Re: Time limits
Alan DeKok wrote: James Green [EMAIL PROTECTED] wrote: For example, if [EMAIL PROTECTED] logged in, we might have him on a 2 hours per day access permitted tariff. rlm_counter I guess then rlm_sqlcounter is the only way forward, since rlm_counter doesn't have any documentation that I can detect? James - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: Time limits
On Fri, 14 Nov 2003, James Green wrote: Alan DeKok wrote: James Green [EMAIL PROTECTED] wrote: For example, if [EMAIL PROTECTED] logged in, we might have him on a 2 hours per day access permitted tariff. rlm_counter I guess then rlm_sqlcounter is the only way forward, since rlm_counter doesn't have any documentation that I can detect? Daa?? Can you please just do a search for counter in radiusd.conf? James - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- Kostas Kalevras Network Operations Center [EMAIL PROTECTED] National Technical University of Athens, Greece Work Phone: +30 210 7721861 'Go back to the shadow' Gandalf - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Time limits
Hi all, Apologies if this in a FAQ somewhere. I have a working FreeRadius installation and have been asked to implement a situation whereby we can assign time credits to logged-in users upon payment. For example, if [EMAIL PROTECTED] logged in, we might have him on a 2 hours per day access permitted tariff. I am however lost in the documentation - I don't know where to look. Can someone please provide some pointers? Many thanks, James Green - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
RE: Time limits
Not knowing enough about freeRadius, my first thought would be a script (perl or php) that would run every 15 minutes, checking users of time limited, seeing how long they have been logged on that day, and if they have been, set them to suspended and send an SNMP kill message to that user. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of James Green Sent: Thursday, November 13, 2003 9:33 AM To: [EMAIL PROTECTED] Subject: Time limits Hi all, Apologies if this in a FAQ somewhere. I have a working FreeRadius installation and have been asked to implement a situation whereby we can assign time credits to logged-in users upon payment. For example, if [EMAIL PROTECTED] logged in, we might have him on a 2 hours per day access permitted tariff. I am however lost in the documentation - I don't know where to look. Can someone please provide some pointers? Many thanks, James Green - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: Time limits
James Green [EMAIL PROTECTED] wrote: For example, if [EMAIL PROTECTED] logged in, we might have him on a 2 hours per day access permitted tariff. rlm_counter Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: Setting Time Limits
rlm_sqlcounter - Original Message - From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, August 07, 2003 11:00 PM Subject: Setting Time Limits Is there a way to only allow a certain number of hours on an account? We are thinking of pre-paid Internet in our area and want to sell 10 Hour, 30 Hour, 100 Hour, and 500 Hour cards. We need for it to disable or not allow once this user has reach his time limit. Kent - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Setting Time Limits
Is there a way to only allow a certain number of hours on an account? We are thinking of pre-paid Internet in our area and want to sell 10 Hour, 30 Hour, 100 Hour, and 500 Hour cards. We need for it to disable or not allow once this user has reach his time limit. Kent - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Session/Time Limits - how?
Hi... Wondering how people here are doing session limits for their radius users (i.e. 4 hour hard limit, etc), and how they are terminating sessions manually (at the moment I'm doing it from an interface on the NAS). Can this be done from within freeradius (I'm auth'ing realms/users out of a mysql DB) per group or per user, or are there 3rd party apps to do this? In the case of the latter, what exactly needs to be done to end a session if I was to write my own script to do this? I'm in the middle of writing a centralised GPL'ed web interface for ISP's, and wish to use freeradius for this. Thankyou Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Free, ultra-private instant messaging with Hush Messenger https://www.hushmail.com/services.php?subloc=messengerl=434 Promote security and make money with the Hushmail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliatel=427 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: Session/Time Limits - how?
[EMAIL PROTECTED] wrote: Wondering how people here are doing session limits for their radius users (i.e. 4 hour hard limit, etc), and how they are terminating sessions manually (at the moment I'm doing it from an interface on the NAS). Huh? See: http://www.freeradius.org/rfc/attributes.html#Session-Timeout The NAS takes care of kicking the user off-line. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
RE: Session/Time Limits - how?
-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of [EMAIL PROTECTED] Sent: Monday, July 28, 2003 11:52 AM To: [EMAIL PROTECTED] Subject: Session/Time Limits - how? Hi... Wondering how people here are doing session limits for their radius users (i.e. 4 hour hard limit, etc), and how they are terminating sessions manually (at the moment I'm doing it from an interface on the NAS). You can use the 'counter' module in radiusd.conf. There is an example of 'daily', and you can define your own. Read the comment there. You need to have this counter module defined in 'instantiate', 'authorize', and 'accounting' sections of radiusd.conf. Essentially, you defined a 'key' as the key reference to database look up. the default is the 'User-Name' attribute. Then you define what attribute to use as the counter in 'count-attribute'. By default it is the 'Acct-Session-Time'. This attribute has to be defined in the RFC because it is part of the protocol exchange. You also define what kind of service type to look to trigger the counter in 'allowed-servicetype'. This is the value of the standard RFC attribute 'Service-Type'. The allowable names are defined in the 'dictionary'' file. Finally you define your own attribute name in the 'check-name' item in counter configuration block that contains the limit you want to set. This attribute is user defined, e.g. 'Max-Daily-Session' in the example. If everybody has the same limit, e.g. 3600 seconds, you can define the following in 'users'. DEFAULT Max-Daily-Session := 3600 If the values differ from user to user, you will have different entries, e.g. Foo Max-Daily-Session := 3600 Bar Max-Daily-Session := 2400 Or if you use DB, e.g. MySQL, for the backend, you put these in 'radcheck' table mysql select * from radcheck; ++--+---++-+ | id | UserName | Attribute | op | Value | ++--+---++-+ | 1 | Foo | User-Password | == | footest | | 2 | Foo | Max-Daily-Session | := | 3600| | 3 | Bar | User-Password | == | bartest | | 4 | Bar | Max-Daily-Session | := | 2400| ++--+---++-+ 4 rows in set (0.00 sec) When a user logs in, the counter module will insert a reply of 'Session-Timeout = ' in the message. The value of '' comes from the limit you set, e.g. 'Max-Daily-Session'. Each time an 'accounting stop' request is sent to the server. The value of counter-attribute, i.e. 'Acct-Session-Time', is subtracted from this max value if it is an integer, or just 1 if that attribute is not an integer. When the max value finally reaches 0 and the user tries to log in again, access will be denied to that user. To reset the counter, you define the 'reset' item in counter configuration block to whatever behavior you like. It does not matter how the client session ends, as long as the 'accounting stop' request contains the following attributes. 1. User-Name matches the same user that sends the previous 'accounting-start' request. 2. Acct-Session-Id matches. 3. Acct-Session-Time specifies the duration of the session. 4. Service-Type matches the 'allowed-servicetype' in the counter configuration. Can this be done from within freeradius (I'm auth'ing realms/users out of a mysql DB) per group or per user, or are there 3rd party apps to do this? In the case of the latter, what exactly needs to be done to end a session if I was to write my own script to do this? I'm in the middle of writing a centralised GPL'ed web interface for ISP's, and wish to use freeradius for this. Thankyou - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Time Limits
I am new to FreeRadius and am wondering if there is a way to block web access during certain times of the day. I am using a web proxy program that authenticates through FreeRadius and need to block access to certain users between say 6 pm and 6am. Is that possible with freeradius? Thanks in advance - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: Time Limits
On Sun, 2002-10-20 at 05:51, Roy Wills wrote: I am new to FreeRadius and am wondering if there is a way to block web access during certain times of the day. I am using a web proxy program that authenticates through FreeRadius and need to block access to certain users between say 6 pm and 6am. Is that possible with freeradius? Yes, it's possible - but made terribly difficult by the fact that you may need to actually read the documentation with the source, or even on the web site, or (in the case of your particular question) in one of thousands of such postings to the list... Unfortunately, documentation and advice on how to set up what you're after is *everywhere* - you may need to t(h)read carefully (hehe), for fear that said info may jump out and bite you on the... erm... I'm sure you get the picture *grin*... -- Cheers, Mattt. icq : 117539757 aboveNetworks www : www.above.nq4u.net [EMAIL PROTECTED]jabber: [EMAIL PROTECTED] What's got four legs and an arm? A happy Pit Bull... - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: rlm_counter crash was: rlm_sqlcounter monthly time limits for groups
al [EMAIL PROTECTED] wrote: this happened after a couple hours of operation, I am not willing to try and duplicate the problem, unless you can guide me through setting up a second server and 'duplicating' the requests to it. ... first errors at Mon May 6 11:13:33 2002 : Error: WARNING: Unresponsive child (id 4101) for request 988 I'd guess you're using Exec-Program-Wait, on a platform other than Linux. I'm currently trying to fix a problem where Exec-Program-Wait locks a thread, when run on platforms other than Linux. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: rlm_sqlcounter monthly time limits for groups
On Mon, 6 May 2002, al wrote: setup: freeradius post .5 (cvs from May 6 2002) using sql in accounting (and loving it) rlm_sqlcounter I have gotten the latest cvs in hopes to use rlm_sqlcounter, (as rlm_counter crashes on me, something about threads) Could you provide more info on the crashes? Does it core dump? If yes could you do a backtrace on it? -- Kostas Kalevras Network Operations Center [EMAIL PROTECTED] National Technical University of Athens, Greece Work Phone: +30 10 7721861 'Go back to the shadow' Gandalf - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: rlm_sqlcounter monthly time limits for groups
Hi Al,
There is a README.txt file in the src/modules/rlm_sqlcounter that contains
a more complete example of what to put in your radiusd.conf file.
You don't need to put anything in the authenticate block. To activate it,
just add an instance of the rlm_sqlcounter module to your authorize block
*after* the section that sets up the appropriate check item (like
Max-Daily-Session).
I'm not sure if you can define your check item in the users file because
there is an initialization order problem. Your new check item attribute
will not be defined before your users file is parsed resulting in an
error. If anyone knows a work around here, please let me know.
I store my check items in the SQL servers 'radgroupcheck' table.
INSERT INTO radgroupcheck VALUES (6, 'xcqw', 'Max-Monthly-Session',
'648000', ':=');
This, of course, requires that each account be linked to a group ('xcqw' in
this case) using the usergroup table.
I hope this helps.
At 08:48 PM 5/6/2002 -0500, you wrote:
setup:
freeradius post .5 (cvs from May 6 2002)
using sql in accounting (and loving it)
rlm_sqlcounter
I have gotten the latest cvs in hopes to use rlm_sqlcounter, (as rlm_counter
crashes on me, something about threads)
I am not seeing any 'clear' instructions on usage.
i have put the config from experimental.conf in my radius.conf. so module
should be loaded,
how do you 'activate' the features of the module.
not sure what to put under auth
and how to use it in users file, (specifially for groups)
any help would be appreciated. example would be greatly appreciated
Al
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Randy Moore
Axion Information Technologies, Inc.
email [EMAIL PROTECTED]
phone 301-408-1200
fax301-445-3947
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: rlm_sqlcounter monthly time limits for groups
I'm not sure if you can define your check item in the users file because
there is an initialization order problem. Your new check item attribute
will not be defined before your users file is parsed resulting in an
error. If anyone knows a work around here, please let me know.
My workaround for this, as silly as it sounds, looks like this:
authorize {
preprocess
realmat
monthlycounter
files
monthlycounter
}
And an appropriate users file entry would be:
DEFAULTGroup == limited, Max-Monthly-Session := 216000
Fall-Through = 1
Which is more than a little different from the docs included with the
sqlcounter module. Although this works exactly the way I'd expect it to, am
_I_ the one doing this wrong?
Chris Kalin
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
rlm_sqlcounter monthly time limits for groups
setup: freeradius post .5 (cvs from May 6 2002) using sql in accounting (and loving it) rlm_sqlcounter I have gotten the latest cvs in hopes to use rlm_sqlcounter, (as rlm_counter crashes on me, something about threads) I am not seeing any 'clear' instructions on usage. i have put the config from experimental.conf in my radius.conf. so module should be loaded, how do you 'activate' the features of the module. not sure what to put under auth and how to use it in users file, (specifially for groups) any help would be appreciated. example would be greatly appreciated Al - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
RE: Setting Time Limits under dial-up admin...
Kostas, I use sql database... using user_edit.php3... These two attributes are uncommented in the user_edit.attr file... however, they will not show up the user_edit page, even when using the drop down box of add attribute I am using freeradius 0.4 Max-Daily-Session Daily Limit (secs) Max-Weekly-Session Weekly Limit (secs) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Kostas Kalevras Sent: 16 April 2002 9:16 To: Freeradius-Users@Lists. Cistron. Nl Subject: Re: How to use Exec-Program-Wait; Setting Time Limits under dial-up admin... On Mon, 15 Apr 2002, Peter Santiago wrote: How does one use Exec-Progra-Wait properly? I use dal-up admin to create users and set their time limit to something other than the default value of 14400. When I edit the user, dial-up admin still says Allowed Session is 4 hours... What do I need to do to make dial-up admin reflect the correct duration of Allowed Session?... Thanks... A repeat question... How do I What is your database? sql or ldap. In dialup_admin do you see 4 hours in the user_admin page (show user) or in the user_edit page (edit user)? What is the corresponding value in the user database? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
RE: Setting Time Limits under dial-up admin...
i need to set up daily limits on both time and transfer(mb). i did uncommented the attrs file but i dont get to change daily allowed time in the edit section of an user.. On Tue, 16 Apr 2002, Peter Santiago wrote: Kostas, I use sql database... using user_edit.php3... These two attributes are uncommented in the user_edit.attr file... however, they will not show up the user_edit page, even when using the drop down box of add attribute I am using freeradius 0.4 Max-Daily-Session Daily Limit (secs) Max-Weekly-Session Weekly Limit (secs) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Kostas Kalevras Sent: 16 April 2002 9:16 To: Freeradius-Users@Lists. Cistron. Nl Subject: Re: How to use Exec-Program-Wait; Setting Time Limits under dial-up admin... On Mon, 15 Apr 2002, Peter Santiago wrote: How does one use Exec-Progra-Wait properly? I use dal-up admin to create users and set their time limit to something other than the default value of 14400. When I edit the user, dial-up admin still says Allowed Session is 4 hours... What do I need to do to make dial-up admin reflect the correct duration of Allowed Session?... Thanks... A repeat question... How do I What is your database? sql or ldap. In dialup_admin do you see 4 hours in the user_admin page (show user) or in the user_edit page (edit user)? What is the corresponding value in the user database? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- Petre L. Daniel,System Administrator, Canad Systems Pitesti SRL Romania, tel:+4048206200,+4048206201 email:[EMAIL PROTECTED] http://www.cyber.ro - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
RE: Setting Time Limits under dial-up admin...
great : )) On Tue, 16 Apr 2002, Kostas Kalevras wrote: On Tue, 16 Apr 2002, Peter Santiago wrote: Kostas, I use sql database... using user_edit.php3... These two attributes are uncommented in the user_edit.attr file... however, they will not show up the user_edit page, even when using the drop down box of add attribute I am using freeradius 0.4 Max-Daily-Session Daily Limit (secs) Max-Weekly-Session Weekly Limit (secs) Go to sql.attrmap and change the two lines: checkItem Max-Daily-Session Max-Daily-Session checkItem Max-Weekly-Session Max-Weekly-Session to read checkItem Max-Daily-Session none checkItem Max-Weekly-Session none -- Kostas Kalevras Network Operations Center [EMAIL PROTECTED]National Technical University of Athens, Greece Work Phone: +30 10 7721861 'Go back to the shadow' Gandalf - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- Petre L. Daniel,System Administrator, Canad Systems Pitesti SRL Romania, tel:+4048206200,+4048206201 email:[EMAIL PROTECTED] http://www.cyber.ro - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
RE: Setting Time Limits under dial-up admin...
The two lines are as is in the sql.attrmap, no need to change. So I took an intuitive guess: checkItem Max-Daily-Session none checkItem Max-Weekly-Session none added (formerly non-existent lines)... Bingo... It's ok now. Btw, when I want to query these two attribute.. in which table should I search? the radreply table? replyItem Max-Daily-Session Max-Daily-Session replyItem Max-Weekly-Session Max-Weekly-Session -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Kostas Kalevras Sent: 16 April 2002 22:23 To: [EMAIL PROTECTED] Subject: RE: Setting Time Limits under dial-up admin... On Tue, 16 Apr 2002, Peter Santiago wrote: Kostas, I use sql database... using user_edit.php3... These two attributes are uncommented in the user_edit.attr file... however, they will not show up the user_edit page, even when using the drop down box of add attribute I am using freeradius 0.4 Max-Daily-Session Daily Limit (secs) Max-Weekly-Session Weekly Limit (secs) Go to sql.attrmap and change the two lines: checkItem Max-Daily-Session Max-Daily-Session checkItem Max-Weekly-Session Max-Weekly-Session to read checkItem Max-Daily-Session none checkItem Max-Weekly-Session none -- Kostas Kalevras Network Operations Center [EMAIL PROTECTED] National Technical University of Athens, Greece Work Phone: +30 10 7721861 'Go back to the shadow' Gandalf - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: How to use Exec-Program-Wait; Setting Time Limits under dial-up admin...
Peter Santiago [EMAIL PROTECTED] wrote: How does one use Exec-Progra-Wait properly? scripts/exec-program-wait I use dal-up admin to create users and set their time limit to something other than the default value of 14400. When I edit the user, dial-up admin still says Allowed Session is 4 hours... What do I need to do to make dial-up admin reflect the correct duration of Allowed Session?... I don't know enough about it to answer. Thanks... A repeat question... How do I enforce Session-Time limits for users created in the database? Kicking them out, whenever their allocated time runs out? PLease help... You don't. The NAS should take the Session-Timeout limits, and kick the user off when their time has expired. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
2 things...about groups and time limits and rhelms..
2 things i have found. could be helpfull for others... first, in 'users' file, all entrys are with @domain.com when trying the 'group' things/examples, i was given a clue that it was unix 'groups' as applied to the users account is what controlled the 'groups' examples... so, if we have a user unix account of 'batman' and in the radius users file we have '[EMAIL PROTECTED]' then the groups will not work, even if we use the 'strip' command in the realms file for the 'local' domain...all of our users have an @domain in the users file, however, their unix account just has username...so, the short answer is to add a user in unix exactically like whats in the radius users file...then set the group permissions..works, but is kinda un-practical, or get a fix that would use the radius users file as expected, '[EMAIL PROTECTED]' and let groups be just 'batman'... secondly, when doing proxy authentication, a username comes in like: User-Name = [EMAIL PROTECTED] (note leading spaces) and gets passed to another radius server, where its authenticated as [EMAIL PROTECTED] and is in detail record for the user as [EMAIL PROTECTED].. while that may be a big in the 'other' radius server, thats not the issue here... it is about the detail records that are created for the proxy authentication... having leading 'whitespace' it makes it hard to import detail records into our billing program, since it takes the 'User-Name' litterally, and trys to match [EMAIL PROTECTED] to [EMAIL PROTECTED] which is whats in the access database... any chance we could get the server to 'ignore leading spaces' in the User-Name attrib/log and just output the string? Mike - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
