<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2658.34">
<TITLE>RE: on the right track?</TITLE>
</HEAD>
<BODY>
<P><FONT SIZE=2>I just worked this out yesterday.</FONT>
</P>
<P><FONT SIZE=2>Best way for me (I found) was to create two groups (one is pubnet-dialup the other is pubnet-extend) </FONT>
</P>
<P><FONT SIZE=2>I set this in the /etc/raddb/users file</FONT>
</P>
<BR>
<P><FONT SIZE=2># Authentication for pubnet-dialup group</FONT>
<BR><FONT SIZE=2>DEFAULT Auth-Type = System, Group == "pubnet-dialup"</FONT>
<BR><FONT SIZE=2> Fall-Through = 1</FONT>
</P>
<BR>
<P><FONT SIZE=2># authentication for pubnet-extend group</FONT>
<BR><FONT SIZE=2>DEFAULT Auth-Type = System, Group == "pubnet-extend"</FONT>
<BR><FONT SIZE=2> Fall-Through = 1</FONT>
</P>
<BR>
<BR>
<P><FONT SIZE=2># Defaults for all framed connections.</FONT>
<BR><FONT SIZE=2>#</FONT>
<BR><FONT SIZE=2># sets timeout for group "pubnet-dialup"</FONT>
<BR><FONT SIZE=2>DEFAULT Service-Type == Framed-User, Group == "pubnet-dialup"</FONT>
<BR><FONT SIZE=2> Framed-IP-Address = 255.255.255.254,</FONT>
<BR><FONT SIZE=2> Framed-MTU = 576,</FONT>
<BR><FONT SIZE=2> Service-Type = Framed-User,</FONT>
<BR><FONT SIZE=2> Session-Timeout = 14400,</FONT>
<BR><FONT SIZE=2> Idle-Timeout = 1800,</FONT>
<BR><FONT SIZE=2> Fall-Through = Yes</FONT>
</P>
<P><FONT SIZE=2># Sets timeout for group "pubnet-extend"</FONT>
<BR><FONT SIZE=2>DEFAULT Service-Type == Framed-User, Group == "pubnet-extend"</FONT>
<BR><FONT SIZE=2> Framed-IP-Address = 255.255.255.254,</FONT>
<BR><FONT SIZE=2> Framed-MTU = 576,</FONT>
<BR><FONT SIZE=2> Service-Type = Framed-User,</FONT>
<BR><FONT SIZE=2> Session-Timeout = 28800,</FONT>
<BR><FONT SIZE=2> Idle-Timeout = 1800,</FONT>
<BR><FONT SIZE=2> Fall-Through = Yes</FONT>
</P>
<BR>
<BR>
<BR>
<BR>
<P><FONT SIZE=2>I authenticate against two groups. Then set the timeouts per each group (first is for 4 hours, second 8).</FONT>
</P>
<BR>
<P><FONT SIZE=2>Hope that helps. </FONT>
</P>
<BR>
<P><FONT SIZE=2>Regards,</FONT>
</P>
<BR>
<P><FONT SIZE=2>David Galloway</FONT>
<BR><FONT SIZE=2>Public Networks Administration</FONT>
<BR><FONT SIZE=2>KRS IT Network Operations</FONT>
<BR><FONT SIZE=2>Help Desk (805) 355-2444</FONT>
<BR><FONT SIZE=2>Direct (805) 355-4512</FONT>
</P>
<P><FONT SIZE=2>-----Original Message-----</FONT>
<BR><FONT SIZE=2>From: freeradius-users-bounces+david.l.galloway=us.army.mil@lists.freeradius.org [<A HREF="mailto:freeradius-users-bounces+david.l.galloway=us.army.mil@lists.freeradius.org">mailto:freeradius-users-bounces+david.l.galloway=us.army.mil@lists.freeradius.org</A>] On Behalf Of mbjohn@duke.edu</FONT></P>
<P><FONT SIZE=2>Sent: Thursday, February 23, 2006 3:43 AM</FONT>
<BR><FONT SIZE=2>To: freeradius-users@lists.freeradius.org</FONT>
<BR><FONT SIZE=2>Subject: on the right track?</FONT>
</P>
<P><FONT SIZE=2>Hello all!</FONT>
</P>
<P><FONT SIZE=2>I've tried to search the web and the archives for an answer to this question and didn't come up with anything, so I hope I'm not duplicating a question that's already been answered.</FONT></P>
<P><FONT SIZE=2>Currently, where I work, we run two modem pools. One pool is limited to certain users who are allowed to connect up to 8 hrs at a time. The other pool is for general users who are given 15 min to quickly check email or search for something on the web (fwiw, they're allowed to reconnect after their time is up....).</FONT></P>
<P><FONT SIZE=2>As broadband has become more available, less and less users are using the modem pool. We still have a handful of people from both groups who are still using it. So, in the interest to provide the service for the people still using it while not paying for unused lines, we're trying to consolidate things.</FONT></P>
<P><FONT SIZE=2>We have a Cisco AS5300 terminal server that already uses freeradius w/ kerberos to authenticate users. We would like to take that a step further and use freeradius to limit usage time based on the user name (certain users are allowed 8hrs while all others are given 15min).</FONT></P>
<P><FONT SIZE=2>Looking over the config files in /etc/raddb, it appears the attrs file is just what I need to use. Would I be able to use a combination of huntgroups and the attrs file to accomplish what I need? I know in the documentation for the "fisp" entry, it talks about not having a Fall-Through entry. Does that mean it CANNOT have a Fall-Through entry, or that the given example does not? Am I on the right track with this, or should I look elsewhere?</FONT></P>
<P><FONT SIZE=2>Thanks for your help!</FONT>
</P>
<P><FONT SIZE=2>Brian</FONT>
<BR><FONT SIZE=2>-</FONT>
<BR><FONT SIZE=2>List info/subscribe/unsubscribe? See <A HREF="http://www.freeradius.org/list/users.html" TARGET="_blank">http://www.freeradius.org/list/users.html</A></FONT>
</P>
</BODY>
</HTML>