Hi all, I'm trying to understand how to configure radius Time Limit, Data download Limit, .. On a FreeRadius 3.0.10 using mysql and Mikrotik. First of all I wold like to know about to configure mikrotik dictionary (http://wiki.mikrotik.com/wiki/Manual:RADIUS_Client/vendor_dictionary) What I should do create ${prefix}/share/freeradius/dictionary/mikrotik.dictionary and add INCLUDE into raddb/dictionary ? or just add all lines into /etc/raddb/dictionary ? Where I should use the dictionary attributes on modules ? Then on mods-available there is sqlcounter with some configurations. Is there any other examples somewhere ? I need data limitation. And is it possible to create some group of users with diferents restrictions ? Thanks.
On Feb 17, 2016, at 6:32 PM, Oscar Jofre <oscar@jofre.com> wrote:
I'm trying to understand how to configure radius Time Limit, Data download Limit, .. On a FreeRadius 3.0.10 using mysql and Mikrotik.
It should be fairly simple.
First of all I wold like to know about to configure mikrotik dictionary (http://wiki.mikrotik.com/wiki/Manual:RADIUS_Client/vendor_dictionary)
Don't do anything. FreeRADIUS includes the mikrotik dictionary. Do NOT edit the dictionaries, or add that one. It's not necessary.
Where I should use the dictionary attributes on modules ?
Any you need to send an attribute in a reply.
Then on mods-available there is sqlcounter with some configurations.
The server includes lots of modules. They are all documented, and they all describe what they do.
Is there any other examples somewhere ?
Dozens. Read "man unlang", and then read raddb/sites-available/default. There are LOTS of examples of adding and using attributes.
And is it possible to create some group of users with deferents restrictions
Yes. See the wiki for SQL. You can put groups into SQL. Or in LDAP. Or in local files. Alan DeKok.
Thanks Alan, Now I have working authorize timeout limit. Resume in case someone need to know it: cd /etc/raddb/mods-enabled/ ln -s ../mods-available/sqlcounter ./ add into /etc/raddb/sites-available/default authorize { … dailycounter .. } INSERT INTO radcheck( id ,username ,attribute ,op ,value ) VALUES ( NULL -- id - IN int(11) unsigned , 'username' ,'Max-Daily-Session' ,':=' ,'300' ); When user tries to log once reachet the time session message appears: 'Your maximum daily usage time has been reached' I have configured my mikrotik-hotspots interim to 6 minutes. I would like to know if is possible to close the user connection when interim if limit is reached. I've tried to add on accounting { .. dailycounter .. } but I got this error "sqlcounter" modules aren't allowed in 'accounting' sections -- they have no such method. Is there any possibility on accounting to kill user? Is it possible to filter by callingstationid (mac address) instead of username ? What I should change ? Where I can see possible Key values ? Last think about groups I saw that radacct has groupname and I should use radgroupcheck but how parametrize to get radgroupcheck instead of radcheck ? Thanks a lot ! -----Mensaje original----- De: Freeradius-Users [mailto:freeradius-users-bounces+oscar=jofre.com@lists.freeradius.org] En nombre de Alan DeKok Enviado el: jueves, 18 de febrero de 2016 3:45 Para: FreeRadius users mailing list Asunto: Re: Modules - dictionary On Feb 17, 2016, at 6:32 PM, Oscar Jofre <oscar@jofre.com> wrote:
I'm trying to understand how to configure radius Time Limit, Data download Limit, .. On a FreeRadius 3.0.10 using mysql and Mikrotik.
It should be fairly simple.
First of all I wold like to know about to configure mikrotik dictionary (http://wiki.mikrotik.com/wiki/Manual:RADIUS_Client/vendor_dictionary)
Don't do anything. FreeRADIUS includes the mikrotik dictionary. Do NOT edit the dictionaries, or add that one. It's not necessary.
Where I should use the dictionary attributes on modules ?
Any you need to send an attribute in a reply.
Then on mods-available there is sqlcounter with some configurations.
The server includes lots of modules. They are all documented, and they all describe what they do.
Is there any other examples somewhere ?
Dozens. Read "man unlang", and then read raddb/sites-available/default. There are LOTS of examples of adding and using attributes.
And is it possible to create some group of users with deferents restrictions
Yes. See the wiki for SQL. You can put groups into SQL. Or in LDAP. Or in local files. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Feb 19, 2016, at 8:23 PM, Oscar Jofre <oscar@jofre.com> wrote:
I have configured my mikrotik-hotspots interim to 6 minutes. I would like to know if is possible to close the user connection when interim if limit is reached.
See the NAS documentation. If it supports CoA-Request or Disconnect-Request packets, yes. Read raddb/sites-available/originate-coa.
Is it possible to filter by callingstationid (mac address) instead of username ?
Yes.
What I should change ? Where I can see possible Key values ?
Edit the queries which have User-Name, and change them to Calling-Station-Id. The configuration files are text for a reason.
Last think about groups I saw that radacct has groupname and I should use radgroupcheck but how parametrize to get radgroupcheck instead of radcheck ?
I don't know what that means. The Wiki documents how the SQL module works. If you need something else from the module, you'll have to write "unlang" rules by hand, instead of using SQL. Alan DeKok.
See the NAS documentation. If it supports CoA-Request or Disconnect-Request packets, yes. Read raddb/sites-available/originate-coa.
I've read the documentation but I don't understand where to activate CoA to send Disconnect-Request, on originate-coa: # CoA packets can be originated when a normal Access-Request or # Accounting-Request packet is received. Simply update the # "coa" list: # # update coa { # &User-Name = "%{User-Name}" # &Acct-Session-Id = "%{Acct-Session-Id}" # &NAS-IP-Address = "%{NAS-IP-Address}" # } # # And the CoA packet will be sent. You can also send Disconnect # packets by using "update disconnect { ...". Where I have to place the update coa to send info on interim, into sites-available/coa ? I think I should add more data into update coa according to mikrotik documentation: Change of Authorization RADIUS disconnect and Change of Authorization (according to RFC3576) are supported as well. These attributes may be changed by a CoA request from the RADIUS server: Mikrotik-Group Mikrotik-Recv-Limit Mikrotik-Xmit-Limit Mikrotik-Rate-Limit Ascend-Data-Rate (only if Mikrotik-Rate-Limit is not present) Ascend-XMit-Rate (only if Mikrotik-Rate-Limit is not present) Mikrotik-Mark-Id Filter-Id Mikrotik-Advertise-Url Mikrotik-Advertise-Interval Session-Timeout Idle-Timeout Port-Limit Note that it is not possible to change IP address, pool or routes that way - for such changes a user must be disconnected first. I misunderstand how to send on interim session-Timeout according to dailycounter that is working ok on authorization. Thanks ! -----Mensaje original----- De: Freeradius-Users [mailto:freeradius-users-bounces+oscar=jofre.com@lists.freeradius.org] En nombre de Alan DeKok Enviado el: sábado, 20 de febrero de 2016 19:37 Para: FreeRadius users mailing list Asunto: Re: Modules - dictionary On Feb 19, 2016, at 8:23 PM, Oscar Jofre <oscar@jofre.com> wrote:
I have configured my mikrotik-hotspots interim to 6 minutes. I would like to know if is possible to close the user connection when interim if limit is reached.
See the NAS documentation. If it supports CoA-Request or Disconnect-Request packets, yes. Read raddb/sites-available/originate-coa.
Is it possible to filter by callingstationid (mac address) instead of username ?
Yes.
What I should change ? Where I can see possible Key values ?
Edit the queries which have User-Name, and change them to Calling-Station-Id. The configuration files are text for a reason.
Last think about groups I saw that radacct has groupname and I should use radgroupcheck but how parametrize to get radgroupcheck instead of radcheck ?
I don't know what that means. The Wiki documents how the SQL module works. If you need something else from the module, you'll have to write "unlang" rules by hand, instead of using SQL. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Feb 20, 2016, at 6:18 PM, Oscar Jofre <oscar@jofre.com> wrote:
See the NAS documentation. If it supports CoA-Request or Disconnect-Request packets, yes. Read raddb/sites-available/originate-coa.
I've read the documentation but I don't understand where to activate CoA to send Disconnect-Request, on originate-coa:
You put "update coa" in an authorize section or an accounting section.
I think I should add more data into update coa according to mikrotik documentation:
If that's what Mikrotik wants, I guess so. Alan DeKok.
Hi,
You put "update coa" in an authorize section or an accounting section.
On sites-available/default ? It is possible to send CoA only when user is over limit session ? I mean how to join with dailycounter ? -----Mensaje original----- De: Freeradius-Users [mailto:freeradius-users-bounces+oscar=jofre.com@lists.freeradius.org] En nombre de Alan DeKok Enviado el: domingo, 21 de febrero de 2016 0:22 Para: FreeRadius users mailing list Asunto: Re: Modules - dictionary On Feb 20, 2016, at 6:18 PM, Oscar Jofre <oscar@jofre.com> wrote:
See the NAS documentation. If it supports CoA-Request or Disconnect-Request packets, yes. Read raddb/sites-available/originate-coa.
I've read the documentation but I don't understand where to activate CoA to send Disconnect-Request, on originate-coa:
You put "update coa" in an authorize section or an accounting section.
I think I should add more data into update coa according to mikrotik documentation:
If that's what Mikrotik wants, I guess so. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Yes in the default file. Dailycounter automatically sets the session timeout so once user's session is expired, user is not allowed to login this is all already happening with default config. As far as data coa is concerned you have to read accounting packets using unlang in accounting section in default file of course and send a coa when the data limit is reached! Hope this helps. BR, Anirudh Malhotra 8zero2 Mail: 8zero2.in@gmail.com Facebook: www.facebook.com/8zero2 Twitter: @8zero2_in Blog: blog.8zero2.in On 21 Feb 2016, 14:19 +0530, Oscar Jofre<oscar@jofre.com>, wrote:
Hi,
You put "update coa" in an authorize section or an accounting section.
On sites-available/default ?
It is possible to send CoA only when user is over limit session ? I mean how to join with dailycounter ?
-----Mensaje original----- De: Freeradius-Users [mailto:freeradius-users-bounces+oscar=jofre.com@lists.freeradius.org] En nombre de Alan DeKok Enviado el: domingo, 21 de febrero de 2016 0:22 Para: FreeRadius users mailing list Asunto: Re: Modules - dictionary
On Feb 20, 2016, at 6:18 PM, Oscar Jofre<oscar@jofre.com>wrote:
See the NAS documentation. If it supports CoA-Request or Disconnect-Request packets, yes. Read raddb/sites-available/originate-coa.
I've read the documentation but I don't understand where to activate CoA to send Disconnect-Request, on originate-coa:
You put "update coa" in an authorize section or an accounting section.
I think I should add more data into update coa according to mikrotik documentation:
If that's what Mikrotik wants, I guess so.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Feb 21, 2016, at 3:48 AM, Oscar Jofre <oscar@jofre.com> wrote:
You put "update coa" in an authorize section or an accounting section.
On sites-available/default ?
Yes. Or in any other virtual server. Do the "authorize" or "accounting" sections show up anywhere else?
It is possible to send CoA only when user is over limit session ? I mean how to join with dailycounter ?
Write "unlang" rules. We write documentation which describes how the server works, and how to configure it. We do *not* write documentation which describes exactly how to implement every possible request. You *must* read the documentation, understand it, and come up with the solution. We can help you, but this is a free support list... we won't do everything for you. Alan DeKok.
Hi again, I do setup test environment, read, test and try to understand CoA with my English difficult.... I've setup dailycouter on accounting and users are not allowed to connect when reached limit session time. Next challenge is to disconnect user if it's over limit session time. To do it easy I just activate originate-coa cd /etc/raddb/sites-enabled ln -s ../sites-available/originate-coa ./ For test I have a mikrotik connected with openvpn with freeradius. OpenVpn server 172.16.0.1 (this is the IP I use on mikrotik to setup Radius Address) Vpn Connection assig NAS-IP-Mikrotik=172.16.0.10 Then on originate-coa I setup ipaddr and secret : ipaddr = 172.16.0.1 I modify /etc/raddb/sites-available/default adding (now is for test and test that disconnects ok) ... accounting { ..... update disconnect { &User-Name = "%{User-Name}" &Acct-Session-Id = "%{Acct-Session-Id}" &NAS-IP-Address = "%{NAS-IP-Address}" &Framed-IP-Address = "%{Framed-IP-Address}" } } Restart radius and test. What I See (I know you will know) - working with hotspot users. - When I log hotspot user then I got connected but at the same time disconnects. (that should be because mikrotik or freeradius after authorization sends/execute accounting) That’s not really a problem because I have to add if(....) before update disconnect to check limits..... Here are my questions. (just to know if I can do it and come light to do it) I'm using one freeRadius to identify user from more than 300 mikrotiks hotspots. Every Nas (mikrotik) has a dynamic IP (openvpn) I can't fix an IP for every NAS (mikrotik). All have standard configurations. Then: 1) how can handle this pool of Nas (mikrotiks) with COA on original-coa ? How can I setup original-coa to setup ipaddr (pool of openvpn Ip's 172.16.0.2 - 172.16.255.555) Then &NAS-IP-Address = "%{NAS-IP-Address}" is pointing to real NAS (mikrotik) 2) Then because I'm planning to my clients (mikrotik - NAS) can have different setup (daylicounter with differents resets) I can create daylicounters with differets attributes. It's possible to create a daylicounter_account module to add on accounting and send disconnect CoA user when user goes over limit? I mean same that does daylicounter but instead of replay Session-Timeout replay Coa disconnect. If someone have donne something silimar can share code ? Thanks a lot ! -----Mensaje original----- De: Freeradius-Users [mailto:freeradius-users-bounces+oscar=jofre.com@lists.freeradius.org] En nombre de Alan DeKok Enviado el: domingo, 21 de febrero de 2016 14:01 Para: FreeRadius users mailing list Asunto: Re: Modules - dictionary On Feb 21, 2016, at 3:48 AM, Oscar Jofre <oscar@jofre.com> wrote:
You put "update coa" in an authorize section or an accounting section.
On sites-available/default ?
Yes. Or in any other virtual server. Do the "authorize" or "accounting" sections show up anywhere else?
It is possible to send CoA only when user is over limit session ? I mean how to join with dailycounter ?
Write "unlang" rules. We write documentation which describes how the server works, and how to configure it. We do *not* write documentation which describes exactly how to implement every possible request. You *must* read the documentation, understand it, and come up with the solution. We can help you, but this is a free support list... we won't do everything for you. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Mar 14, 2016, at 4:23 AM, Oscar Jofre <oscar@jofre.com> wrote:
I do setup test environment, read, test and try to understand CoA with my English difficult....
It's fine.
Next challenge is to disconnect user if it's over limit session time.
To do it easy I just activate originate-coa
cd /etc/raddb/sites-enabled ln -s ../sites-available/originate-coa ./
And edit it to use the correct IP addresses.
I'm using one freeRadius to identify user from more than 300 mikrotiks hotspots. Every Nas (mikrotik) has a dynamic IP (openvpn) I can't fix an IP for every NAS (mikrotik). All have standard configurations.
RADIUS doesn't work well with dynamic IPs. If you own the hotspots, you should set them up with private IPs inside of the VPN tunnel. Then, send RADIUS traffic to the private IPs.
Then:
1) how can handle this pool of Nas (mikrotiks) with COA on original-cos ?
You can't. RADIUS is based on static IPs.
How can I setup original-coa to setup ipaddr (pool of openvpn Ip's 172.16.0.2 - 172.16.255.555) Then &NAS-IP-Address = "%{NAS-IP-Address}" is pointing to real NAS (mikrotik)
You can't.
2) Then because I'm planning to my clients (mikrotik - NAS) can have different setup (daylicounter with differents resets) I can create daylicounters with differets attributes. It's possible to create a daylicounter_account module to add on accounting and send disconnect CoA user when user goes over limit?
The dailycounter module won't automatically disconnect the user, but you can write policies to glue them together,
I mean same that does daylicounter but instead of replay Session-Timeout replay Coa disconnect.
No. The dailycounter module counts. It doesn't do a lot else. You have to write policies to implement what you want. Alan DeKok.
Hi ,
Next challenge is to disconnect user if it's over limit session time.
To do it easy I just activate originate-coa
cd /etc/raddb/sites-enabled ln -s ../sites-available/originate-coa ./
And edit it to use the correct IP addresses.
Then that means that for each Nas-client (mikrotik) connected with the freeradius, I have to add on originate-coa: home_server example-coa { type = coa ipaddr = 172.16.0.10 port = 3799 secret = secret # CoA specific parameters. See raddb/proxy.conf for details. coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server2 example-coa2 { type = coa ipaddr = 172.16.0.10 port = 3799 secret = secret # CoA specific parameters. See raddb/proxy.conf for details. coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } ..... home_servern example-coan { type = coa ipaddr = 172.16.0.10 port = 3799 secret = secret # CoA specific parameters. See raddb/proxy.conf for details. coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } That’s not good for me. Is not possible to add ipaddr (&NAS-IP-Address) on accounting ? I think I misunderstand something ... Thanks -----Mensaje original----- De: Freeradius-Users [mailto:freeradius-users-bounces+oscar=jofre.com@lists.freeradius.org] En nombre de Alan DeKok Enviado el: lunes, 14 de marzo de 2016 19:09 Para: FreeRadius users mailing list Asunto: Re: Modules - dictionary On Mar 14, 2016, at 4:23 AM, Oscar Jofre <oscar@jofre.com> wrote:
I do setup test environment, read, test and try to understand CoA with my English difficult....
It's fine.
Next challenge is to disconnect user if it's over limit session time.
To do it easy I just activate originate-coa
cd /etc/raddb/sites-enabled ln -s ../sites-available/originate-coa ./
And edit it to use the correct IP addresses.
I'm using one freeRadius to identify user from more than 300 mikrotiks hotspots. Every Nas (mikrotik) has a dynamic IP (openvpn) I can't fix an IP for every NAS (mikrotik). All have standard configurations.
RADIUS doesn't work well with dynamic IPs. If you own the hotspots, you should set them up with private IPs inside of the VPN tunnel. Then, send RADIUS traffic to the private IPs.
Then:
1) how can handle this pool of Nas (mikrotiks) with COA on original-cos ?
You can't. RADIUS is based on static IPs.
How can I setup original-coa to setup ipaddr (pool of openvpn Ip's 172.16.0.2 - 172.16.255.555) Then &NAS-IP-Address = "%{NAS-IP-Address}" is pointing to real NAS (mikrotik)
You can't.
2) Then because I'm planning to my clients (mikrotik - NAS) can have different setup (daylicounter with differents resets) I can create daylicounters with differets attributes. It's possible to create a daylicounter_account module to add on accounting and send disconnect CoA user when user goes over limit?
The dailycounter module won't automatically disconnect the user, but you can write policies to glue them together,
I mean same that does daylicounter but instead of replay Session-Timeout replay Coa disconnect.
No. The dailycounter module counts. It doesn't do a lot else. You have to write policies to implement what you want. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Mar 14, 2016, at 6:03 PM, Oscar Jofre <oscar@jofre.com> wrote:
Then that means that for each Nas-client (mikrotik) connected with the freeradius, I have to add on originate-coa:
Yes.
That’s not good for me.
That's how RADIUS works.
Is not possible to add ipaddr (&NAS-IP-Address) on accounting ?
Maybe... it depends what you mean by that.
I think I misunderstand something ...
RADIUS is simple. It uses fixed IPs to define both client and server. Alan DeKok.
Is not possible to add ipaddr (&NAS-IP-Address) on accounting ?
Maybe... it depends what you mean by that.
I mean, if I have 200 clients identified by IP NAS-IP-Address (openVPN IP), instead of adding 200: home_server example-coa { type = coa ipaddr = 172.16.0.10 ..... } home_server example-coa { type = coa ipaddr = 172.16.0.11 ..... } ...... home_server example-coa { type = coa ipaddr = 172.16.0.209 ..... } Just send the coa request on accounting adding NAS-IP-Address ... Because I testes and works just : echo "user-name=pru, Framed-IP-Address=172.17.1.247" | radclient -x 172.16.0.10:3799 disconnect secret Could I add on accounting: update disconnect { &User-Name = "%{User-Name}" -->pru Framed-IP-Address = "%{Framed-IP-Address}" -->172.17.1.247 &NAS-IP-Address = "%{NAS-IP-Address}" --> 172.16.0.10 } On accounting I have all the parameters and even the radius secret is the same on all my clients .... So if I add &NAS-IP-Address instead of use ipaddr could use &NAS-IP-Address then I don't need to add to many entruies on originate-coa. I tried and didn’t work ... Any idea ? Thanks ! -----Mensaje original----- De: Freeradius-Users [mailto:freeradius-users-bounces+oscar=jofre.com@lists.freeradius.org] En nombre de Alan DeKok Enviado el: martes, 15 de marzo de 2016 0:39 Para: FreeRadius users mailing list Asunto: Re: Modules - dictionary On Mar 14, 2016, at 6:03 PM, Oscar Jofre <oscar@jofre.com> wrote:
Then that means that for each Nas-client (mikrotik) connected with the freeradius, I have to add on originate-coa:
Yes.
That’s not good for me.
That's how RADIUS works.
Is not possible to add ipaddr (&NAS-IP-Address) on accounting ?
Maybe... it depends what you mean by that.
I think I misunderstand something ...
RADIUS is simple. It uses fixed IPs to define both client and server. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Mar 15, 2016, at 2:58 AM, Oscar Jofre <oscar@jofre.com> wrote:
Is not possible to add ipaddr (&NAS-IP-Address) on accounting ?
Maybe... it depends what you mean by that.
I mean, if I have 200 clients identified by IP NAS-IP-Address (openVPN IP), instead of adding 200:
As I've said, you need to list each IP separately. That's how RADIUS works. Alan DeKok.
Hi, So first the attributes shown and documented by your NAS says clearly that these can be changed by coa. Which does not mean that these have to be sent in a coa request. Second the attributes which are to be sent to NAS in a coa request should be documented by your NAS Somewhere mostly it is calling-station-id and acct-session-id. BR, Anirudh Malhotra 8zero2 Mail: 8zero2.in@gmail.com Facebook: www.facebook.com/8zero2 Twitter: @8zero2_in Blog: blog.8zero2.in On 21 Feb 2016, 04:49 +0530, Oscar Jofre<oscar@jofre.com>, wrote:
See the NAS documentation. If it supports CoA-Request or Disconnect-Request packets, yes. Read raddb/sites-available/originate-coa.
I've read the documentation but I don't understand where to activate CoA to send Disconnect-Request, on originate-coa:
# CoA packets can be originated when a normal Access-Request or # Accounting-Request packet is received. Simply update the # "coa" list: # # update coa { #&User-Name = "%{User-Name}" #&Acct-Session-Id = "%{Acct-Session-Id}" #&NAS-IP-Address = "%{NAS-IP-Address}" # } # # And the CoA packet will be sent. You can also send Disconnect # packets by using "update disconnect { ...".
Where I have to place the update coa to send info on interim, into sites-available/coa ?
I think I should add more data into update coa according to mikrotik documentation:
Change of Authorization
RADIUS disconnect and Change of Authorization (according to RFC3576) are supported as well. These attributes may be changed by a CoA request from the RADIUS server: Mikrotik-Group Mikrotik-Recv-Limit Mikrotik-Xmit-Limit Mikrotik-Rate-Limit Ascend-Data-Rate (only if Mikrotik-Rate-Limit is not present) Ascend-XMit-Rate (only if Mikrotik-Rate-Limit is not present) Mikrotik-Mark-Id Filter-Id Mikrotik-Advertise-Url Mikrotik-Advertise-Interval Session-Timeout Idle-Timeout Port-Limit Note that it is not possible to change IP address, pool or routes that way - for such changes a user must be disconnected first.
I misunderstand how to send on interim session-Timeout according to dailycounter that is working ok on authorization.
Thanks !
-----Mensaje original----- De: Freeradius-Users [mailto:freeradius-users-bounces+oscar=jofre.com@lists.freeradius.org] En nombre de Alan DeKok Enviado el: sábado, 20 de febrero de 2016 19:37 Para: FreeRadius users mailing list Asunto: Re: Modules - dictionary
On Feb 19, 2016, at 8:23 PM, Oscar Jofre<oscar@jofre.com>wrote:
I have configured my mikrotik-hotspots interim to 6 minutes. I would like to know if is possible to close the user connection when interim if limit is reached.
See the NAS documentation. If it supports CoA-Request or Disconnect-Request packets, yes. Read raddb/sites-available/originate-coa.
Is it possible to filter by callingstationid (mac address) instead of username ?
Yes.
What I should change ? Where I can see possible Key values ?
Edit the queries which have User-Name, and change them to Calling-Station-Id. The configuration files are text for a reason.
Last think about groups I saw that radacct has groupname and I should use radgroupcheck but how parametrize to get radgroupcheck instead of radcheck ?
I don't know what that means.
The Wiki documents how the SQL module works. If you need something else from the module, you'll have to write "unlang" rules by hand, instead of using SQL.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
Anirudh Malhotra -
Oscar Jofre