December 2012 - Freeradius-Users - lists.freeradius.org

Radius Code set to 2??
by ashok kumar 04 Dec '12

04 Dec '12

Hey folks, I have and AP from which I get a RADIUS message with code field set to 2. It was received from on port 1812. Can anybody tell me the significance of this problem because when I change the APs everything works fine. I need to ascertain whether any configuration change is required on AP/ Radius server. Awaiting your useful suggestions. Thanks in advance Regards, Ashok Kumar.

2 1

FreeRadius authentication problems
by Taneli Virtanen 04 Dec '12

04 Dec '12

Hello, I'm currently having some trouble with FreeRadius authentication. Posting my troubles at the Ubuntu forums didn't seem to help much, so I'm trying my hand here at the mailing lists. Here is the situation: We have recently aquired a Ruckus Zone director to manage our networks. We then wanted to have a Radius server to authenticate users thourgh their mac address. So, I installed Ubuntu, followed some basic tutorials and got all the way up to the point where I can join the radius controlled network. Problem is that while connected to this wireless network, I can't connect to internet and get booted from it in less than a minute with no message in radius debug for me to solve this problem. Here is the debug when connecting to the radius network: Ready to process requests. rad_recv: Access-Request packet from host 192.168.154.12 port 1065, id=9, length=168 User-Name = "Client mac address here" User-Password = "Client mac address here" Calling-Station-Id = "Client mac address here" NAS-IP-Address = 192.168.154.12 Called-Station-Id = "Ruckus mac address here:opetusx" Service-Type = Framed-User NAS-Port-Type = Wireless-802.11 NAS-Identifier = "Ruckus mac address here" Vendor-25053-Attr-3 = 0x6f706574757378 Message-Authenticator = 0xa7676bfa2ace5b4ba05356c35cac255a # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [authorized_macs] expand: %{Calling-Station-ID} -> Client mac address here [authorized_macs] users: Matched entry Client mac address here at line 2 ++[authorized_macs] returns ok ++? if (!ok) ? Evaluating !(ok) -> FALSE ++? if (!ok) -> FALSE ++- entering else else {...} +++? if (!EAP-message) ? Evaluating !(EAP-message) -> TRUE +++? if (!EAP-message) -> TRUE +++- entering if (!EAP-message) {...} ++++[control] returns ok +++- if (!EAP-message) returns ok ++- else else returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "Client mac address here", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = Accept Auth-Type = Accept, accepting the user # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 9 to 192.168.154.12 port 1065 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 9 with timestamp +7 Ready to process requests. I followed the plain mac auth guide to get this far, and the system sort of works, but not quite. So the configs must be out of whack somehow, but since radius doesn't give any debug info when I get booted out of the network I'm at loss here. Any help?

5 7

log detail
by studyfordo 04 Dec '12

04 Dec '12

Hi, all if i do the following set in /site-enable/default file, I want to know whether i can see such as when user logout,login failure,user login time....... accounting { detail daily sql sql_log exec (for exec-program and exec-program-wait) attr_filter.accounting_response } thanks

1 0

802.1x Issue
by Brekler Custodio 03 Dec '12

03 Dec '12

Hi again people, so a week ago i posted here a problem with 802.1x i had and it turned to be all my users were MD5 password, so that was my problem.Today i created a new DB on a test server, changed on sql.conf and tested.Im getting this error, i tried to understand that, BUT im kinda a newbie on freeradius + linux (i started to learn 1 month ago) and couldnt find the error.I dont know if the error is on MYSQL or freeradius... Appreciate anything you guys can help me!Thanks in advance. nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' AND ( id_tp_usuario in (1, 2, 3) OR ( id_tp_usuario = 4 AND dt_ingresso <= CURDATE() AND dt_egresso >= CURDATE() ) ) ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" }rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linkedrlm_sql (sql): Attempting to connect to root@localhost:/radiusrlm_sql (sql): starting 0rlm_sql (sql): Attempting to connect rlm_sql_mysql #0rlm_sql_mysql: Starting connect to MySQL server for #0rlm_sql (sql): Connected new DB handle, #0rlm_sql (sql): starting 1rlm_sql (sql): Attempting to connect rlm_sql_mysql #1rlm_sql_mysql: Starting connect to MySQL server for #1rlm_sql (sql): Connected new DB handle, #1rlm_sql (sql): starting 2rlm_sql (sql): Attempting to connect rlm_sql_mysql #2rlm_sql_mysql: Starting connect to MySQL server for #2rlm_sql (sql): Connected new DB handle, #2rlm_sql (sql): starting 3rlm_sql (sql): Attempting to connect rlm_sql_mysql #3rlm_sql_mysql: Starting connect to MySQL server for #3rlm_sql (sql): Connected new DB handle, #3rlm_sql (sql): starting 4rlm_sql (sql): Attempting to connect rlm_sql_mysql #4rlm_sql_mysql: Starting connect to MySQL server for #4rlm_sql (sql): Connected new DB handle, #4rlm_sql (sql): Processing generate_sql_clientsrlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nasrlm_sql (sql): Reserving sql socket id: 4rlm_sql (sql): Read entry nasname=172.23.54.2,shortname=ruckus-controller,secret=t3st3rlm_sql (sql): Adding client 172.23.54.2 (ruckus-controller, server=<none>) to clients listrlm_sql (sql): Released sql socket id: 4 Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules} # serverserver { # from file /etc/freeradius/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_sql_log Module: Instantiating module "sql_log" from file /etc/freeradius/modules/sql_log sql_log { path = "/var/log/freeradius/radacct/sql-relay" Post-Auth = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', '%S');" sql_user_name = "%{%{User-Name}:-DEFAULT}" utf8 = no safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules} # serverradiusd: #### Opening IP addresses and Ports ####listen { type = "auth" ipaddr = * port = 0}listen { type = "acct" ipaddr = * port = 0}listen { type = "auth" ipaddr = 127.0.0.1 port = 18120}Listening on authentication address * port 1812Listening on accounting address * port 1813Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnelListening on proxy address * port 1814Ready to process requests.rad_recv: Access-Request packet from host 172.23.54.2 port 32777, id=52, length=206 User-Name = "user" Calling-Station-Id = "00-22-43-09-43-BD" NAS-IP-Address = 172.23.54.2 NAS-Port = 1 Called-Station-Id = "68-92-34-91-91-48:UNIFEBE-1X" Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "68-92-34-91-91-48" Connect-Info = "CONNECT 802.11b/g" WISPr-Location-Name = "2o-Andar" EAP-Message = 0x020000090175736572 Vendor-25053-Attr-3 = 0x554e49464542452d3158 Message-Authenticator = 0x53dcd42dc46e9bee1e5538df27c8ae45# Executing section authorize from file /etc/freeradius/sites-enabled/default+- entering group authorize {...}++[preprocess] returns ok++[chap] returns noop++[mschap] returns noop++[digest] returns noop[suffix] No '@' in User-Name = "user", looking up realm NULL[suffix] No such realm "NULL"++[suffix] returns noop[eap] EAP packet type response id 0 length 9[eap] No EAP Start, assuming it's an on-going EAP conversation++[eap] returns updated++[unix] returns notfound++[files] returns noop[sql] expand: %{User-Name} -> user[sql] sql_set_user escaped user --> 'user'rlm_sql (sql): Reserving sql socket id: 3[sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' AND ( id_tp_usuario in (1, 2, 3) OR ( id_tp_usuario = 4 AND dt_ingresso <= CURDATE() AND dt_egresso >= CURDATE() ) ) ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'user' AND ( id_tp_usuario in (1, 2, 3) OR ( id_tp_usuario = 4 AND dt_ingresso <= CURDATE() AND dt_egresso >= CURDATE() ) ) ORDER BY idrlm_sql_mysql: MYSQL check_error: 1054 receivedrlm_sql_getvpdata: database query error[sql] SQL query error; rejecting userrlm_sql (sql): Released sql socket id: 3++[sql] returns failInvalid user: [user/<via Auth-Type = EAP>] (from client ruckus-controller port 1 cli 00-22-43-09-43-BD)Using Post-Auth-Type Reject# Executing group from file /etc/freeradius/sites-enabled/default+- entering group REJECT {...}[attr_filter.access_reject] expand: %{User-Name} -> user attr_filter: Matched entry DEFAULT at line 11++[attr_filter.access_reject] returns updatedDelaying reject of request 0 for 1 secondsGoing to the next requestWaking up in 0.9 seconds.Sending delayed reject for request 0Sending Access-Reject of id 52 to 172.23.54.2 port 32777Waking up in 4.9 seconds.Cleaning up request 0 ID 52 with timestamp +205Ready to process requests.

8 20

I wanna post
by Taneli Virtanen 03 Dec '12

03 Dec '12

virtanentaneli(a)gmail.com

5 5

Sending authentication-requests to multiple radius-servers
by Stefan Kuegler 02 Dec '12

02 Dec '12

Hello. I have a short question: Is it possible to send an authentication-request from a client to multiple servers simultaneously ? +----------+ /----->| radius A | +--------+ +--------------+ / +----------+ | client |--->| radius proxy |X +--------+ +--------------+ \ +----------+ \----->| radius B | +----------+ We now authenticate with HMAC-based One Time Password Token (aka event-based token) from a Cisco ASA via radius to only one freeradius-server. But we want to establish a second authentication server for failover reasons. When using event based tokens, it's absolute necessary that every server receives the same authentication request simultaneously from the client to trigger the next "event" on the server side. Best Regards, Stefan Kuegler

4 8

About Radius security
by Emmanuel BILLOT ACAD 01 Dec '12

01 Dec '12

Hi, Apologizes if this question is to "newbie", but i recently thought about Radius security when using proxy. Considering we are using an EAP-TTLS method, based on LDAP authentication inside inner-tunnel (finally with PAP auth a the end). When a client tries an auth, encryption is done by the server only, encoding datas into a TLS tunnels initiated by the server. So login and password are "hidden" into this tunnel. But when using this method through a proxy way, wher eis data encryption ? Ex : First i a direct connexion : Client (EAP-TTLS) => Tunnel (TLS) => Radius Server Then with proxy : Client (EAP-TTLS) => ? => Proxy Radius Server => ? => Radius BR,

2 2

rlm_ldap attribute mappings 3.0
by Arran Cudbard-Bell 01 Dec '12

01 Dec '12

Hi All, Following from previous threads the old attribute mapping scheme in rlm_ldap has been removed in the 3.0 branch. Existing mapping files should be converted to the new configuration file format. # # Mapping of RADIUS dictionary attributes to LDAP directory attributes. # # WARNING: Although this format is almost identical to the unlang # update section format, it does *NOT* mean that you can use other # unlang constructs in module configuration files. # # Configuration items are in the format: # <radius attribute> <op> <ldap attribute> # # Where: # <radius attribute>: The destination RADIUS attribute # with any valid list and request qualifiers. # <op>: Is any assignment attribute (=, :=, +=, -=). # <ldap attribute>: The attribute in the associated # with user or profile objects in the LDAP # directory. If the attribute name is wrapped in # double quotes it will be xlat expanded. # # Request and list qualifiers may also be placed after the section # name to set defaults for unqualified RADIUS attributes. update reply { # control:NT-Password := ntPassword # Reply-Message := radiusReplyMessage # Tunnel-Type := radiusTunnelType # Tunnel-Medium-Type := radiusTunnelMediumType # Tunnel-Private-Group-ID := radiusTunnelPrivategroupId } Unlike normal update sections, the list after update can also contain request qualifiers, and the pairs can contain both request and list qualifiers that override the default. The righthand operand may also be xlat expanded (if double quoted), though as with any expansion you'll incurr a small performance penalty. I don't really see any use cases for this, but it's consistent with normal update section behaviour. Hopefully we'll be able to expand the enhanced update section format to the main server config before 3.0 is released. I was also thinking about possibly adding group and profile update sections. Currently the main update section applies to all profiles processed. But wanted to see if people would find them useful first. Would you find that useful? Testing/feedback appreciated. -Arran

1 0

Usage monitoring Perl script
by amanda edades 01 Dec '12

01 Dec '12

Hello, I am new to FreeRADIUS and am trying to implement QoS policing using FreeRADIUS, where the RADIUS server assigns users QoS policies by usergroup membership. The server monitors usage, and throttles a user's bandwidth by originating a CoA assigning the throttled group if he exceeds the data cap defined for his group. I have data usage being calculated by a Perl script - I define a group's data cap in the radgroupcheck table, and reference it using $RAD_CHECK{'Data-Cap'} I am able to run the script correctly in the authorize section, but when calling it from the accounting section, it does not grab the value, and just designates the cap as 0, causing all future comparisons to conclude the user is over the cap. It appears that in the accounting section, $RAD_CHECK does not reference the radgroupcheck table. I have worked around this by hardcoding data caps for usergroups in the Perl script, but I would like to store these caps in a SQL table so they can easily be modified in the future without having to touch the FreeRADIUS config. How do I reference radgroupcheck from the accounting section of my Perl script to pull these values? Here is a portion of my workaround code: sub accounting { my $Group1_cap = 5368709120; # define other caps here: $Group2_cap, $Group3_cap, etc. my $cap = 0; if ($RAD_CHECK{'Group-Name'} = "Group1") { $cap = $Group1_cap; } # *I would like to replace $cap with $RAD_CHECK{'Data-Cap'}, but this does not pull values defined in radgroupcheck* $RAD_CHECK{'Avail-Bytes'} = $cap - $RAD_CHECK{'Used-Bytes'}; if ($RAD_CHECK{'Avail-Bytes'} < 0) { # usage cap exceeded return RLM_MODULE_NOOP; } return RLM_MODULE_UPDATED; } Thank you in advance, Amanda

2 1