On 2012-04-13 06:27 PM, shiv wrote:

You should use the Login-Time attribute. look here to see how its used -> http://wiki.freeradius.org/Rlm_logintime Ideally, you would add a row for each user (not optimal) with Login-Time attribute with value like 'Al1600-1700' which means they will be able to login only between 1600 and 1700 on all days. We use it in the radgroupcheck table for groups of users and in unlang for groups of NAS's.

Use the freeradius-dialupadmin package. There is some similar function, but I haven't tried it.

On 2012-04-13 09:49 PM, jomajo wrote:

Hello guys.

Thank you for your answers. I just installed dialup admin. There is no functions to manage at what time users can connect and at what time they can not. :(

I'm looking for solution like Jeremy Stretch already has on his lab : http://packetlife.net/wiki/how-community-lab-works/

Dialup admin can manage so many attributes. Read through the package's readme, faq, howto etc... The features are hidden. Freeradius 2.1 is so feature rich. One cannot learn it enough in a few months. ;)

Hi! I am talking just about time-based authentication, at the specific time. But now there is a problem with MD5 encryption. Take a look please: <...> ++[sql] returns ok rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair ++[daily] returns noop rlm_checkval: Item Name: Calling-Station-Id, Value: 10.0.0.254 rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs ++[checkval] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = PAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "test" [pap] Using MD5 encryption. [pap] Configured MD5 password has incorrect length [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 43 to 10.0.0.1 port 1645 Waking up in 4.9 seconds. Cleaning up request 0 ID 43 with timestamp +11 Ready to process requests. <...> -- View this message in context: http://freeradius.1045715.n5.nabble.com/FreeRADIUS-time-based-authentication... Sent from the FreeRadius - User mailing list archive at Nabble.com.

jomajo wrote:

I am talking just about time-based authentication, at the specific time.

But now there is a problem with MD5 encryption. Take a look please:

No. *You* need to read the output. The problem is clear. Alan DeKok.

jomajo wrote:

Yes, the problem is clear:

[pap] Configured MD5 password has incorrect length [pap] Passwords don't match

But I'm looking how to solve this problem.

Password is correct.

Really? The debug message says otherwise. I guess it's impossible to solve. The passwords are clearly *so* secret that you can't post them. It's not like the configuration file for the "pap" module contains a URL that tells you how to create a *correct* MD5 password. That information is super-secret, too. Alan DeKok.

Hi,

And there is a full "freeradius -X " command output:

yep : [pap] Configured MD5 password has incorrect length did you read the txt that Alan already mentioned? I'd personally choose cleartext-password with {md5} at the beginning of the value with auto_header = yes in pap module.. alan

Need I change something / somewhere once more? -- View this message in context: http://freeradius.1045715.n5.nabble.com/FreeRADIUS-time-based-authentication... Sent from the FreeRadius - User mailing list archive at Nabble.com.

Yes... I was looking in wrong location. You are correct. My md5 algorith in dialup-administrator for password creation was "crypt" not "md5" :) Now this is working! Thank you very much guys! -- View this message in context: http://freeradius.1045715.n5.nabble.com/FreeRADIUS-time-based-authentication... Sent from the FreeRadius - User mailing list archive at Nabble.com.

Hi Joey, On Sat, Apr 14, 2012 at 12:06:06AM +0800, ZhenJoey wrote:

The first one, Athoriztion! FreeRadius is AAA server, I know what the Authentication does,I know what the Accounting does, but I dont know what the Athorization does.

Try reading doc/aaa.rst in the source, which gives a good overview. Also, the PDFs on http://aureliengeron.free.fr/livrewifi/ are good - see http://aureliengeron.free.fr/livrewifi/freeradius-en-part3.pdf for example - all of it is good, but p23 onwards might help you the most. It shows how packets make their way through the server.

Second question, the Attribute belong to a NAS or Belong to a user or some is NAS's attribute ,some is user;s attribute?

Attributes/values are passed between the NAS (which is the RADIUS 'client') and the RADIUS server. They have nothing (directly) to do with the end user. Of course, user login information is placed into the attributes by the NAS.

a enviroment variable named "WISPR_BANDWIDTH_DOWN_MAX"of the NAS OS,does any one knows,how the NAS control the bandwidth after set this enviroment varibale???

I suggest you read the documentation on your NAS. The RADIUS server just sends attributes back, and it's up to the NAS to implement what it's told.

and one more question,does anyone have experience of set the Attribute "BANDWIDTH_DOWN_MAX"(of course different name in different NAS) for radreply?, the MAX BANDWIDTH means the NAS have this MAX bandwidth, all user will share these bandwidth? or the specific user whose reply from Radius Server contain this attribute has this limit, there is no affect on other users who do not have this attribute?

It's up to the NAS - read the documentation for that. In terms of coovachilli, setting DEFAULT WISPr-Bandwidth-Max-Up = 1000000, WISPr-Bandwidth-Max-Down = 2000000 in your users file (there are plenty of other ways to do this - unlang, sql, etc) will mean that all users get 1Mbit up and 2Mbit down. You can send these with different values per user if you want. Cheers, Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>