On 02/08/2013 09:50 AM, Alan DeKok wrote:
Bill Isaacs wrote:
Ok so the question then is: where the hell is radclient getting the
notion that the account has 2366393 seconds left?
From the RADIUS server. This isn't magic. radclient doesn't invent
attributes in reply packets. It receives them from the RADIUS server.
Well... your question about "where does radclient get that value from"
is entirely missing the point. It gets it from the RADIUS server. I've
said this. I have no idea how to convince you it's true.
Alan, you're so much more fun when you're not being myopic. lol Of
course it's getting the answer from the radius server. You really think
I don't know that?
And the *only* way to debug the RADIUS server is to look at the debug
output.
And no, your original message did *not* say you had run the server in
debugging mode. There's only a reference to creating an account for
debugging purposes. There's no "radiusd -X" output.
You're quite right Alan, it didn't. NOR did I say that it did. To
paraphrase you, "You're staring at the first sentence, wondering where
the debug output is. That's a mistake". :D
What I DID say was "I'm researching this anomaly myself in all the
documentation, but thought it would also be helpful /both to me and to
others/ to post the problem here." (emphasis added).
What I implied in the ensuing message was that it would be posted here
once I tracked the message down, but that posting it and the solution
in nice digestible pieces for those not familiar at all with radius
would be helpful to them. I suspect if you went to decaf and quit
asking 'why' others don't just do what should be done, you would have
understood that.
Take a deep breath. Read between the lines, and realize that if others
understood radius the way you do, you'd be out of a job (at least on the
board here). I'm trying to make this fun, and be worthwhile as a
thread. So caaalm down. ok? I'll post the debug output along with
what it reveals as soon as I've worked it all out thoroughly. Trust me. :)
... why I'm
getting annoyed.
See "decaf" above.
If you want to track down the issue to a specific module, update the
config to do:
update reply {
Reply-Message += "A %{reply:Session-Timeout}"
}
Cut & paste that through various pieces of authorize, post-auth, etc.
Change the "A" to "B", "C", etc. You should see 10-20 Reply-Messages
in the Access-Accept. Each with a value for Session-Timeout. That lets
you track *what* the value is, and *where* in the config the value is
coming from.
Then once you know it's a particular module, you can figure out how to
fix that module.
Now *there* is a wholly useful piece of information. Bravo! Sooner or
later, we'll clear out enough of the rants to expose goodies, no? :D
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
