Accounting Requests

Goal: To send the server accounting requests and to have the server log the accounting requests.

Time: 20-30 minutes

Files:

Modules: rlm_detail, rlm_radutmp

Programs: radwho, radlast

In addition to authorization and authentication, one of the primary roles of a RADIUS server is to record accounting information supplied by an NAS. In this exercise, you should create accounting requests to send to the server and see what the server does with those requests. This process simulates the actions taken by an NAS when a user logs in.

Use the entry in the file from the exercise in New User for user "bob".

You may create accounting packets by hand for this exercise, but we suggest that the follow test packets from the exercises/packets directory be used in this exercise:

If you do create accounting packets by hand, then the attributes listed in the above scripts should be used as a guide.

First, run the bob-login-one.sh script.

Observe that the server has replied with an authentication accept to an authentication request for user "bob", who has logged in on a particular NAS port.

If the server does not reply with an authentication accept, then check the attributes in the test packet and the file entry.

You should now read the man pages for the radwho and radlast programs. Run each program in turn:

Observe that both programs do not report user "bob" as being logged in.

Now run the bob-acct-start.sh script, and observe the response of the server. You should see output containing lines similar to the following:

Other modules that should be referenced for "accounting" are the "preprocess", "suffix", "detail", "unix", and "radutmp" modules. We will work through the operation of these modules in a moment.

Now, run the radwho and radlast programs again:

Observe that both programs now see "bob" as being logged in.

To tell the server that user "bob" has logged out, run the bob-acct-stop.sh script. Observe the server output, and then run radwho and radlast again.

The radwho program should not display any logged-in users. The radlast program should now display both the last login time and the last logout time for user "bob".

Now run the bob-acct-stop.sh program again. Observe how the server’s output differs from the previous accounting stop packet.

You should now read the man pages for the rlm_unix, rlm_radutmp, and rlm_unix modules, along with their configuration entries in raddb/mods-available/radutmp and raddb/mods-available/unix.

In short, the "unix" module manages the database used by the radlast command. The "radutmp" module manages a separate database, which is used by the radwho command.

The "detail" module simply logs every accounting request to a file in a simple textual format.