Accounting with pam_radius

Question

How can Implement accounting on a unix system using pam_radius ? pam_radius configuration is easy for authentication.

But I confused to find a way for accounting.

In accounting we send some AVP's to 1813 port of radius server. However how can I do this method on pam_radius ?

For example I have following config on /etc/pam.d/radius :

auth        sufficient      pam_radius_auth.so
account     sufficient      pam_radius_auth.so
session     sufficient      pam_radius_auth.so
password    sufficient      pam_radius_auth.so

And test my config with pamtester :

pamtester radius ali authenticate
Password: 
pamtester: successfully authenticated

Radius server already running and authentication was successful.

But where is accounting on pam_radius module ?

Answer 1

Accounting is usually the job of the 'session' PAM type. It is the only type that is invoked at login and logout, and there are separate PAM calls for Accounting-Start and Accounting-Stop:

pamtester radius ali open_session close_session

(The 'session' calls are invoked even for logins that aren't password-based, such as SSH public-key auth, which of course cannot go through 'authenticate' as there's no password to be given.)

---

Note that despite its name, the 'account' type is not for RADIUS accounting – it is used for authorization (account validation), i.e. checking whether the account is allowed to log in.