0

sqlcounter expire_on_login mysql freeradius rlm_sqlcounter

I'm trying to set access period time by first login of client first I enable sqlcounter module in mode-enable folder OS version: Ubuntu 18.04 and Freeradius version: 3.0.16

The sqlcounter file contain following :

#/etc/freeradius/3.0/mods-enabled/sqlcounter
sqlcounter expire_on_login {
        sql_module_instance = sql
        dialect = mysql

        counter_name = Expire-After-Initial-Login
        check_name = Expire-After
        key = User-Name
        reset = never      
        query = "\
              SELECT IFNULL( MAX(TIME_TO_SEC(TIMEDIFF(NOW(), acctstarttime))),0) \
              FROM radacct \
              WHERE UserName='%{${key}}' \
              ORDER BY acctstarttime \
              LIMIT 1;"
}

In /etc/freeradius/3.0/sites-available/default file, I add the following under

authorize {
  expire_on_login

After I add restriction in radchceck table in phpmyadmin by following code:

INSERT INTO radcheck ( id , UserName , Attribute , op , Value ) VALUES (NULL , 'zaib', 'Expire-After', '=', '3600');

And finally test the user access by following command: radtest zaib zaib localhost 1812 testing123.

The result is:

    User-Name = "zaib"
    User-Password = "zaib"
    NAS-IP-Address = 192.168.22.101
    NAS-Port = 1812
    Message-Authenticator = 0x00
    Cleartext-Password = "zaib"
Received Access-Reject Id 167 from 127.0.0.1:1812 to 0.0.0.0:0 length 20
(0) -: Expected Access-Accept got Access-Reject

In freeradius -xxX log output, I see:

Fri May 10 18:56:30 2019 : WARNING: (0) expire_on_login: Couldn't find check attribute, control:Expire-After, doing nothing...

And also:

Fri May 10 18:56:30 2019 : ERROR: (0) No Auth-Type found: rejecting the user via Post-Auth-Type = Reject

I tried to change op option in sql from =to := and after that I get following results:

Sent Access-Request Id 72 from 0.0.0.0:42845 to 127.0.0.1:1812 length 74
    User-Name = "zaib"
    User-Password = "zaib"
    NAS-IP-Address = 192.168.22.101
    NAS-Port = 1812
    Message-Authenticator = 0x00
    Cleartext-Password = "zaib"
Received Access-Accept Id 72 from 127.0.0.1:1812 to 0.0.0.0:0 length 39
    Mikrotik-Rate-Limit = "1024k/1024k"

It seems fine but restriction doesn't work at all , user can access after end of period.

In free radius log I see :

Fri May 10 18:56:30 2019 : WARNING: (0) expire_on_login: Couldn't find check attribute, control:Expire-After, doing nothing...

And also in MySQL radacct table when user is logged in I can see acctstarttime value it's like this : 2019-05-10 15:20:46

Any idea how to fix this ? Please help me, thanks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.