Situation: I have fully configured and working Freeradius server. Installed OVPN 2.6.4 on other server. And goal is auth through Radius. Installed pam-radius-auth. Configured (confs below). Authentication is working just fine, but there are no Accounting packets from OVPN. When I'm trying pamtester - everyting is ok, accounting is here, but when I connected OVPN - no.


account required      pam_radius_auth.so
auth    required      pam_radius_auth.so conf=/etc/pam.d/pam_radius_auth.conf debug
session required      pam_radius_auth.so


<My Radius server ip>  <Shared secret>       3


setenv deferred_auth_pam 1
plugin /usr/lib/x86_64-linux-gnu/openvpn/plugins/openvpn-plugin-auth-pam.so ovpn
verify-client-cert none
key-direction 0
local *<IPaddr>*
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA256
tls-crypt tc.key
topology subnet
server-ipv6 fddd:1194:1194:1194::/64
push "redirect-gateway def1 ipv6 bypass-dhcp"
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS"
push "dhcp-option DNS"
push "block-outside-dns"
push "explicit-exit-notify 3"
keepalive 10 120
cipher AES-128-GCM
user nobody
group nogroup
verb 3
crl-verify crl.pem
explicit-exit-notify 1
management 7555
log-append /var/log/openvpn/openvpn.log
txqueuelen 4000

What I missing?

  • welcome, Questions seeking installation, configuration or diagnostic help must include the desired end state, the specific problem or error, sufficient information about the configuration and environment to reproduce it, and attempted solutions. Questions without a clear problem statement are not useful to other readers and are unlikely to get good answers. as also verify that you applied all details of How to Ask
    – djdomi
    Jun 15 at 17:54

2 Answers 2


I did several implementations like yours of Freeradius and learned a lot during that time. And I probably know what you are "missing" if I understood your question/problem correctly.

Here we go:

Your configuration looks fine.
However, authentication and accounting are two separate components of the Radius Protocol. The plugin/module you use pam-radius-auth only does authentication. The plugin/module does not have the capability to send Radius accounting packets.

If you check the following website of OpenVPN Plugin Overview, you will see in the plugin overview, the topic radiusplugin.
I used: ValdikSS openvpn-radiusplugin which worked for me at the time. It also had, still has I see, a nice readme with configuration examples. But I see there are more radius plugins available on the OpenVPN website, so check the plugins out and find the best one which suits your quality standards and needs.

Also a nice article that explains Radius Accounting: How does Radius accounting work

Good Luck!

  • Can you show me really working configs. And versions of OVPN etc
    – Comandante
    Jun 15 at 20:58
  • Sorry, it was in my job 4/5 years ago. So, no versions prolly you can see it when you check the version releases. Maybe I have some configuration examples in my old notes. If you still need it, I'll check it out tomorrow.
    – Bombaci
    Jun 16 at 21:24
  • If you'll find some configs it will be great. Problem solved for me, but any additional information are very useful.
    – Comandante
    Jun 17 at 13:35
  • I just checked my old notes. Nothing really in there about this. However, this tutorial is also very extensive: how to configure accounting
    – Bombaci
    Jun 18 at 12:40

Well, ok, I've found this patch https://github.com/ValdikSS/openvpn-radiusplugin/issues/14

And after recompiling accounting works, at least on Acc-Start. But on closing session from client there is no changes in DB. I have unclosed session in radius.

  • I've got it. Old clients do not correctly send sigterm signal to 2.6 OVPN. OVPN disconnected session after some timeout. In any way I think - question solved.
    – Comandante
    Jun 16 at 12:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .