Hello everybody, I simply and correctly setup my ubuntu linux box to use freeradius authentication; actually the problem is that I'm not able to use radius accounting. I think that I correctly setup my radius server to use sql as accounting mode but the radius server neither receives accounting packets from the client (I see it starting the server with the -XXX option). The only "accounting" thing that it's saving in the sql db is the post auth section that inserts a line for a correct authentication response. on the client side I only modified the pam - gdm configuration file that is #%PAM-1.0 auth requisite pam_nologin.so auth sufficient pam_radius_auth.so auth required pam_env.so readenv=1 auth required pam_env.so readenv=1 envfile=/etc/default/locale @include common-auth auth optional pam_gnome_keyring.so account required pam_radius_auth.so @include common-account session required pam_limits.so @include common-session session optional pam_gnome_keyring.so auto_start @include common-password whitch step have I forgotten? what's wrong? thank you for your help, sub
sub wrote:
Hello everybody, I simply and correctly setup my ubuntu linux box to use freeradius authentication; actually the problem is that I'm not able to use radius accounting. I think that I correctly setup my radius server to use sql as accounting mode but the radius server neither receives accounting packets from the client (I see it starting the server with the -XXX option). The only "accounting" thing that it's saving in the sql db is the post auth section that inserts a line for a correct authentication response.
on the client side I only modified the pam - gdm configuration file that is
#%PAM-1.0 auth requisite pam_nologin.so auth sufficient pam_radius_auth.so auth required pam_env.so readenv=1 auth required pam_env.so readenv=1 envfile=/etc/default/locale @include common-auth auth optional pam_gnome_keyring.so account required pam_radius_auth.so @include common-account session required pam_limits.so @include common-session session optional pam_gnome_keyring.so auto_start @include common-password
whitch step have I forgotten? what's wrong?
I don't know if the pam_radius_auth module does accounting; try adding it to the "session" config
thank you for your help, sub - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Sun, Apr 20, 2008 at 6:46 PM, Phil Mayers <p.mayers@imperial.ac.uk> wrote:
I don't know if the pam_radius_auth module does accounting; try adding it to the "session" config
I tried putting the line in the session section and it really works. the server received an accounting request of "start" at the user login and an accounting-request "stop" at logout. it's ok but what I really need is accounting because I can't wait for the user action to save informations in the db. In the page of the project (http://www.freeradius.org/pam_radius_auth/) I see "This is the PAM to RADIUS authentication module. It allows any PAM-capable machine to become a RADIUS client for authentication and accounting requests." so I think that the pam_radius_auth module shoud support acconting :-p furthermore at this page we've an example of the pam configuration file. http://www.freeradius.org/pam_radius_auth/USAGE some help? sub
sub wrote:
I tried putting the line in the session section and it really works. the server received an accounting request of "start" at the user login and an accounting-request "stop" at logout.
So it is receiving accounting packets. That's how accounting works.
it's ok but what I really need is accounting because I can't wait for the user action to save informations in the db.
This sentence makes no sense. You want... some kind of accounting which is independent of user login and logout? What kind of magic accounting is that?
In the page of the project (http://www.freeradius.org/pam_radius_auth/) I see "This is the PAM to RADIUS authentication module. It allows any PAM-capable machine to become a RADIUS client for authentication and accounting requests." so I think that the pam_radius_auth module shoud support acconting :-p
It does. You verified that it does. It sends accounting stop/start messages. That is what accounting *means*.
furthermore at this page we've an example of the pam configuration file. http://www.freeradius.org/pam_radius_auth/USAGE
some help?
Perhaps you could explain what you mean by "what I really need is accounting"... and why the existing, standards-compliant accounting in the module isn't sufficient for your needs. Or maybe you're thinking of something else other than accounting? Alan DeKok.
On Sun, Apr 20, 2008 at 8:05 PM, Alan DeKok <aland@deployingradius.com> wrote:
sub wrote:
it's ok but what I really need is accounting because I can't wait for the user action to save informations in the db.
This sentence makes no sense.
You want... some kind of accounting which is independent of user login and logout? What kind of magic accounting is that?
Alan, what I was expecting (but I'm not an expert, it's possible that it's not a radius feature and I misunderstood it) is that the client periodically sends accounting-request packets ("I'm alive!") to the server and so the server updates the sql db. I don't want something magic but if the users enters and he has only one more minute for his daily session, he we'll be able to be logged if he doesn't logoff by hand. (...)
Or maybe you're thinking of something else other than accounting? Alan DeKok.
maybe I misundersood how radius accounting works... thanks for your help, sub
sub wrote:
what I was expecting (but I'm not an expert, it's possible that it's not a radius feature and I misunderstood it) is that the client periodically sends accounting-request packets ("I'm alive!") to the server and so the server updates the sql db.
It would have helped to say that. Instead, you said: "it does accounting start and stop, but I want it do accounting!" And due to the way that PAM works, it's impossible to send "alive" packets. The pam_radius module is called *only* for start/stop. So it *only* sends start/stop packets.
I don't want something magic but if the users enters and he has only one more minute for his daily session, he we'll be able to be logged if he doesn't logoff by hand.
I don't understand that sentence. I *think* you're trying to ask if the PAM module supports Session-Timeout. And no, it doesn't, because PAM has no such capability.
maybe I misundersood how radius accounting works...
Explain what you mean using full sentences. The more explanation the better. Leaving words out means that it's difficult to understand you. Alan DeKok.
On Sun, Apr 20, 2008 at 8:45 PM, Alan DeKok <aland@deployingradius.com> wrote:
sub wrote:
what I was expecting (but I'm not an expert, it's possible that it's not a radius feature and I misunderstood it) is that the client periodically sends accounting-request packets ("I'm alive!") to the server and so the server updates the sql db.
It would have helped to say that. Instead, you said: "it does accounting start and stop, but I want it do accounting!"
yes, you're right...sorry.
And due to the way that PAM works, it's impossible to send "alive" packets. The pam_radius module is called *only* for start/stop. So it *only* sends start/stop packets.
ok, instead I was trying to see if I could receive "alive" packets as I said.
I don't want something magic but if the users enters and he has only one more minute for his daily session, he we'll be able to be logged if he doesn't logoff by hand.
I don't understand that sentence.
I *think* you're trying to ask if the PAM module supports Session-Timeout. And no, it doesn't, because PAM has no such capability.
yes. More or less I have a radius accounting server and I hoped it was able to send pam a timeout valued for the user. The nicest thing would have been some kind of "disconnect" message sent by the server to the client in order to logoff the user. But I understood it's not possible.
maybe I misundersood how radius accounting works...
Explain what you mean using full sentences. The more explanation the better. Leaving words out means that it's difficult to understand you.
Alan DeKok. -
thanks a lot for your help! sub
I tried putting the line in the session section and it really works. the server received an accounting request of "start" at the user login and an accounting-request "stop" at logout. it's ok but what I really need is accounting because I can't wait for the user action to save informations in the db.
??? That's how accounting works. You might try returning Acct-Interim-Interval (normal values are between 10 and 30 minutes) to see if you will get updates for longer sessions. If you are thinking of restricting sessions than have a look at Session-Timeout and Idle-Timeout attributes. Again no guarantee that pam module supports them. Ivan Kalik Kalik Informatika iSP
Hi to all. I know that this is FR mailing list but I'm looking for some material about pppoe server on freebsd and freeradius as a radius server. So, please send me some links for reading.. Thanks
Marinko Tarlac schrieb:
Hi to all. I know that this is FR mailing list but I'm looking for some material about pppoe server on freebsd and freeradius as a radius server.
So, please send me some links for reading..
Thanks - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
see: http://www.freeantennas.com/PPPoE-Server-HOWTO.html It is a howto for Linux but you could somehow usr the techniques described there for BSD. We have a setup like this and it is working quite good. Michael.
Marinko Tarlac schrieb:
Hi to all. I know that this is FR mailing list but I'm looking for some material about pppoe server on freebsd and freeradius as a radius server.
So, please send me some links for reading..
Thanks
Already do not learn it? http://www.google.ru/search?complete=1&hl=ru&lr=&newwindow=1&client=firefox-... The first link: http://www.iplab-nnz.ru/blog/index.php?op=ViewArticle&articleId=22&blogId=1 It on Russian, but I think you will understand
Thanks... As I can see they use freeNibs. I made my own billing system for Mikrotik and now I want to test it on another platform. See ya in couple days with some results... :) snaut@snaut.ru wrote:
Marinko Tarlac schrieb:
Hi to all. I know that this is FR mailing list but I'm looking for some material about pppoe server on freebsd and freeradius as a radius server.
So, please send me some links for reading..
Thanks
Already do not learn it? http://www.google.ru/search?complete=1&hl=ru&lr=&newwindow=1&client=firefox-...
The first link: http://www.iplab-nnz.ru/blog/index.php?op=ViewArticle&articleId=22&blogId=1 It on Russian, but I think you will understand
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (7)
-
Alan DeKok -
Ivan Kalik -
Marinko Tarlac -
Michael Schwartzkopff -
Phil Mayers -
snaut＠snaut.ru -
sub