Nunca

That damn xenserver-linuxfixup-disk.iso!

In case you run into the same problem as me (that is, trying to unplug an already unavailable ISO SR from XenServer 5.6 and finding out that the xenserver-linuxfixup-disk.iso can’t be removed), there’s a way out. Granted, it’s not that easy, but at least it worked for me.

Assumptions taken here: you know how to navigate xe (the console tools of the XenServer host), knows the UUID of the SR (using xe sr-list type=iso) and knows this is all funky stuff that, if done wrong, WILL BREAK things. You’ve been warned.

Firstly, find out the UUID of the VDI (trying to unplug the PBD or the SR through console should give you that):

xe vdi-list name-label=xenserver-linuxfixup-disk.iso

Find the UUID of the VBD (should return only one):

xe vdi-param-get uuid=<VDI_UUID> param-name=vbd-uuids

Find the UUID VM which is using it:

xe vbd-param-get uuid=<VBD_UUID> param-name=vm-uuid

Shutdown the VM (it takes a while, don’t panic and go get a coffee!):

xe vm-shutdown uuid=<VM_UUID>

After that, XenCenter should allow you to Forget/Detach/Destroy the ISO SR, or you can do it through xe:

xe pbd-unplug uuid=<PBD_UUID>

xe sr-forget uuid=<SR_UUID>

The Key to Traffic-based Tickets in RADIUS

I spent ages looking for information on how to limit user access based on traffic used through a captive portal using pfSense, and couldn’t find somewhere with an easy to use SQL command that was generic enough to use with daloRADIUS.

Well, in case you were wandering (like me) around the ‘net, here it is:

SELECT IFNULL(SUM(AcctInputOctets + AcctOutputOctets),0) AS AcctTotalOctets FROM radacct WHERE username = '%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b';

This, in essence, is the SQL you need to use for the traffic-based counter that you need to setup in FreeRADIUS for this to work. Then add a check for an attribute like Max-Total-Octets and add that attribute with the amount you want to limit (in bytes) to the users who should be limited, and voilà!

You can use a reset value of never and just keep re-filling user’s session traffic when they run out. Set a reply-message that tells them they’ve run out of data, though, or it will just look like they got their password wrong.