Good day. I'm having problems with rlm_counter on FreeRADIUS Version 1.1.7. I've set my NAS to send Stop/Start packets every minute, but it only refreshes count once. That means once an user is logged in, it will count his first minute but then he will be able to access indefinitely.
My user ----------------- Prueba3 User-Password == "a", Simultaneous-Use += 5, Max-Daily-Session := 300 Session-Timeout := 60 ----------------- My conf ----------------- prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid #user = nobody #group = nobody max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = 192.168.63.1 port = 1892 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = yes log_auth_badpass = yes log_auth_goodpass = yes usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { chap { authtype = CHAP } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session cache-size = 5000 } counter weekly { filename = ${raddbdir}/db.weekly key = User-Name count-attribute = Acct-Session-Time reset = weekly counter-name = Weekly-Session-Time check-name = Max-Weekly-Session cache-size = 5000 } counter monthly { filename = ${raddbdir}/db.monthly key = User-Name count-attribute = Acct-Session-Time reset = monthly counter-name = Monthly-Session-Time check-name = Max-Monthly-Session cache-size = 5000 } counter forever { filename = ${raddbdir}/db.forever key = User-Name count-attribute = Acct-Session-Time reset = never counter-name = Forever-Session-Time check-name = Max-Forever-Session cache-size = 5000 } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } } instantiate { daily weekly monthly forever } authorize { preprocess chap files daily weekly monthly forever } authenticate { Auth-Type CHAP { chap } } preacct { preprocess acct_unique files } accounting { detail daily weekly monthly forever radutmp } session { radutmp #sql } post-auth { } ----------------- Here is it starting: ------------------ Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1892 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: bind_address = 192.168.63.1 IP address [192.168.63.1] main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded Counter counter: filename = "/usr/local/etc/raddb/db.daily" counter: key = "User-Name" counter: reset = "daily" counter: count-attribute = "Acct-Session-Time" counter: counter-name = "Daily-Session-Time" counter: check-name = "Max-Daily-Session" counter: allowed-servicetype = "(null)" counter: cache-size = 5000 rlm_counter: Counter attribute Daily-Session-Time is number 1830 rlm_counter: Current Time: 1253729323 [2009-09-23 18:08:43], Next reset 1253750400 [2009-09-24 00:00:00] Module: Instantiated counter (daily) counter: filename = "/usr/local/etc/raddb/db.weekly" counter: key = "User-Name" counter: reset = "weekly" counter: count-attribute = "Acct-Session-Time" counter: counter-name = "Weekly-Session-Time" counter: check-name = "Max-Weekly-Session" counter: allowed-servicetype = "(null)" counter: cache-size = 5000 rlm_counter: Counter attribute Weekly-Session-Time is number 1832 rlm_counter: Current Time: 1253729323 [2009-09-23 18:08:43], Next reset 1254009600 [2009-09-27 00:00:00] Module: Instantiated counter (weekly) counter: filename = "/usr/local/etc/raddb/db.monthly" counter: key = "User-Name" counter: reset = "monthly" counter: count-attribute = "Acct-Session-Time" counter: counter-name = "Monthly-Session-Time" counter: check-name = "Max-Monthly-Session" counter: allowed-servicetype = "(null)" counter: cache-size = 5000 rlm_counter: Counter attribute Monthly-Session-Time is number 1834 rlm_counter: Current Time: 1253729323 [2009-09-23 18:08:43], Next reset 1254355200 [2009-10-01 00:00:00] Module: Instantiated counter (monthly) counter: filename = "/usr/local/etc/raddb/db.forever" counter: key = "User-Name" counter: reset = "never" counter: count-attribute = "Acct-Session-Time" counter: counter-name = "Forever-Session-Time" counter: check-name = "Max-Forever-Session" counter: allowed-servicetype = "(null)" counter: cache-size = 5000 rlm_counter: Counter attribute Forever-Session-Time is number 1836 rlm_counter: Current Time: 1253729323 [2009-09-23 18:08:43], Next reset 0 [2009-09-23 18:00:00] Module: Instantiated counter (forever) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication 192.168.63.1:1892 Listening on accounting 192.168.63.1:1893 Ready to process requests. ------------------ Here is it logging in fine ------------------ rad_recv: Access-Request packet from host 192.168.63.1:3422, id=172, length=130 NAS-IP-Address = 192.168.11.146 NAS-Identifier = "pfSense.local" User-Name = "Prueba3" User-Password = "a" Service-Type = Login-User NAS-Port-Type = Ethernet NAS-Port = 0 Framed-IP-Address = 192.168.63.132 Called-Station-Id = "08:00:27:dc:bf:b1" Calling-Station-Id = "00:16:76:60:3d:81" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 users: Matched entry Prueba3 at line 1 modcall[authorize]: module "files" returns ok for request 0 rlm_counter: Entering module authorize code rlm_counter: Searching the database for key 'Prueba3' rlm_counter: Key Found. rlm_counter: Check item = 300, Count = 22 rlm_counter: res is greater than zero rlm_counter: (Check item - counter) is greater than zero rlm_counter: Authorized user Prueba3, check_item=300, counter=22 rlm_counter: Sent Reply-Item for user Prueba3, Type=Session-Timeout, value=278 modcall[authorize]: module "daily" returns ok for request 0 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "weekly" returns noop for request 0 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "monthly" returns noop for request 0 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "forever" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: type Local auth: user supplied User-Password matches local User-Password Processing the session section of radiusd.conf modcall: entering group session for request 0 radius_xlat: '/var/log/radutmp' radius_xlat: 'Prueba3' modcall[session]: module "radutmp" returns ok for request 0 modcall: leaving group session (returns ok) for request 0 Login OK: [Prueba3/a] (from client Local port 0 cli 00:16:76:60:3d:81) Sending Access-Accept of id 172 to 192.168.63.1 port 3422 Session-Timeout := 60 Finished request 0 ------------------------ Here it is complaining it only works with Stop/Start ------------------------ rad_recv: Accounting-Request packet from host 192.168.63.1:12908, id=175, length=142 NAS-IP-Address = 192.168.11.146 NAS-Identifier = "pfSense.local" User-Name = "Prueba3" Acct-Status-Type = Start Acct-Authentic = RADIUS Service-Type = Login-User NAS-Port-Type = Ethernet NAS-Port = 0 Acct-Session-Id = "01e56ba6b4be990c" Framed-IP-Address = 192.168.63.132 Called-Station-Id = "08:00:27:dc:bf:b1" Calling-Station-Id = "00:16:76:60:3d:81" Processing the preacct section of radiusd.conf modcall: entering group preacct for request 1 modcall[preacct]: module "preprocess" returns noop for request 1 rlm_acct_unique: Hashing 'NAS-Port = 0,Client-IP-Address = 192.168.63.1,NAS-IP-Address = 192.168.11.146,Acct-Session-Id = "01e56ba6b4be990c",User-Name = "Prueba3"' rlm_acct_unique: Acct-Unique-Session-ID = "c968f78b6779a240". modcall[preacct]: module "acct_unique" returns ok for request 1 modcall[preacct]: module "files" returns noop for request 1 modcall: leaving group preacct (returns ok) for request 1 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 1 radius_xlat: '/var/log/radacct/192.168.63.1/detail-20090923' rlm_detail: /var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radacct/192.168.63.1/detail-20090923 modcall[accounting]: module "detail" returns ok for request 1 rlm_counter: We only run on Accounting-Stop packets. modcall[accounting]: module "daily" returns noop for request 1 rlm_counter: We only run on Accounting-Stop packets. modcall[accounting]: module "weekly" returns noop for request 1 rlm_counter: We only run on Accounting-Stop packets. modcall[accounting]: module "monthly" returns noop for request 1 rlm_counter: We only run on Accounting-Stop packets. modcall[accounting]: module "forever" returns noop for request 1 radius_xlat: '/var/log/radutmp' radius_xlat: 'Prueba3' modcall[accounting]: module "radutmp" returns ok for request 1 modcall: leaving group accounting (returns ok) for request 1 Sending Accounting-Response of id 175 to 192.168.63.1 port 12908 Finished request 1 ------------------------ Here is it updating counters on the first Stop/Start ------------------------ rad_recv: Accounting-Request packet from host 192.168.63.1:24160, id=190, length=196 NAS-IP-Address = 192.168.11.146 NAS-Identifier = "pfSense.local" User-Name = "Prueba3" Acct-Status-Type = Stop Acct-Session-Time = 39 Acct-Authentic = RADIUS Service-Type = Login-User NAS-Port-Type = Ethernet NAS-Port = 0 Acct-Session-Id = "01e56ba6b4be990c" Framed-IP-Address = 192.168.63.132 Called-Station-Id = "08:00:27:dc:bf:b1" Calling-Station-Id = "00:16:76:60:3d:81" Acct-Input-Packets = 84 Acct-Input-Octets = 6610 Acct-Input-Gigawords = 0 Acct-Output-Packets = 103 Acct-Output-Octets = 140013 Acct-Output-Gigawords = 0 Acct-Session-Time = 39 Acct-Terminate-Cause = NAS-Request Processing the preacct section of radiusd.conf modcall: entering group preacct for request 2 modcall[preacct]: module "preprocess" returns noop for request 2 rlm_acct_unique: Hashing 'NAS-Port = 0,Client-IP-Address = 192.168.63.1,NAS-IP-Address = 192.168.11.146,Acct-Session-Id = "01e56ba6b4be990c",User-Name = "Prueba3"' rlm_acct_unique: Acct-Unique-Session-ID = "c968f78b6779a240". modcall[preacct]: module "acct_unique" returns ok for request 2 modcall[preacct]: module "files" returns noop for request 2 modcall: leaving group preacct (returns ok) for request 2 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 2 radius_xlat: '/var/log/radacct/192.168.63.1/detail-20090923' rlm_detail: /var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radacct/192.168.63.1/detail-20090923 modcall[accounting]: module "detail" returns ok for request 2 rlm_counter: Packet Unique ID = 'c968f78b6779a240' rlm_counter: Searching the database for key 'Prueba3' rlm_counter: Key found. rlm_counter: Counter Unique ID = '015d06e249366c2b' rlm_counter: User=Prueba3, Counter=22. rlm_counter: User=Prueba3, New Counter=61. rlm_counter: Storing new value in database. rlm_counter: New value stored successfully. modcall[accounting]: module "daily" returns ok for request 2 rlm_counter: Packet Unique ID = 'c968f78b6779a240' rlm_counter: Searching the database for key 'Prueba3' rlm_counter: Key found. rlm_counter: Counter Unique ID = '015d06e249366c2b' rlm_counter: User=Prueba3, Counter=40. rlm_counter: User=Prueba3, New Counter=79. rlm_counter: Storing new value in database. rlm_counter: New value stored successfully. modcall[accounting]: module "weekly" returns ok for request 2 rlm_counter: Packet Unique ID = 'c968f78b6779a240' rlm_counter: Searching the database for key 'Prueba3' rlm_counter: Key found. rlm_counter: Counter Unique ID = '015d06e249366c2b' rlm_counter: User=Prueba3, Counter=40. rlm_counter: User=Prueba3, New Counter=79. rlm_counter: Storing new value in database. rlm_counter: New value stored successfully. modcall[accounting]: module "monthly" returns ok for request 2 rlm_counter: Packet Unique ID = 'c968f78b6779a240' rlm_counter: Searching the database for key 'Prueba3' rlm_counter: Key found. rlm_counter: Counter Unique ID = '015d06e249366c2b' rlm_counter: User=Prueba3, Counter=40. rlm_counter: User=Prueba3, New Counter=79. rlm_counter: Storing new value in database. rlm_counter: New value stored successfully. modcall[accounting]: module "forever" returns ok for request 2 radius_xlat: '/var/log/radutmp' radius_xlat: 'Prueba3' modcall[accounting]: module "radutmp" returns ok for request 2 modcall: leaving group accounting (returns ok) for request 2 Sending Accounting-Response of id 190 to 192.168.63.1 port 24160 Finished request 2 ---------------------------- Here it is refusing to update on Stop/Start ---------------------------- rad_recv: Access-Request packet from host 192.168.63.1:28882, id=33, length=130 NAS-IP-Address = 192.168.11.146 NAS-Identifier = "pfSense.local" User-Name = "Prueba3" User-Password = "a" Service-Type = Login-User NAS-Port-Type = Ethernet NAS-Port = 0 Framed-IP-Address = 192.168.63.132 Called-Station-Id = "08:00:27:dc:bf:b1" Calling-Station-Id = "00:16:76:60:3d:81" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 users: Matched entry Prueba3 at line 1 modcall[authorize]: module "files" returns ok for request 4 rlm_counter: Entering module authorize code rlm_counter: Searching the database for key 'Prueba3' rlm_counter: Key Found. rlm_counter: Check item = 300, Count = 61 rlm_counter: res is greater than zero rlm_counter: (Check item - counter) is greater than zero rlm_counter: Authorized user Prueba3, check_item=300, counter=61 rlm_counter: Sent Reply-Item for user Prueba3, Type=Session-Timeout, value=239 modcall[authorize]: module "daily" returns ok for request 4 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "weekly" returns noop for request 4 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "monthly" returns noop for request 4 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "forever" returns noop for request 4 modcall: leaving group authorize (returns ok) for request 4 auth: type Local auth: user supplied User-Password matches local User-Password Processing the session section of radiusd.conf modcall: entering group session for request 4 radius_xlat: '/var/log/radutmp' radius_xlat: 'Prueba3' modcall[session]: module "radutmp" returns ok for request 4 modcall: leaving group session (returns ok) for request 4 Login OK: [Prueba3/a] (from client Local port 0 cli 00:16:76:60:3d:81) Sending Access-Accept of id 33 to 192.168.63.1 port 28882 Session-Timeout := 60 Finished request 4 ---------------------- And after that, on every reauthentication, the count value remains the same, so count will never be larger than 300. ---------------------- rad_recv: Access-Request packet from host 192.168.63.1:18612, id=32, length=130 NAS-IP-Address = 192.168.11.146 NAS-Identifier = "pfSense.local" User-Name = "Prueba3" User-Password = "a" Service-Type = Login-User NAS-Port-Type = Ethernet NAS-Port = 0 Framed-IP-Address = 192.168.63.132 Called-Station-Id = "08:00:27:dc:bf:b1" Calling-Station-Id = "00:16:76:60:3d:81" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 users: Matched entry Prueba3 at line 1 modcall[authorize]: module "files" returns ok for request 7 rlm_counter: Entering module authorize code rlm_counter: Searching the database for key 'Prueba3' rlm_counter: Key Found. rlm_counter: Check item = 300, Count = 61 rlm_counter: res is greater than zero rlm_counter: (Check item - counter) is greater than zero rlm_counter: Authorized user Prueba3, check_item=300, counter=61 rlm_counter: Sent Reply-Item for user Prueba3, Type=Session-Timeout, value=239 modcall[authorize]: module "daily" returns ok for request 7 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "weekly" returns noop for request 7 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "monthly" returns noop for request 7 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "forever" returns noop for request 7 modcall: leaving group authorize (returns ok) for request 7 auth: type Local auth: user supplied User-Password matches local User-Password Processing the session section of radiusd.conf modcall: entering group session for request 7 radius_xlat: '/var/log/radutmp' radius_xlat: 'Prueba3' modcall[session]: module "radutmp" returns ok for request 7 modcall: leaving group session (returns ok) for request 7 Login OK: [Prueba3/a] (from client Local port 0 cli 00:16:76:60:3d:81) Sending Access-Accept of id 32 to 192.168.63.1 port 18612 Session-Timeout := 60 Finished request 7 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html