Hi, I was wondering if when using DHCP with freeradius we can control the lease time depending on the group the user belongs to. Thanks, Franz
On Mon, Mar 12, 2012 at 10:25 PM, Franz <flamana@gmail.com> wrote:
Hi, I was wondering if when using DHCP with freeradius we can control the lease time depending on the group the user belongs to.
Possible, but you need to create the rule yourself. If you use v2.1.x branch from git, the lease time is selected by default in the config file. If you're using sql or ldap to store your users, you can easily change it with unlang. -- Fajar
Thank you Fajar, I am using mysql, i will play arround with the queries. Thanks, Franz On Mar 12, 2012, at 5:08 PM, "Fajar A. Nugraha" <list@fajar.net> wrote:
On Mon, Mar 12, 2012 at 10:25 PM, Franz <flamana@gmail.com> wrote:
Hi, I was wondering if when using DHCP with freeradius we can control the lease time depending on the group the user belongs to.
Possible, but you need to create the rule yourself.
If you use v2.1.x branch from git, the lease time is selected by default in the config file. If you're using sql or ldap to store your users, you can easily change it with unlang.
-- Fajar - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Tue, Mar 13, 2012 at 6:32 PM, Franz <flamana@gmail.com> wrote:
> Thank you Fajar, I am using mysql, i will play arround with the queries.
I might not be clear-enough in my last reply.
You should NOT need to alter any existing queries. Instead, you need
to ADD new queries in ldap virtual server to get the user group.
Something like
update control {
Sql-Group = "%{SELECT groupname FROM radusergroup where ...}"
}
if ( Sql-Group == "my-special-group" ) {
update reply {
DHCP-IP-Address-Lease-Time := 60
}
}
Now the above is just an example, which won't work, since the query is
a dummy one. I'm not sure what kind of group checking you can do in
LDAP. Do you group them based on MAC address, for example?
Anyway, if you can define the policy, how to group them, then the
above can be a good start.
--
Fajar
>
> Thanks,
>
> Franz
>
> On Mar 12, 2012, at 5:08 PM, "Fajar A. Nugraha" <list@fajar.net> wrote:
>
>> On Mon, Mar 12, 2012 at 10:25 PM, Franz <flamana@gmail.com> wrote:
>>> Hi,
>>> I was wondering if when using DHCP with freeradius we can control the
>>> lease time depending on the group the user belongs to.
>>
>> Possible, but you need to create the rule yourself.
>>
>> If you use v2.1.x branch from git, the lease time is selected by
>> default in the config file. If you're using sql or ldap to store your
>> users, you can easily change it with unlang.
>>
>> --
>> Fajar
>> -
>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Tue, Mar 13, 2012 at 6:41 PM, Fajar A. Nugraha <list@fajar.net> wrote:
On Tue, Mar 13, 2012 at 6:32 PM, Franz <flamana@gmail.com> wrote:
Thank you Fajar, I am using mysql, i will play arround with the queries.
I might not be clear-enough in my last reply.
You should NOT need to alter any existing queries. Instead, you need to ADD new queries in ldap virtual server to get the user group. Something like
update control { Sql-Group = "%{SELECT groupname FROM radusergroup where ...}" }
if ( Sql-Group == "my-special-group" ) { update reply { DHCP-IP-Address-Lease-Time := 60 } }
Now the above is just an example, which won't work, since the query is a dummy one. I'm not sure what kind of group checking you can do in LDAP. Do you group them based on MAC address, for example?
It should be "I'm not sure what kind of group checking you can do in DHCP". -- Fajar
Hi, Sorry it took too long to respond. Basically what I want to accomplish is to give an IP based on a group that has a specific Max-All-Session-Time. So for example if a group has 3600 as Max-All-Session-Time, the ip would be leased for 3600 sec. Fajar, i was checking your contribution here: http://freeradius.1045715.n5.nabble.com/DHCP-sqlpippol-test-v2-1-x-td5151022... Do you think this can be accomplished with your DHCP-sqlippol changes? Thanks, Franz -- View this message in context: http://freeradius.1045715.n5.nabble.com/Using-DHCP-tp5558126p5647084.html Sent from the FreeRadius - User mailing list archive at Nabble.com.
On Wed, Apr 18, 2012 at 12:27 AM, qbik <flamana@gmail.com> wrote:
Hi, Sorry it took too long to respond. Basically what I want to accomplish is to give an IP based on a group that has a specific Max-All-Session-Time. So for example if a group has 3600 as Max-All-Session-Time, the ip would be leased for 3600 sec. Fajar, i was checking your contribution here:
Do you mean Session-Timeout? Max-All-Session-Time is a sum of all sesision time for that user, which wouldn't make sense to be used as lease time.
http://freeradius.1045715.n5.nabble.com/DHCP-sqlpippol-test-v2-1-x-td5151022...
It should be in v2.1.x git branch already.
Do you think this can be accomplished with your DHCP-sqlippol changes?
Not directly, no. DHCP and radius part of FR is basically two separate entity that doesn't really talk to each other. It does have access to the same db though. If you store the attribute (i.e. Session-Timeout) somewhere in radcheck/radgroupcheck, you need to write some simple code (with unlang) to get that value out of the db and into dhcp's lease time attribute. Should be possible, but it's not written/tested yet. If the attribute is calculated (i.e. when you calculate Session-Timeout with sqlcounter), it's harder. It might be possible to "hijack" the module to do recalculation (just like how sqlipool was hijacked to provide ip address for dhcp), but it's not written/tested yet :) IMHO if you ONLY concerned about lease time, just use a short one, roughly double whatever value you're using for interim-updates. It's MUCH easier and cleaner that way :) -- Fajar
May be I am going beyond here overthinking this. This is a custom hotspot system so each group pretends to a plan (1 hour, 1 day, 5 days etc), these groups have no timeout or idle timeout. What I want to avoid is leasing a different ip to a user who is part of the 5 days group as the Captiveportal checks for a match of ip+mac after authentication. Hence I wanted to specify a lease time equal to the Max-All-Session-Time so the user does not get prompted for his credentials on every ip change. thank you for your help. i will play arround with unlang to specify a lease time equal to the info in radcheck/radgroupcheck -- View this message in context: http://freeradius.1045715.n5.nabble.com/Using-DHCP-tp5558126p5648959.html Sent from the FreeRadius - User mailing list archive at Nabble.com.
participants (3)
-
Fajar A. Nugraha -
Franz -
qbik