I am using pptp with radiusclient, and a mysql backend. The problem is that the radiusclient puts in too many entries into the database. Below is a copy of one client connecting and disconnecting. The problem appears to be that for the second entry there is never a acctstoptime entered into the databse, or is there a way to make it so only entry is entered into the database. where is just says 0000-00-00 00:00:00. mysql> select * from radacct; +-----------+----------------+------------------+-----------------+-----------+-------+--------------+-----------+-------------+---------------------+---------------------+-----------------+---------------+-------------------+------------------+-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+-----------------+----------------+---------------+----------------------+---------------------+ | radacctid | acctsessionid | acctuniqueid | username | groupname | realm | nasipaddress | nasportid | nasporttype | acctstarttime | acctstoptime | acctsessiontime | acctauthentic | connectinfo_start | connectinfo_stop | acctinputoctets | acctoutputoctets | calledstationid | callingstationid | acctterminatecause | servicetype | framedprotocol | framedipaddress | acctstartdelay | acctstopdelay | xascendsessionsvrkey | LastUpdate | +-----------+----------------+------------------+-----------------+-----------+-------+--------------+-----------+-------------+---------------------+---------------------+-----------------+---------------+-------------------+------------------+-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+-----------------+----------------+---------------+----------------------+---------------------+ | 1 | 4F3C72A5117D00 | 4fed5006f373739c | user@domain.com | | | 108.59.9.35 | 0 | Async | 2012-02-16 04:06:13 | 0000-00-00 00:00:00 | 0 | RADIUS | | | 0 | 0 | | 22.11.45.88 | | Framed-User | PPP | 10.80.72.1 | 0 | 0 | | 2012-02-16 04:06:13 | | 2 | 4F3C72A5117D01 | 19f60e897a312d37 | user@domain.com | | | 108.59.9.35 | 0 | Async | 2012-02-16 04:06:13 | 2012-02-16 04:06:16 | 3 | RADIUS | | | 792 | 0 | | 22.11.45.88 | User-Request | Framed-User | PPP | 10.80.72.1 | 0 | 0 | | 2012-02-16 04:06:16 | +-----------+----------------+------------------+-----------------+-----------+-------+--------------+-----------+-------------+---------------------+---------------------+-----------------+---------------+-------------------+------------------+-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+-----------------+----------------+---------------+----------------------+---------------------+ 2 rows in set (0.00 sec) Thanks
On Thu, Feb 16, 2012 at 10:13 AM, Ski Mountain <ski_the_mountain@yahoo.com> wrote:
The problem appears to be that for the second entry there is never a acctstoptime entered into the databse,
Both entries have DIFFERENT acctsessionid (and thus, different acctuniqueid). That means the NAS is sending acct for two different sessions.
or is there a way to make it so only entry is entered into the database. where is just says 0000-00-00 00:00:00.
Blame the NAS. It's possible that: - on the first record, the NAS is only sending acct-stop - an acct-stop packet is lost - you modified the default scheme, since by default an accounting record without acct-stop would have NULL in acctstoptime I suggest you: (1) log acct packets to detail file as well. e.g. accounting { ... detail sql ... } that way you can examine the detail file later to see what packets FR recieved from the NAS. That way you can correctly determine which of the three possibilites above actually happen (2) add an additional column: acct-status-type, and modify the sql queries accordingly. Similar to the above, but this way you can quickly determine whether an acct-stop packet is lost. -- Fajar
I did not modify the default schema. I am just using the radius client that is in debian in order to authenicate pptp clients. Everything is on the same server so it is not a issue with packets being lost. i radiusclient1 - /bin/login replacement which uses the RADIUS protocol for authentication I do blame the nas and have cursed at pptp quite a bit, not I just want the dam thing to only send one radacct packet. ----- Original Message ----- From: Fajar A. Nugraha <list@fajar.net> To: Ski Mountain <ski_the_mountain@yahoo.com>; FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Cc: Sent: Wednesday, February 15, 2012 10:48 PM Subject: Re: duplicate radacct entries On Thu, Feb 16, 2012 at 10:13 AM, Ski Mountain <ski_the_mountain@yahoo.com> wrote:
The problem appears to be that for the second entry there is never a acctstoptime entered into the databse,
Both entries have DIFFERENT acctsessionid (and thus, different acctuniqueid). That means the NAS is sending acct for two different sessions.
or is there a way to make it so only entry is entered into the database. where is just says 0000-00-00 00:00:00.
Blame the NAS. It's possible that: - on the first record, the NAS is only sending acct-stop - an acct-stop packet is lost - you modified the default scheme, since by default an accounting record without acct-stop would have NULL in acctstoptime I suggest you: (1) log acct packets to detail file as well. e.g. accounting { ... detail sql ... } that way you can examine the detail file later to see what packets FR recieved from the NAS. That way you can correctly determine which of the three possibilites above actually happen (2) add an additional column: acct-status-type, and modify the sql queries accordingly. Similar to the above, but this way you can quickly determine whether an acct-stop packet is lost. -- Fajar
On Thu, Feb 16, 2012 at 11:21 AM, Ski Mountain <ski_the_mountain@yahoo.com> wrote:
I did not modify the default schema.
are you REALLY sure? the default sql schema does NOT have a last update column :)
I am just using the radius client that is in debian in order to authenicate pptp clients. Everything is on the same server so it is not a issue with packets being lost.
then most likely something's wrong with the NAS configuration
i radiusclient1 - /bin/login replacement which uses the RADIUS protocol for authentication
I do blame the nas and have cursed at pptp quite a bit, not I just want the dam thing to only send one radacct packet.
I have setup poptop and openvpn setup which can send acct packets just fine. As usual, if you're still having problems, ask an expert to help you. -- Fajar
I guess I did make some updates to that version that actully broke the Simultaneous-Use := 1 that I needed. Below is the current version, where i reinstated the default sechema. I think the heart of the problem is the fact that below is just one connection(that created two entries), then I disconnected. It only updates acctstoptime in one of the entries. mysql> select * from radacct; +-----------+----------------+------------------+-----------------+-----------+-------+--------------+-----------+-------------+---------------------+---------------------+-----------------+---------------+-------------------+------------------+-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+-----------------+----------------+---------------+----------------------+ | radacctid | acctsessionid | acctuniqueid | username | groupname | realm | nasipaddress | nasportid | nasporttype | acctstarttime | acctstoptime | acctsessiontime | acctauthentic | connectinfo_start | connectinfo_stop | acctinputoctets | acctoutputoctets | calledstationid | callingstationid | acctterminatecause | servicetype | framedprotocol | framedipaddress | acctstartdelay | acctstopdelay | xascendsessionsvrkey | +-----------+----------------+------------------+-----------------+-----------+-------+--------------+-----------+-------------+---------------------+---------------------+-----------------+---------------+-------------------+------------------+-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+-----------------+----------------+---------------+----------------------+ | 1 | 4F3C899014E700 | c72b782da444ddad | user@domain.com | | | 108.59.9.35 | 0 | Async | 2012-02-16 05:44:00 | NULL | 0 | RADIUS | | | 0 | 0 | | 146.115.45.88 | | Framed-User | PPP | 10.80.72.1 | 0 | 0 | | | 2 | 4F3C899014E701 | 3a28576fec37b3cd | user@domain.com | | | 108.59.9.35 | 0 | Async | 2012-02-16 05:44:00 | 2012-02-16 05:44:02 | 2 | RADIUS | | | 792 | 0 | | 146.115.45.88 | User-Request | Framed-User | PPP | 10.80.72.1 | 0 | 0 | | +-----------+----------------+------------------+-----------------+-----------+-------+--------------+-----------+-------------+---------------------+---------------------+-----------------+---------------+-------------------+------------------+-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+-----------------+----------------+---------------+----------------------+ 2 rows in set (0.00 sec) ----- Original Message ----- From: Fajar A. Nugraha <list@fajar.net> To: Ski Mountain <ski_the_mountain@yahoo.com> Cc: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Sent: Wednesday, February 15, 2012 11:38 PM Subject: Re: duplicate radacct entries On Thu, Feb 16, 2012 at 11:21 AM, Ski Mountain <ski_the_mountain@yahoo.com> wrote:
I did not modify the default schema.
are you REALLY sure? the default sql schema does NOT have a last update column :)
I am just using the radius client that is in debian in order to authenicate pptp clients. Everything is on the same server so it is not a issue with packets being lost.
then most likely something's wrong with the NAS configuration
i radiusclient1 - /bin/login replacement which uses the RADIUS protocol for authentication
I do blame the nas and have cursed at pptp quite a bit, not I just want the dam thing to only send one radacct packet.
I have setup poptop and openvpn setup which can send acct packets just fine. As usual, if you're still having problems, ask an expert to help you. -- Fajar
On Thu, Feb 16, 2012 at 11:47 AM, Ski Mountain <ski_the_mountain@yahoo.com> wrote:
I think the heart of the problem is the fact that below is just one connection(that created two entries), then I disconnected. It only updates acctstoptime in one of the entries.
... which is why I said blame the NAS. It's possible that two different process created the records, e.g: - pptpd (with radius plugin) create the complete acct record - login shell (or whatever other process that uses PAM and is invoked in your setup) create the record with only acct-start-time. If you log the packets to detail file, you can examine those two packets and look at the difference. Not all attributes is recorded in sql, but all received attributes is logged in detail file. -- Fajar
participants (2)
-
Fajar A. Nugraha -
Ski Mountain