Using radgroupcheck to reject user's login
Hi, Do you know if is possible to reject a login with radgroupcheck? In latest versions of FreeRADIUS, if we want to reject a user's request that tries to do login with some attributes, we should to use radcheck because if we use radgroupcheck FreeRADIUS doesn't produce a reject. In radcheck we should to define all compulsary attributes, because if there are attributes into radgroupchek and not correspond with NAS' attributes, FreeRADIUS will continues checking other groups. I would like to know if any attribute doesn't correspond, if is possible, that FreeRADIUS rejects the request and doesn't continues checking other groups from radgroupcheck. We are interested in maintain radgroupcheck table with compulsary attributes (if is possible). Maybe changing some settings, can we achieve this? Thanks for your help. Best regards, Toni. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Using-radgroupcheck-to-reject-user-s... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Hi, I have implemented daily usage limit and also volume limit but users are still able to connect. Radius logs says, Auth: Invalid user (rlm_counter: Maximum daily usage time reached): [fam/fam] (from client mynetwork port 2 cli 0013726e6f35) User can connect. Any help. Thanks and regards, Fazal Ahmed Malik
On Thu, Feb 9, 2012 at 12:51 AM, Fazal Ahmed Malik <fam@solacetel.com> wrote:
Hi,
I have implemented daily usage limit and also volume limit but users are still able to connect. Radius logs says,
Auth: Invalid user (rlm_counter: Maximum daily usage time reached): [fam/fam] (from client mynetwork port 2 cli 0013726e6f35)
User can connect.
What does the debug log say? If FR is sending access-reject but the nas allows the user to connect anyway, then blame the NAS. Possibly you're looking at logs when the user is rejected sometime in the past, but the user is currently accepted. Retry your test with FR running in debug mode and see the output. -- Fajar
tonimanel wrote:
I would like to know if any attribute doesn't correspond, if is possible, that FreeRADIUS rejects the request and doesn't continues checking other groups from radgroupcheck.
See the FAQ for how to reject users. It doesn't matter if the configuration is in the "users" file, SQL, or elsewhere. The attributes are the same. Alan DeKok.
Hi (Alan), Thanks for your answer. I have read about that ... Maybe to fix this problem, I should to reject all users and then add an accept by each group. That's correct? Or, are there a better solution? I hope your answers because I would like to do some tests to achieve it. Thanks and regards, Toni.? -- View this message in context: http://freeradius.1045715.n5.nabble.com/Using-radgroupcheck-to-reject-user-s... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Hi again, I have been testing with the definition of DEFAULT Auth-Type := Reject in users file, but does not works. I don't know if I should to define this into another directive or in another file or in sql table. Now, I'm thinking in to define radgroupcheck's attributes directly into radcheck table and the same with radgroupreply's attributes because, I'm interested in reject a user if doesn't correspond with its group's attributes. Is this really the way to achieve this? Thanks and regards, Toni. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Using-radgroupcheck-to-reject-user-s... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Better option is to accept user login but assign his account in special group where he will be redirected to specific page (for example "Your account is suspended ....") To many user rejects can overload your NAS/RADIUS and it is hard to trace the regular user login attempts... On 2/9/2012 5:53 PM, tonimanel wrote:
Hi again,
I have been testing with the definition of DEFAULT Auth-Type := Reject in users file, but does not works. I don't know if I should to define this into another directive or in another file or in sql table. Now, I'm thinking in to define radgroupcheck's attributes directly into radcheck table and the same with radgroupreply's attributes because, I'm interested in reject a user if doesn't correspond with its group's attributes.
Is this really the way to achieve this?
Thanks and regards,
Toni.
-- View this message in context: http://freeradius.1045715.n5.nabble.com/Using-radgroupcheck-to-reject-user-s... Sent from the FreeRadius - User mailing list archive at Nabble.com. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (5)
-
Alan DeKok -
Fajar A. Nugraha -
Fazal Ahmed Malik -
Marinko Tarlac -
tonimanel