Bill Isaacs wrote: > Ok so the question then is: where the hell is radclient getting the > notion that the account has 2366393 seconds left?
From the RADIUS server. This isn't magic. radclient doesn't invent attributes in reply packets. It receives them from the RADIUS server. > Alan, take a deep breath. Of course I've looked at the debug output. > Note my opening sentence, ol' pardner. ;) Well... your question about "where does radclient get that value from" is entirely missing the point. It gets it from the RADIUS server. I've said this. I have no idea how to convince you it's true. And the *only* way to debug the RADIUS server is to look at the debug output. And no, your original message did *not* say you had run the server in debugging mode. There's only a reference to creating an account for debugging purposes. There's no "radiusd -X" output. My frustration here is that the documentation and my messages cannot possibly be any more clear. Yet you're wandering around doing everything *but* what the documentation says, and then wondering why I'm getting annoyed. Run the server in debugging mode. Really. Do it. I mean it. If you want to track down the issue to a specific module, update the config to do: update reply { Reply-Message += "A %{reply:Session-Timeout}" } Cut & paste that through various pieces of authorize, post-auth, etc. Change the "A" to "B", "C", etc. You should see 10-20 Reply-Messages in the Access-Accept. Each with a value for Session-Timeout. That lets you track *what* the value is, and *where* in the config the value is coming from. Then once you know it's a particular module, you can figure out how to fix that module. Right now, you're staring at the radclient output, wondering why the server isn't working. That's a mistake. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html