Hello everyone, I need a lil advice from you FreeRADIUS gurus, as i'm having a bit of trouble in understanding the database structure from the examples and schema available on the project wiki. Let's say i successfully managed to bind freeRADIUS to mysql, i can connect it and no errors are present, i created all proper tables, and database accounts to have freeRADIUS talk to mysql. the problem is.. ok but now, which informations do i put where? i'd start from a simple example.. let's say i have the user "testuser" "cleartext-password" := "testpassword" if i add this values in the radcheck table, i can successfully authenticate testuser from my NAS. Now let's say i'd like to limit the user for using the service for only 1 hour a day. if i recall correctly there is a parameter that says: Max-Daily-Session := 3600 (seconds) but, where do i have to add this value? still to the radcheck? or radreply? or where else? i also noticed that the radacct table contains one account for each time i perform a login for the specific user, is it normal? is there a table that contains usernames in a unique manner? so that i can eventually link it to another table containing further informations about the user (name, surname etc?) sorry if i ask here but really i couldn't understand this from the wiki :( thanks in advice.
Rampage wrote:
Let's say i successfully managed to bind freeRADIUS to mysql, i can connect it and no errors are present, i created all proper tables, and database accounts to have freeRADIUS talk to mysql.
the problem is.. ok but now, which informations do i put where?
See doc/rlm_sql.
i'd start from a simple example..
let's say i have the user
"testuser" "cleartext-password" := "testpassword"
if i add this values in the radcheck table, i can successfully authenticate testuser from my NAS.
That's how it works.
Now let's say i'd like to limit the user for using the service for only 1 hour a day. if i recall correctly there is a parameter that says:
Max-Daily-Session := 3600 (seconds)
but, where do i have to add this value? still to the radcheck? or radreply? or where else?
In radcheck.
i also noticed that the radacct table contains one account for each time i perform a login for the specific user, is it normal?
That's what your NAS is telling it to do. The NAS is sending an accounting "start" for each login. And probably no "stop"
is there a table that contains usernames in a unique manner?
Only if you create it.
so that i can eventually link it to another table containing further informations about the user (name, surname etc?)
Only if you create it. The default schema does what's needed for RADIUS. It doesn't do anything else.
sorry if i ask here but really i couldn't understand this from the wiki :(
It's good to ask *specific* questions. Like " I read page X paragraph Y, and didn't understand concept Z". That lets us help you with the details. Saying "I didn't understand things" means our response is "What part of the documentation is unclear?" Alan DeKok.
Il 12/06/2012 23:11, Alan DeKok ha scritto:
Rampage wrote:
i also noticed that the radacct table contains one account for each time i perform a login for the specific user, is it normal? That's what your NAS is telling it to do. The NAS is sending an accounting "start" for each login. And probably no "stop"
Thanks for your reply, actually i think a stop is sent because it's registered in the radacct table: mysql> select * from radacct\G *************************** 1. row *************************** radacctid: 1 acctsessionid: e1dcb98e63c83cb5 acctuniqueid: f258863473f21879 username: ciccio groupname: realm: nasipaddress: 192.168.10.1 nasportid: 2 nasporttype: Ethernet acctstarttime: 2012-06-12 11:28:00 acctstoptime: 2012-06-12 12:28:00 acctsessiontime: 3600 acctauthentic: RADIUS connectinfo_start: connectinfo_stop: acctinputoctets: 5347401 acctoutputoctets: 66632775 calledstationid: 192.168.10.1 callingstationid: 00-0c-29-70-97-19 acctterminatecause: Session-Timeout servicetype: Login-User framedprotocol: framedipaddress: 192.168.10.103 acctstartdelay: 0 acctstopdelay: 0 xascendsessionsvrkey: acctstoptime seems to be the timestamp of when the NAS sends the stop, still the entry from the db is not deleted, so i have an entry for each session start, i'm worried that this might cause an infinite database grouth in the future when the service goes in production environment. the NAS is the PfSense captive portal, which afaik is a chillispot. thanks Francesco
On Wed, Jun 13, 2012 at 5:08 AM, Rampage <atomikramp@email.it> wrote:
acctstoptime seems to be the timestamp of when the NAS sends the stop, still the entry from the db is not deleted, so i have an entry for each session start,
That's the default setup. Most people will need the historical accounting records for e.g. calculating remaining usage for quota-based users, or simply for reporting.
i'm worried that this might cause an infinite database grouth in the future when the service goes in production environment.
You need to maintain it :) If you DON'T need accounting records, then either: - don't use sql on accounting section, OR - modify the queries (sql/mysql/dialup.conf) to do what you want (e.g. delete the record on acct stop)
the NAS is the PfSense captive portal, which afaik is a chillispot.
Chillispot should work fine. Depending on what you need, you might want to turn on interim update (via Acct-Interim-Interval reply attribute). Make sure it's larger than 60 seconds though, otherwise chillispot will ignore it. -- Fajar
participants (3)
-
Alan DeKok -
Fajar A. Nugraha -
Rampage