0

How can Implement accounting on a unix system using pam_radius ? pam_radius configuration is easy for authentication.

But I confused to find a way for accounting.

In accounting we send some AVP's to 1813 port of radius server. However how can I do this method on pam_radius ?

For example I have following config on /etc/pam.d/radius :

auth        sufficient      pam_radius_auth.so
account     sufficient      pam_radius_auth.so
session     sufficient      pam_radius_auth.so
password    sufficient      pam_radius_auth.so

And test my config with pamtester :

pamtester radius ali authenticate
Password: 
pamtester: successfully authenticated

Radius server already running and authentication was successful.

But where is accounting on pam_radius module ?

1 Answer 1

0

Accounting is usually the job of the 'session' PAM type. It is the only type that is invoked at login and logout, and there are separate PAM calls for Accounting-Start and Accounting-Stop:

pamtester radius ali open_session close_session

(The 'session' calls are invoked even for logins that aren't password-based, such as SSH public-key auth, which of course cannot go through 'authenticate' as there's no password to be given.)


Note that despite its name, the 'account' type is not for RADIUS accounting – it is used for authorization (account validation), i.e. checking whether the account is allowed to log in.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.