counter
Hi I did setup Freeradius with SQL backend and connected it to a l2tp vpn server. Connecting works great and accounting is logged into the radacct table. So far so good, now I am experimenting with limits. And I chose daily session time to test out first. I did insert into radcheck "where username is obviously test" test Max-Daily-Session := 100000000 When I did that, logon fails Now, here is where I might have messed up In sites-enabled/default I did uncomment authorise{ # Enforce daily limits on time spent logged in. daily and accounting { daily In radiusd.conf I did uncomment instantiate { # We add the counter module here so that it registers # the check-name attribute before any module which sets # it daily modules/counter includes counter daily { filename = ${db_dir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session reply-name = Session-Timeout allowed-servicetype = Framed-User cache-size = 5000 } When I start radiusd -X I can see the following : radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_counter Module: Instantiating module "daily" from file /etc/raddb/modules/counter counter daily { filename = "/etc/raddb/db.daily" key = "User-Name" reset = "daily" count-attribute = "Acct-Session-Time" counter-name = "Daily-Session-Time" check-name = "Max-Daily-Session" reply-name = "Session-Timeout" allowed-servicetype = "Framed-User" cache-size = 5000 } rlm_counter: Counter attribute Daily-Session-Time is number 11273 rlm_counter: Current Time: 1405421724 [2014-07-15 05:55:24], Next reset 1405486800 [2014-07-16 00:00:00] rlm_counter: Failed to open file /etc/raddb/db.daily: Permission denied /etc/raddb/modules/counter[71]: Instantiation failed for module "daily" What strikes me as weird is why does freeradius try to look in db.daily which does not exist, instead of the MySQL table radacct ? I did try to create a file db.daily "just for testing" and seLinux is disabled. [root@localhost raddb]# ls -lart /etc/raddb/db.daily -rw-r--r-- 1 root radiusd 0 Jul 15 05:35 /etc/raddb/db.daily [root@localhost raddb]# getenforce Disabled This is more or less a default CentOS RPM installation user and group are listed below user = radiusd group = radiusd Am I barking up the wrong tree here ? Any pointers in the right directions please? Regards
On Tue, Jul 15, 2014 at 5:59 PM, Ali Jawad <alijawad1@gmail.com> wrote:
counter daily {
filename = ${db_dir}/db.daily
rlm_counter: Failed to open file /etc/raddb/db.daily: Permission denied
/etc/raddb/modules/counter[71]: Instantiation failed for module "daily"
What strikes me as weird is why does freeradius try to look in db.daily which does not exist, instead of the MySQL table radacct ?
counter -> store data in a file (gdbm) sqlcounter -> use accounting data stored in sql
Any pointers in the right directions please?
Try http://wiki.freeradius.org/modules/Rlm_sqlcounter -- Fajar
Hi Fajar Thanks for the input, so if I use dailycounter instead of daily, and of course dailycounter is defined in sql/mysql/counter.conf does freeradius automatically know that it should look into sql counter.conf, or should I comment out counter without db ? Regards On Tue, Jul 15, 2014 at 1:25 PM, Fajar A. Nugraha <list@fajar.net> wrote:
On Tue, Jul 15, 2014 at 5:59 PM, Ali Jawad <alijawad1@gmail.com> wrote:
counter daily {
filename = ${db_dir}/db.daily
rlm_counter: Failed to open file /etc/raddb/db.daily: Permission denied
/etc/raddb/modules/counter[71]: Instantiation failed for module "daily"
What strikes me as weird is why does freeradius try to look in db.daily which does not exist, instead of the MySQL table radacct ?
counter -> store data in a file (gdbm) sqlcounter -> use accounting data stored in sql
Any pointers in the right directions please?
Try http://wiki.freeradius.org/modules/Rlm_sqlcounter
-- Fajar - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Tue, Jul 15, 2014 at 6:33 PM, Ali Jawad <alijawad1@gmail.com> wrote:
Hi Fajar Thanks for the input, so if I use dailycounter instead of daily, and of course dailycounter is defined in sql/mysql/counter.conf does freeradius automatically know that it should look into sql counter.conf, or should I
Have you read the configuration file (i.e. radiusd.conf)? If not, please do. Here's the upstream version (I assume you use distro-bundled FR-2.x): https://github.com/FreeRADIUS/freeradius-server/blob/v2.x.x/raddb/radiusd.co...
comment out counter without db ?
In general, only use/activate the modules you need. Do you need the counter module? -- Fajar
Regards
On Tue, Jul 15, 2014 at 1:25 PM, Fajar A. Nugraha <list@fajar.net> wrote:
On Tue, Jul 15, 2014 at 5:59 PM, Ali Jawad <alijawad1@gmail.com> wrote:
counter daily {
filename = ${db_dir}/db.daily
rlm_counter: Failed to open file /etc/raddb/db.daily: Permission denied
/etc/raddb/modules/counter[71]: Instantiation failed for module "daily"
What strikes me as weird is why does freeradius try to look in db.daily which does not exist, instead of the MySQL table radacct ?
counter -> store data in a file (gdbm) sqlcounter -> use accounting data stored in sql
Any pointers in the right directions please?
Try http://wiki.freeradius.org/modules/Rlm_sqlcounter
-- Fajar - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Dear Fajar
That worked beautifully, thanks ! Can you point me in the direction of
setting up daily BW limits as well please ?
Regards
On Tue, Jul 15, 2014 at 1:59 PM, Fajar A. Nugraha <list@fajar.net> wrote:
> On Tue, Jul 15, 2014 at 6:33 PM, Ali Jawad <alijawad1@gmail.com> wrote:
> > Hi Fajar
> > Thanks for the input, so if I use dailycounter instead of daily, and of
> > course dailycounter is defined in sql/mysql/counter.conf does freeradius
> > automatically know that it should look into sql counter.conf, or should I
>
> Have you read the configuration file (i.e. radiusd.conf)? If not, please
> do.
>
> Here's the upstream version (I assume you use distro-bundled FR-2.x):
>
> https://github.com/FreeRADIUS/freeradius-server/blob/v2.x.x/raddb/radiusd.conf.in#L746
>
>
>
> > comment out counter without db ?
>
> In general, only use/activate the modules you need. Do you need the
> counter module?
>
> --
> Fajar
>
> > Regards
> >
> >
> > On Tue, Jul 15, 2014 at 1:25 PM, Fajar A. Nugraha <list@fajar.net>
> wrote:
> >>
> >> On Tue, Jul 15, 2014 at 5:59 PM, Ali Jawad <alijawad1@gmail.com> wrote:
> >> > counter daily {
> >> >
> >> > filename = ${db_dir}/db.daily
> >>
> >>
> >> > rlm_counter: Failed to open file /etc/raddb/db.daily: Permission
> denied
> >> >
> >> > /etc/raddb/modules/counter[71]: Instantiation failed for module
> "daily"
> >>
> >> > What strikes me as weird is why does freeradius try to look in
> db.daily
> >> > which does not exist, instead of the MySQL table radacct ?
> >>
> >> counter -> store data in a file (gdbm)
> >> sqlcounter -> use accounting data stored in sql
> >>
> >>
> >> > Any pointers in the right directions please?
> >>
> >> Try http://wiki.freeradius.org/modules/Rlm_sqlcounter
> >>
> >> --
> >> Fajar
> >> -
> >> List info/subscribe/unsubscribe? See
> >> http://www.freeradius.org/list/users.html
> >
> >
> >
> > -
> > List info/subscribe/unsubscribe? See
> > http://www.freeradius.org/list/users.html
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
>
I assume you already read the wiki page which has examples for time limits?
If you only enforce one of time or BW, you can adjust the counter
(i.e. dailycounter) to use the one you need. The column that holds BW
information from radacct should be acctinputoctets and
acctoutputoctets (doublecheck with your actual schema).
Try something like this (untested, from memory)
sqlcounter dailycounter {
...
query = "SELECT SUM(acctinputoctets + acctoutputoctets) FROM
radacct WHERE UserName='%{${key}}' AND UNIX_TIMESTAMP(acctstarttime) +
acctsessiontime > '%b'"
}
see sql.counter.conf for more details (including what '%b' is, and a
more sql-friendly query).
--
Fajar
On Wed, Jul 16, 2014 at 5:29 AM, Ali Jawad <alijawad1@gmail.com> wrote:
> Dear Fajar
> That worked beautifully, thanks ! Can you point me in the direction of
> setting up daily BW limits as well please ?
> Regards
>
>
> On Tue, Jul 15, 2014 at 1:59 PM, Fajar A. Nugraha <list@fajar.net> wrote:
>>
>> On Tue, Jul 15, 2014 at 6:33 PM, Ali Jawad <alijawad1@gmail.com> wrote:
>> > Hi Fajar
>> > Thanks for the input, so if I use dailycounter instead of daily, and of
>> > course dailycounter is defined in sql/mysql/counter.conf does freeradius
>> > automatically know that it should look into sql counter.conf, or should
>> > I
>>
>> Have you read the configuration file (i.e. radiusd.conf)? If not, please
>> do.
>>
>> Here's the upstream version (I assume you use distro-bundled FR-2.x):
>>
>> https://github.com/FreeRADIUS/freeradius-server/blob/v2.x.x/raddb/radiusd.conf.in#L746
>>
>>
>>
>> > comment out counter without db ?
>>
>> In general, only use/activate the modules you need. Do you need the
>> counter module?
>>
>> --
>> Fajar
>>
>> > Regards
>> >
>> >
>> > On Tue, Jul 15, 2014 at 1:25 PM, Fajar A. Nugraha <list@fajar.net>
>> > wrote:
>> >>
>> >> On Tue, Jul 15, 2014 at 5:59 PM, Ali Jawad <alijawad1@gmail.com> wrote:
>> >> > counter daily {
>> >> >
>> >> > filename = ${db_dir}/db.daily
>> >>
>> >>
>> >> > rlm_counter: Failed to open file /etc/raddb/db.daily: Permission
>> >> > denied
>> >> >
>> >> > /etc/raddb/modules/counter[71]: Instantiation failed for module
>> >> > "daily"
>> >>
>> >> > What strikes me as weird is why does freeradius try to look in
>> >> > db.daily
>> >> > which does not exist, instead of the MySQL table radacct ?
>> >>
>> >> counter -> store data in a file (gdbm)
>> >> sqlcounter -> use accounting data stored in sql
>> >>
>> >>
>> >> > Any pointers in the right directions please?
>> >>
>> >> Try http://wiki.freeradius.org/modules/Rlm_sqlcounter
>> >>
>> >> --
>> >> Fajar
>> >> -
>> >> List info/subscribe/unsubscribe? See
>> >> http://www.freeradius.org/list/users.html
>> >
>> >
>> >
>> > -
>> > List info/subscribe/unsubscribe? See
>> > http://www.freeradius.org/list/users.html
>> -
>> List info/subscribe/unsubscribe? See
>> http://www.freeradius.org/list/users.html
>
>
>
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
participants (2)
-
Ali Jawad -
Fajar A. Nugraha