Simultaneous-use check but don't reject
Hi I'm using Simultaneous-use := 1 and sql for check on my Freeradius server. When the radius found that customer connected already it reject customer with Reply-Message := "\r\nYou are already logged in - access denied\r\n\n". Is the way do not reject customer to be able connect customer and redirect them to Error page? Regards, Alexander.
Alexander Kosykh wrote:
I'm using Simultaneous-use := 1 and sql for check on my Freeradius server. When the radius found that customer connected already it reject customer with Reply-Message := "\r\nYou are already logged in - access denied\r\n\n". Is the way do not reject customer to be able connect customer and redirect them to Error page?
See the documentation for your NAS or captive portal. This isn't an issue for RADIUS. Alan DeKok.
The question is not how to make captive portal on my NAS, the question is how do not reject customer, who reached max value of simultaneous-use? Regards, Alexander. 2011/12/20 Alan DeKok <aland@deployingradius.com>
Alexander Kosykh wrote:
I'm using Simultaneous-use := 1 and sql for check on my Freeradius server. When the radius found that customer connected already it reject customer with Reply-Message := "\r\nYou are already logged in - access denied\r\n\n". Is the way do not reject customer to be able connect customer and redirect them to Error page?
See the documentation for your NAS or captive portal. This isn't an issue for RADIUS.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi,
The question is not how to make captive portal on my NAS, the question is how do not reject customer, who reached max value of simultaneous-use?
....if you dont care about them reaching that value, then why are you checking? but if you really do want to redirect them to an error page - then you need to read/check how to do that with your NAS (as Alan said, read your NAS documentation) and instead of the current Simultaneous-Use result, put your own result in (whatever RADIUS attributes/values you need to set for your user to get redirected to some error page....however that is don by your NAS) alan
I tried to do this in my config session { # radutmp # # See "Simultaneous Use Checking Queries" in sql.conf sql if (Post-Auth-Type == reject) { ok block_auth_error # my own policy } } but radius answer is reject whatever and pppoe didn't up 2011/12/21 Alan Buxey <A.L.M.Buxey@lboro.ac.uk>
Hi,
The question is not how to make captive portal on my NAS, the question is how do not reject customer, who reached max value of simultaneous-use?
....if you dont care about them reaching that value, then why are you checking?
but if you really do want to redirect them to an error page - then you need to read/check how to do that with your NAS (as Alan said, read your NAS documentation) and instead of the current Simultaneous-Use result, put your own result in (whatever RADIUS attributes/values you need to set for your user to get redirected to some error page....however that is don by your NAS)
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Wed, Dec 21, 2011 at 4:18 AM, Alexander Kosykh <avkosykh@gmail.com> wrote:
I tried to do this in my config
session { # radutmp
# # See "Simultaneous Use Checking Queries" in sql.conf sql if (Post-Auth-Type == reject) { ok block_auth_error # my own policy }
}
but radius answer is reject whatever and pppoe didn't up
You need to learn some concepts first. What radius can do: - it tells the NAS whether to accept or reject a user - if the user is accepted, it can tell the NAS how to treat that user. e.g. what VLAN he should be on, what speed he can have, etc. However it's up to the NAS whether to actually apply the info sent by radius. What radius can NOT do: - be a captive portal - be a magic box that solves all your problems
From your description, it looks like you should NOT use the default simultaneous-use code. Rather, you should: (1) make sure your NAS supports vlan assignment based on radius reply (2) setup different vlans based on whether a user is currently logged in elsewhere or not (3) setup a captive portal on a vlan (4) configure freeradius to tell the NAS to allocate that vlan when a user tries to login more than once
I can tell you how to do (4) (or you can just read raddb/sql/mysql/dialup.conf), but before you do that you need to have a NAS that supports (1), and you must be able to do (2) and (3). If you don't know how to do that, get an expert to help you. -- Fajar
On Wed, Dec 21, 2011 at 5:29 AM, Fajar A. Nugraha <list@fajar.net> wrote:
On Wed, Dec 21, 2011 at 4:18 AM, Alexander Kosykh <avkosykh@gmail.com> wrote:
I tried to do this in my config
but radius answer is reject whatever and pppoe didn't up
You know what, since you say it's pppoe, I can share a setup on my environment that might be adaptable for you. The situation: - pppoe - IP address is (normally) allocated by nas, dynamically, using public IP address - AAA using freeradius The problem: - we want disabled users to still be able to login, but they'd be placed on a special network where they'd only be able to access an info page (or, in your terms, "error page") The solution: - setup a private IP pool on the NAS (e.g. 10.x.x.x) - put disabled users in a special group (e.g. "disabled-users") - setup sqlippool for that IP address pool (e.g. "disabled-users-pool") - setup a special DNS server (any authoritative DNS server supporting wildcard will do) that will resolve all DNS record to a special web server. - setup routing on the NAS so that the private IP pool can access the DNS server and the web server, but it can't access public IP address - add radgroupcheck entry for that group which points to the pool (e.g. Pool-Name := "disabled-users-pool") - add radgroupreply entry which will tell users to use the special DNS server (e.g MS-Primary-DNS-Server := "10.0.0.10") That way, when a user in "disabled-users" group logs in, he'd get a private IP address, and whatever address he typed in browser will bring him to the info page. You might be able to adapt it to your needs by adding Pool-Name and MS-Primary-DNS-Server attribute dynamically using unlang, based on an sql query which checks whether a user is already logged in or not. Somewhat complicated, but should work. If you're still having trouble understanding the example, better ask an expert to help you. -- Fajar
Hi. I knew how to make all you wrote above. I need to know how to accept customer, when sim-use rejected him. Regards, Alexander. 2011/12/21 Fajar A. Nugraha <list@fajar.net>
On Wed, Dec 21, 2011 at 5:29 AM, Fajar A. Nugraha <list@fajar.net> wrote:
On Wed, Dec 21, 2011 at 4:18 AM, Alexander Kosykh <avkosykh@gmail.com> wrote:
I tried to do this in my config
but radius answer is reject whatever and pppoe didn't up
You know what, since you say it's pppoe, I can share a setup on my environment that might be adaptable for you.
The situation: - pppoe - IP address is (normally) allocated by nas, dynamically, using public IP address - AAA using freeradius
The problem: - we want disabled users to still be able to login, but they'd be placed on a special network where they'd only be able to access an info page (or, in your terms, "error page")
The solution: - setup a private IP pool on the NAS (e.g. 10.x.x.x) - put disabled users in a special group (e.g. "disabled-users") - setup sqlippool for that IP address pool (e.g. "disabled-users-pool") - setup a special DNS server (any authoritative DNS server supporting wildcard will do) that will resolve all DNS record to a special web server. - setup routing on the NAS so that the private IP pool can access the DNS server and the web server, but it can't access public IP address - add radgroupcheck entry for that group which points to the pool (e.g. Pool-Name := "disabled-users-pool") - add radgroupreply entry which will tell users to use the special DNS server (e.g MS-Primary-DNS-Server := "10.0.0.10")
That way, when a user in "disabled-users" group logs in, he'd get a private IP address, and whatever address he typed in browser will bring him to the info page.
You might be able to adapt it to your needs by adding Pool-Name and MS-Primary-DNS-Server attribute dynamically using unlang, based on an sql query which checks whether a user is already logged in or not. Somewhat complicated, but should work.
If you're still having trouble understanding the example, better ask an expert to help you.
-- Fajar - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Wed, Dec 21, 2011 at 12:56 PM, Alexander Kosykh <avkosykh@gmail.com> wrote:
Hi.
I knew how to make all you wrote above.
Are you sure?
I need to know how to accept customer, when sim-use rejected him.
Cause if you do, you wouldn't ask that. Easiest way: simply remove "sql" (or "radutmp", depends on what you use) from "session" section. Then simultaneous-use check will be disabled (e.g. user will be accepted no matter whether they're already logged in or not). You will still be able to examine user status and limit using unlang from "%{control:Simultanenous-Use}" (which gets its value from radcheck/radgroupcheck) and "%{sql: whatever-you-find-as-simul_count_query-on-sql/mysql/dialup.conf}". Using those two values you add reply items (either vlan assignment, IP/DNS assignment, and so on). -- Fajar
How to make checkrad, if disable all in "session" section? acct-stop packets is lost sometimes and sql think that customer is online, but he didn't. Regards, Alexander. 2011/12/21 Fajar A. Nugraha <list@fajar.net>
On Wed, Dec 21, 2011 at 12:56 PM, Alexander Kosykh <avkosykh@gmail.com> wrote:
Hi.
I knew how to make all you wrote above.
Are you sure?
I need to know how to accept customer, when sim-use rejected him.
Cause if you do, you wouldn't ask that.
Easiest way: simply remove "sql" (or "radutmp", depends on what you use) from "session" section. Then simultaneous-use check will be disabled (e.g. user will be accepted no matter whether they're already logged in or not).
You will still be able to examine user status and limit using unlang from "%{control:Simultanenous-Use}" (which gets its value from radcheck/radgroupcheck) and "%{sql: whatever-you-find-as-simul_count_query-on-sql/mysql/dialup.conf}". Using those two values you add reply items (either vlan assignment, IP/DNS assignment, and so on).
-- Fajar - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Wed, Dec 21, 2011 at 1:22 PM, Alexander Kosykh <avkosykh@gmail.com> wrote:
How to make checkrad, if disable all in "session" section?
checkrad should be disabled (i.e. not called by FR) when you comment-out radutmp from "session" section. You should still be able to run it manually $ checkrad Usage: checkrad nas_type nas_ip nas_port login session_id
acct-stop packets is lost sometimes and sql think that customer is online, but he didn't.
I belive I responded to a similar question yesterday (search the list archive). You just have to deal with it. Design your system with the full knowledge that SOME accounting packets will be lost. -- Fajar
Do you have some examples, which work fast to handle 10 AAA/second and check sim-use without freeradius standart methods? Regards, Alexander. 2011/12/21 Fajar A. Nugraha <list@fajar.net>
I belive I responded to a similar question yesterday (search the list archive). You just have to deal with it. Design your system with the full knowledge that SOME accounting packets will be lost
On Wed, Dec 21, 2011 at 2:10 PM, Alexander Kosykh <avkosykh@gmail.com> wrote:
Do you have some examples, which work fast to handle 10 AAA/second and check sim-use without freeradius standart methods?
Did you read what I wrote earlier? All the concepts are there. Converting it to actual code is easy-enough (although takes some time) if you're familiar with freeradius, sqlippool, and unlang. If you're not familiar with it, well, my best advice is either spend some time to study it, or get an expert to help you. -- Fajar
participants (4)
-
Alan Buxey -
Alan DeKok -
Alexander Kosykh -
Fajar A. Nugraha