Hotspot success setup?
-
Periko- I have tried this setup on PFsense 2.0.2 according to the FR2 Docs the issue was patched on this release, however it remains in my case. I created 2 users in FR2 "hour" and "day" and have CP with start/stop accounting. The bug continues where it disconnects them after a few minutes with the same error. i am putting below the log of the system log with the error.
Hour had 60 minutes and was logged of after 5 with and when i try to go back in it would tell me the time had expired and day had 1440 minutes and the same message.
Is there a patch i must install on the 2.0.2?
Jan 10 17:42:09
logportalauth[25696]: USER LOGIN: hour, 3c:d9:2b:1f:1f:0b, 192.168.1.100
Jan 10 17:42:17
logportalauth[25696]: USER LOGIN: hour, 3c:d9:2b:1f:1f:0b, 192.168.1.100
Jan 10 17:42:17
logportalauth[25696]: CONCURRENT LOGIN - REUSING OLD SESSION: hour, 3c:d9:2b:1f:1f:0b, 192.168.1.100
Jan 10 17:50:44
logportalauth[25696]: DISCONNECT: hour, 3c:d9:2b:1f:1f:0b, 192.168.1.100
Jan 10 18:14:58
logportalauth[25696]: USER LOGIN: hour, 3c:d9:2b:1f:1f:0b, 192.168.1.100
Jan 10 18:19:45
logportalauth[5388]: RADIUS_DISCONNECT: hour, 3c:d9:2b:1f:1f:0b, 192.168.1.100, Your maximum never usage time has been reached
Jan 10 23:31:24
logportalauth[25087]: Restarting captive portal.
Jan 10 18:31:51
logportalauth[10022]: FAILURE: hour, 3c:d9:2b:1f:1f:0b, 192.168.1.100, Your maximum never usage time has been reached
Jan 10 18:34:29
logportalauth[10022]: USER LOGIN: day, 3c:d9:2b:1f:1f:0b, 192.168.1.100
Jan 10 19:28:02
logportalauth[12243]: RADIUS_DISCONNECT: day, 3c:d9:2b:1f:1f:0b, 192.168.1.100, Your maximum never usage time has been reached
Jan 11 08:19:17
logportalauth[10022]: FAILURE: day, 3c:d9:2b:1f:1f:0b, 192.168.1.100, Your maximum never usage time has been reached
Jan 10 19:22:58
radiusd[23151]: rlm_radutmp: Logout for NAS CP port 3, but no Login record
Jan 10 19:22:58
radiusd[23151]: rlm_radutmp: Logout for NAS CP port 3, but no Login record
Jan 10 19:22:58
radiusd[23151]: Login OK: [day] (from client CP port 3 cli 3c:d9:2b:1f:1f:0b)
Jan 10 19:22:58
radiusd[23151]: Login OK: [day] (from client CP port 3 cli 3c:d9:2b:1f:1f:0b)
Jan 10 19:23:58
radiusd[23151]: rlm_radutmp: Login entry for NAS CP port 3 wrong order
Jan 10 19:23:58
radiusd[23151]: rlm_radutmp: Login entry for NAS CP port 3 wrong order
Jan 10 19:23:58
radiusd[23151]: Login OK: [day] (from client CP port 3 cli 3c:d9:2b:1f:1f:0b)
Jan 10 19:23:58
radiusd[23151]: Login OK: [day] (from client CP port 3 cli 3c:d9:2b:1f:1f:0b)
Jan 10 19:24:59
radiusd[23151]: rlm_radutmp: Logout for NAS CP port 3, but no Login record
Jan 10 19:24:59
radiusd[23151]: rlm_radutmp: Logout for NAS CP port 3, but no Login record
Jan 10 19:24:59
radiusd[23151]: Login OK: [day] (from client CP port 3 cli 3c:d9:2b:1f:1f:0b)
Jan 10 19:24:59
radiusd[23151]: Login OK: [day] (from client CP port 3 cli 3c:d9:2b:1f:1f:0b)
Jan 10 19:25:59
radiusd[23151]: rlm_radutmp: Login entry for NAS CP port 3 wrong order
Jan 10 19:25:59
radiusd[23151]: rlm_radutmp: Login entry for NAS CP port 3 wrong order
Jan 10 19:25:59
radiusd[23151]: Login OK: [day] (from client CP port 3 cli 3c:d9:2b:1f:1f:0b)
Jan 10 19:25:59
radiusd[23151]: Login OK: [day] (from client CP port 3 cli 3c:d9:2b:1f:1f:0b)
Jan 10 19:27:00
radiusd[23151]: rlm_radutmp: Logout for NAS CP port 3, but no Login record
Jan 10 19:27:00
radiusd[23151]: rlm_radutmp: Logout for NAS CP port 3, but no Login record
Jan 10 19:27:00
radiusd[23151]: Login OK: [day] (from client CP port 3 cli 3c:d9:2b:1f:1f:0b)
Jan 10 19:27:00
radiusd[23151]: Login OK: [day] (from client CP port 3 cli 3c:d9:2b:1f:1f:0b)
Jan 10 19:28:01
radiusd[23151]: rlm_radutmp: Login entry for NAS CP port 3 wrong order
Jan 10 19:28:01
radiusd[23151]: rlm_radutmp: Login entry for NAS CP port 3 wrong order
Jan 10 19:28:01
radiusd[23151]: Invalid user (rlm_counter: Maximum never usage time reached): [day] (from client CP port 3 cli 3c:d9:2b:1f:1f:0b)
Jan 10 19:28:01
radiusd[23151]: Invalid user (rlm_counter: Maximum never usage time reached): [day] (from client CP port 3 cli 3c:d9:2b:1f:1f:0b)
Jan 10 19:28:02
radiusd[23151]: rlm_radutmp: Logout for NAS CP port 3, but no Login record
Jan 10 19:28:02
radiusd[23151]: rlm_radutmp: Logout for NAS CP port 3, but no Login record
-
Thanks, I was thinking that I was the only one with this issue!!!
I still don't get where is the issue, thanks for your info fsantaana. -
periko,
just want to update you on somethign i noticed with this issue as it's becoming more urgent that i find a way to resolve this. Maybe with the below you can help or see if you notice something. Do you know where the file or the line in the code that sends the session time out increments to the fr2?
i've tried all the methods below and still having the problems with the code timing when using start/stop acct from the cp. I tried to remove all the idle/session timeouts from fr2 and cp page. Also removed th eoption to use the radius session time out and there are no session timeouts on the user.
However what i did notice is that the first session time that is sent is not correct. it should send 60 second increments but the first time packet send 40 seconds and from there it throws the entire time off and it keeps increasing. So let's say that every time it should be 60 the first is 40 then the second is 100, 160, 220, etc. do you know where this is coded? maybe if we change the variable to a static number of 60 it will correct the problem? just an idea and what i noticed.
Also with that the only way i can keep the code timer correct is if i switch to interim accounting but then the fr2 session time never decreases and thus hinders the valid time useless because it would never expire.
-
Hi fsantaana.
Good information, I'm not a programmer but will be good to know if someone here could give us info about how CP from pfsense works and which files are involved.
I will post updates if I get something, thanks!!!
-
Hi fsantaana.
Good information, I'm not a programmer but will be good to know if someone here could give us info about how CP from pfsense works and which files are involved.
I will post updates if I get something, thanks!!!
Hi periko,
I talked to fsantaana on another thread.
He seems to found a solution to make the time counter work. Start reading the following thread starting with the post in the below URL.
http://forum.pfsense.org/index.php/topic,56306.msg309438.html#msg309438You have to make some changes on the captiveportal.inc but then it should work.
-
Hi all.
Looks like is working, I had made the changes in:
/etc/inc/captiveportal.inc
This patch http://redmine.pfsense.org/issues/2164 is for pfsense < 2.0.2, but analyzing a little the file, manually I thing I got it.
I had been playing with fr2, adding users with 2/4/8/16/30/60 minutes each and pfsense kick out each user after they reach their time.
I reboot my machine and he remember who had been eating his daily time, good.
Now I must see what happen after 24hrs, waiting.This are the changes I made in the file:
730,731c730 < $stop_time - 60, < //$cpentry[0], // start time --- > $cpentry[0], // start time 735,738c734 < //10); // NAS Request < 10, // NAS Request < false, //Not interim update < $stop_time); --- > 10); // NAS Request 741d736 < exec("sleep 1"); 799d793 < $stop_time - 60, 872d865 < $stop_time = time(); 878d870 < $stop_time - 60, 883,885c875 < //7); // Admin Reboot < 7, // Admin Reboot < false, $stop_time); --- > 7); // Admin Reboot
Hope u can understand this.
I will continue testing, but until now is working, thanks all of u guys, I knew that this will happen sooner or latter this a great feature for a great product like pfsense.
But with more testers we can make it better, thanks again ;D -
periko you are correct. I had made those changes earlier and posted on another Post.
They have been working fine and no problems since that change. I have tested in 3 sites with approx 30-40 simultaneous connections and it keeps track of everyone just fine.
-
Hi fsantaana.
Yes, I follow your posts here thanks, I just would like to see if we could add a billing system, other packages like daloradius require MySQL but some of my boxes are fan less they use CF and MySQL will killthose boxes.
Hope we could see this feature in a near future.
But like u, my system is working, thanks!!!
-
this is exactly what i'm working on with a fanless box and CF card which is why i used the USERS file. But i have done some research and found that if you use a SLC CF card (SSD drives/industrial) which has 100k writes as oppose to a MLC CF card (Cameras/commercial) then this shouldn't matter. You can use a full install of pfsense on the box and it will be ok to load the MySQL php addon to it like they've shown on other posts. With that you will have more control of your users/accounting.
I will be trying this in the next week or so just waiting on the box to arrive from Taiwan :). I have implemented it already but using a MLC with the USERS file which we've had the few problems with and worked out here. I will keep you posted on my success/failure.
Right now i'm trying to find out 2 things- how to convert the user name entered to all lowercase and then submitted to the CP page. I'm trying to play around with the forms on the default window but always manage to send a blank username to the CP/Freeradius for authentication.
And trying to see if i can get per user idle timeout instead of a Global timeout.
If you have any ideas let me know !
-
(…)
Right now i'm trying to find out 2 things- how to convert the user name entered to all lowercase and then submitted to the CP page. I'm trying to play around with the forms on the default window but always manage to send a blank username to the CP/Freeradius for authentication.Take a look here. RADIUS offers this by default:
http://onlamp.com/pub/a/onlamp/excerpt/radius_5/index1.html?page=5lower_user and lower_pass To eliminate case problems that often plague authentication methods such as RADIUS, the FreeRADIUS developers have included a feature that will attempt to modify the User-Name and User-Password attributes to make them all lowercase; this is done either before an authentication request, after a failed authentication request using the values of the attributes as they came, or not at all. Clearly setting the lower_user directive to after makes the most sense: it adds processing time to each request, but unless this particular machine normally carries a high load, the reduced troubleshooting time is worth the extra performance cost. However, a secure password often makes use of a combination of uppercase and lowercase letters, so security dictates leaving the password attribute alone. Usage: lower_user = [before/after/no]; lower_pass = [before/after/no] Suggestion: lower_user = after; lower_pass = no nospace_user and nospace_pass Much like the lower_user and lower_pass controls, these directives preprocess an Access-Request packet and ensure that no spaces are included. The available options are the same: before, after, or no. Again, the most obvious choice is to set nospace_user to after to save helpdesk time. Some administrators have a tendency to not allow spaces in passwords; if this is the case, set nospace_pass to before (since there is a system-wide policy against spaces in passwords, testing a request as-is is not required). Usage: nospace_user = [before/after/no]; nospace_password = [before/after/no] Suggestion: nospace_user = after; nospace_password = before
And trying to see if i can get per user idle timeout instead of a Global timeout.
If you have any ideas let me know !
Idle Timeout on CP is user based as far as I know. If there isn't any traffic for that user more than idel timeout then this user gets disconnected. If the user is initiating traffic then the idle timeout will be reset and is starting counting again from beginning.
Hard Timeout on CP is user based, too but it kicks the user when time is over and user needs to reconnect. CP offers a checkbox "Enable Session-Timeout from RADIUS". You can set this individual for every user and this seems to be the same as the CP hard timeout but could be set independent so every user has a different timeout.
–- edit ---
Loweruser and lower pass seems to be out to date in freeradius 2.x - you should test this if it works or not.Another possibility could be to use the policy.conf file of freeradius. It does the same with MAC addresses. No matter which format the NAS sends the MAC address, lowercase, uppercase, with ":" or with "-" at the end all MACs look like:
11-22-aa-bb-55-66To check this look at this wiki:
http://wiki.freeradius.org/guide/Mac-Auth#Plain-Mac-AuthFor MAC addresses already implemented in freeradius –> settings --> "Enable Plain-MAC-Auth"