permit access on date/hour intervals and policy.conf problem
Hi, I need to be able to specify an interval of date and time for accessing through a captive portal connected to freeradius; for example testuser can use network from 2015-05-01 17:00:00 to 2015-05-01 18:00:00 i create 3 custom attributes: ATTRIBUTE System-Date 3002 integer ATTRIBUTE Start_Time 3000 integer ATTRIBUTE Stop_Time 3001 integer System-Date to store system data Start_Time to assign a start auth period for user Stop_Time to assign the end of auithentication permission. I use UNIX time for every attribute for provisioning purpose i use Freeradius + MySQL and in my radcheck table i have for example: testuser | Cleartext-Password | := | testuser testuser | Start_Time | := | 1430499600 testuser | Stop_Time | := | 1430503200 to check account validity i add on policy.conf : check_validity { update control { System-Date := "%l" } if (Start_Time > control:System-Date) { update reply { Reply-Message := "account not yet active" } reject } if (Stop_Time < control:System-Date) { update reply { Reply-Message := "account no longer active" } reject } } freeradius start without error, System-Date take the correct value for Date but Start_Time and Stop_Time in this way seems to work with a file not mysql...(yes my default site has check_validity in authorize section) I don't know how use a query to assign database stored value for Start_Time and Stop_TIme, is it possbile? I need some examples... Thanks in advance Franz Angeli
On May 19, 2015, at 12:49 PM, Franz Angeli <franz.angeli@gmail.com> wrote:
I need to be able to specify an interval of date and time for accessing through a captive portal connected to freeradius;
for example testuser can use network from 2015-05-01 17:00:00 to 2015-05-01 18:00:00
i create 3 custom attributes:
ATTRIBUTE System-Date 3002 integer ATTRIBUTE Start_Time 3000 integer ATTRIBUTE Stop_Time 3001 integer
These should probably be of type "date", and not "integer". But it won't make a huge amount of difference.
System-Date to store system data
Start_Time to assign a start auth period for user
Stop_Time to assign the end of auithentication permission.
That's fine.
for provisioning purpose i use Freeradius + MySQL and in my radcheck table i have for example:
testuser | Cleartext-Password | := | testuser testuser | Start_Time | := | 1430499600 testuser | Stop_Time | := | 1430503200
That should work.
to check account validity i add on policy.conf :
That should work, too.
freeradius start without error, System-Date take the correct value for Date but Start_Time and Stop_Time in this way seems to work with a file not mysql...(yes my default site has check_validity in authorize section)
That's good.
I don't know how use a query to assign database stored value for Start_Time and Stop_TIme, is it possbile? I need some examples...
You are assigning the values from the database. That's what the entries in the radcheck table do. Perhaps you could describe in more detail what you want. Alan DeKok.
Hi, i need to have assigned Start_Time value stored on Database in Start_Time attribute used by check_validity on my policy.conf i think some like: check_validity { update control { System-Date := "%l" Start_Time := "%{sql:SELECT value FROM radcheck WHERE username = %{User-Name} and attribute = Start_Time}" Stop_Time := "%{sql:SELECT value FROM radcheck WHERE username = %{User-Name} and attribute = Stop_Time}" but i think is an incorrect syntax 2015-05-19 19:20 GMT+02:00 Alan DeKok <aland@deployingradius.com>:
On May 19, 2015, at 12:49 PM, Franz Angeli <franz.angeli@gmail.com> wrote:
I need to be able to specify an interval of date and time for accessing through a captive portal connected to freeradius;
for example testuser can use network from 2015-05-01 17:00:00 to 2015-05-01 18:00:00
i create 3 custom attributes:
ATTRIBUTE System-Date 3002 integer ATTRIBUTE Start_Time 3000 integer ATTRIBUTE Stop_Time 3001 integer
These should probably be of type "date", and not "integer". But it won't make a huge amount of difference.
System-Date to store system data
Start_Time to assign a start auth period for user
Stop_Time to assign the end of auithentication permission.
That's fine.
for provisioning purpose i use Freeradius + MySQL and in my radcheck table i have for example:
testuser | Cleartext-Password | := | testuser testuser | Start_Time | := | 1430499600 testuser | Stop_Time | := | 1430503200
That should work.
to check account validity i add on policy.conf :
That should work, too.
freeradius start without error, System-Date take the correct value for Date but Start_Time and Stop_Time in this way seems to work with a file not mysql...(yes my default site has check_validity in authorize section)
That's good.
I don't know how use a query to assign database stored value for Start_Time and Stop_TIme, is it possbile? I need some examples...
You are assigning the values from the database. That's what the entries in the radcheck table do.
Perhaps you could describe in more detail what you want.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On May 19, 2015, at 1:27 PM, Franz Angeli <franz.angeli@gmail.com> wrote:
i need to have assigned Start_Time value stored on Database in Start_Time attribute used by check_validity on my policy.conf
But that's what the radcheck table does...
i think some like:
No. You just need to list "sql" before the "check_validity" policy. The attributes will automatically be pulled from the radcheck table, for use in your policy. Alan DeKok.
in this way i have: sql policy { check_validity { update control { System-Date := "%l" ..... .... but it seems doesnt' work ++[sql] returns ok ++- entering policy check_validity {...} expand: %l -> 1432057169 +++[control] returns noop +++? if (Start_Time > control:System-Date) (Attribute Start_Time was not found) ? Evaluating (Start_Time > control:System-Date) -> FALSE +++? if (Start_Time > control:System-Date) -> FALSE +++? if (Stop_Time < control:System-Date) (Attribute Stop_Time was not found) ? Evaluating (Stop_Time < control:System-Date) -> FALSE +++? if (Stop_Time < control:System-Date) -> FALSE ++- policy check_validity returns noop 2015-05-19 19:36 GMT+02:00 Alan DeKok <aland@deployingradius.com>:
On May 19, 2015, at 1:27 PM, Franz Angeli <franz.angeli@gmail.com> wrote:
i need to have assigned Start_Time value stored on Database in Start_Time attribute used by check_validity on my policy.conf
But that's what the radcheck table does...
i think some like:
No. You just need to list "sql" before the "check_validity" policy. The attributes will automatically be pulled from the radcheck table, for use in your policy.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On May 19, 2015, at 1:42 PM, Franz Angeli <franz.angeli@gmail.com> wrote:
in this way i have:
sql policy {
check_validity {
That's... weird. The policies SHOULD go into raddb/policy.conf. Then, just use the policy name: ... sql check_validity ...
but it seems doesnt' work
++[sql] returns ok ++- entering policy check_validity {...} expand: %l -> 1432057169 +++[control] returns noop +++? if (Start_Time > control:System-Date)
Try using control:Start_Time. See the WIki for how the rlm_sql module works. Alan DeKok.
now i'm using: ATTRIBUTE System-Date 3002 date ATTRIBUTE Start_Time 3000 date ATTRIBUTE Stop_Time 3001 date and in policy.conf policy { sql check_validity { update control { System-Date := "%l" } if (control:Start_Time > control:System-Date) { update reply { Reply-Message := "account not yet active" } reject } if (control:Stop_Time < control:System-Date) { update reply { Reply-Message := "account no longer active" } reject } } in this way i have error: ++- entering policy check_validity {...} expand: %l -> 1432060355 +++[control] returns noop +++? if (control:Start_Time > control:System-Date) Failed parsing "control:System-Date": failed to parse time string "control:System-Date" +++? if (control:Stop_Time < control:System-Date) Failed parsing "control:System-Date": failed to parse time string "control:System-Date" ++- policy check_validity returns noop 2015-05-19 20:11 GMT+02:00 Alan DeKok <aland@deployingradius.com>:
On May 19, 2015, at 1:42 PM, Franz Angeli <franz.angeli@gmail.com> wrote:
in this way i have:
sql policy {
check_validity {
That's... weird. The policies SHOULD go into raddb/policy.conf. Then, just use the policy name:
... sql check_validity ...
but it seems doesnt' work
++[sql] returns ok ++- entering policy check_validity {...} expand: %l -> 1432057169 +++[control] returns noop +++? if (Start_Time > control:System-Date)
Try using control:Start_Time. See the WIki for how the rlm_sql module works.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On May 19, 2015, at 2:35 PM, Franz Angeli <franz.angeli@gmail.com> wrote:
now i'm using:
ATTRIBUTE System-Date 3002 date ATTRIBUTE Start_Time 3000 date ATTRIBUTE Stop_Time 3001 date
You have to change the contents of the SQL database to contain dates, too. Or, just leave the dictionary entries as "integer". Alan DeKok.
with attribute set at integer i have: ++- entering policy check_validity {...} expand: %l -> 1432061274 +++[control] returns noop +++? if (control:Start_Time > control:System-Date) Failed parsing "control:System-Date": Unknown value control:System-Date for attribute Start_Time +++? if (control:Stop_Time < control:System-Date) Failed parsing "control:System-Date": Unknown value control:System-Date for attribute Stop_Time ++- policy check_validity returns noop but is strange expand: %l -> 1432061274 +++[control] returns noop for System-Date := "%l" ? 2015-05-19 20:43 GMT+02:00 Alan DeKok <aland@deployingradius.com>:
On May 19, 2015, at 2:35 PM, Franz Angeli <franz.angeli@gmail.com> wrote:
now i'm using:
ATTRIBUTE System-Date 3002 date ATTRIBUTE Start_Time 3000 date ATTRIBUTE Stop_Time 3001 date
You have to change the contents of the SQL database to contain dates, too.
Or, just leave the dictionary entries as "integer".
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On May 19, 2015, at 2:50 PM, Franz Angeli <franz.angeli@gmail.com> wrote:
with attribute set at integer i have:
++- entering policy check_validity {...} expand: %l -> 1432061274 +++[control] returns noop +++? if (control:Start_Time > control:System-Date) Failed parsing "control:System-Date": Unknown value
In v2, you have to do: if (control:Start_Time > "%{control:System-Date}") { ... In v3, you can compare attributes directly. Alan DeKok.
yes my is V 2.1.12 with: policy { sql check_validity { update control { System-Date := "%l" } if ("%{control:Start_Time}" > "%{control:System-Date}") { update reply { Reply-Message := "account not yet active" } reject } if ("%{control:Stop_Time}" < "%{control:System-Date}") { update reply { Reply-Message := "account no longer active" } reject } } it works! ++- entering policy check_validity {...} expand: %l -> 1432062177 +++[control] returns noop +++? if ("%{control:Start_Time}" > "%{control:System-Date}") expand: %{control:Start_Time} -> 1432062108 expand: %{control:System-Date} -> 1432062177 ? Evaluating ("%{control:Start_Time}" > "%{control:System-Date}") -> FALSE +++? if ("%{control:Start_Time}" > "%{control:System-Date}") -> FALSE +++? if ("%{control:Stop_Time}" < "%{control:System-Date}") expand: %{control:Stop_Time} -> 1432062308 expand: %{control:System-Date} -> 1432062177 ? Evaluating ("%{control:Stop_Time}" < "%{control:System-Date}") -> FALSE +++? if ("%{control:Stop_Time}" < "%{control:System-Date}") -> FALSE ++- policy check_validity returns noop or in case of Stop_Time < System-Date ++- entering policy check_validity {...} expand: %l -> 1432062346 +++[control] returns noop +++? if ("%{control:Start_Time}" > "%{control:System-Date}") expand: %{control:Start_Time} -> 1432062108 expand: %{control:System-Date} -> 1432062346 ? Evaluating ("%{control:Start_Time}" > "%{control:System-Date}") -> FALSE +++? if ("%{control:Start_Time}" > "%{control:System-Date}") -> FALSE +++? if ("%{control:Stop_Time}" < "%{control:System-Date}") expand: %{control:Stop_Time} -> 1432062308 expand: %{control:System-Date} -> 1432062346 ? Evaluating ("%{control:Stop_Time}" < "%{control:System-Date}") -> TRUE +++? if ("%{control:Stop_Time}" < "%{control:System-Date}") -> TRUE +++- entering if ("%{control:Stop_Time}" < "%{control:System-Date}") {...} ++++[reply] returns noop ++++[reject] returns reject Thanks!!! 2015-05-19 20:51 GMT+02:00 Alan DeKok <aland@deployingradius.com>:
On May 19, 2015, at 2:50 PM, Franz Angeli <franz.angeli@gmail.com> wrote:
with attribute set at integer i have:
++- entering policy check_validity {...} expand: %l -> 1432061274 +++[control] returns noop +++? if (control:Start_Time > control:System-Date) Failed parsing "control:System-Date": Unknown value
In v2, you have to do:
if (control:Start_Time > "%{control:System-Date}") { ...
In v3, you can compare attributes directly.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
and just for info...are there some other ways to obtain the same result? 2015-05-19 21:08 GMT+02:00 Franz Angeli <franz.angeli@gmail.com>:
yes my is V 2.1.12
with:
policy { sql check_validity { update control { System-Date := "%l" } if ("%{control:Start_Time}" > "%{control:System-Date}") { update reply { Reply-Message := "account not yet active" } reject } if ("%{control:Stop_Time}" < "%{control:System-Date}") { update reply { Reply-Message := "account no longer active" } reject } }
it works!
++- entering policy check_validity {...} expand: %l -> 1432062177 +++[control] returns noop +++? if ("%{control:Start_Time}" > "%{control:System-Date}") expand: %{control:Start_Time} -> 1432062108 expand: %{control:System-Date} -> 1432062177 ? Evaluating ("%{control:Start_Time}" > "%{control:System-Date}") -> FALSE +++? if ("%{control:Start_Time}" > "%{control:System-Date}") -> FALSE +++? if ("%{control:Stop_Time}" < "%{control:System-Date}") expand: %{control:Stop_Time} -> 1432062308 expand: %{control:System-Date} -> 1432062177 ? Evaluating ("%{control:Stop_Time}" < "%{control:System-Date}") -> FALSE +++? if ("%{control:Stop_Time}" < "%{control:System-Date}") -> FALSE ++- policy check_validity returns noop
or in case of Stop_Time < System-Date
++- entering policy check_validity {...} expand: %l -> 1432062346 +++[control] returns noop +++? if ("%{control:Start_Time}" > "%{control:System-Date}") expand: %{control:Start_Time} -> 1432062108 expand: %{control:System-Date} -> 1432062346 ? Evaluating ("%{control:Start_Time}" > "%{control:System-Date}") -> FALSE +++? if ("%{control:Start_Time}" > "%{control:System-Date}") -> FALSE +++? if ("%{control:Stop_Time}" < "%{control:System-Date}") expand: %{control:Stop_Time} -> 1432062308 expand: %{control:System-Date} -> 1432062346 ? Evaluating ("%{control:Stop_Time}" < "%{control:System-Date}") -> TRUE +++? if ("%{control:Stop_Time}" < "%{control:System-Date}") -> TRUE +++- entering if ("%{control:Stop_Time}" < "%{control:System-Date}") {...} ++++[reply] returns noop ++++[reject] returns reject
Thanks!!!
2015-05-19 20:51 GMT+02:00 Alan DeKok <aland@deployingradius.com>:
On May 19, 2015, at 2:50 PM, Franz Angeli <franz.angeli@gmail.com> wrote:
with attribute set at integer i have:
++- entering policy check_validity {...} expand: %l -> 1432061274 +++[control] returns noop +++? if (control:Start_Time > control:System-Date) Failed parsing "control:System-Date": Unknown value
In v2, you have to do:
if (control:Start_Time > "%{control:System-Date}") { ...
In v3, you can compare attributes directly.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Alan DeKok -
Franz Angeli