Hi, I'm using freeradius-2.1.6, and I'm going to make a download limitation for my users. I used sqlcounter module and config it as follow: sqlcounter monthlydownload { counter-name = "Monthly-Download-Byte" check-name = "Max-Monthly-Download" reply-name = "Session-Octets-Limit" key = "User-Name" sqlmod-inst = "sql" query = "SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='%{%k}' AND AcctStartTime > FROM_UNIXTIME('%b')" reset = "monthly" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } According to the log messages, it shows anything is OK: rlm_sqlcounter: Sent Reply-Item for user hrh, Type=Session-Octets-Limit, value=600106145 ++[monthlydownload] returns ok But in proceeding it shows me what it sent, and there isn't Session-Octets-Limit! as you can see bellow: Sending Access-Accept of id 222 to 127.0.0.1 port 32769 Framed-IP-Address := 20.20.20.1 Framed-IP-Netmask := 255.255.255.0 Session-Timeout = 5460 Finished request 0. Where is my problem? more log is available at the end of message. Thanks for you helps. ------ Ya Ali Hamid Reza Hasani More Log: Module: Linked to module rlm_sqlcounter Module: Instantiating monthlydownload sqlcounter monthlydownload { counter-name = "Monthly-Download-Byte" check-name = "Max-Monthly-Download" reply-name = "Session-Octets-Limit" key = "User-Name" sqlmod-inst = "sql" query = "SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='%{%k}' AND AcctStartTime > FROM_UNIXTIME('%b')" reset = "monthly" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sqlcounter: Reply attribute Session-Octets-Limit is number 3009 rlm_sqlcounter: Counter attribute Monthly-Download-Byte is number 11273 rlm_sqlcounter: Check attribute Max-Monthly-Download is number 11274 rlm_sqlcounter: Current Time: 1259506851 [2009-11-29 18:30:51], Next reset 1259613000 [2009-12-01 00:00:00] rlm_sqlcounter: Current Time: 1259506851 [2009-11-29 18:30:51], Prev reset 1257021000 [2009-11-01 00:00:00] Module: Checking preacct {...} for more modules to load . . . rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='%{User-Name}' AND AcctStartTime > FROM_UNIXTIME('1257021000')' [monthlydownload] expand: SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='%{User-Name}' AND AcctStartTime > FROM_UNIXTIME('1257021000') -> SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='hrh' AND AcctStartTime > FROM_UNIXTIME('1257021000') sqlcounter_expand: '%{sql:SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='hrh' AND AcctStartTime > FROM_UNIXTIME('1257021000')}' [monthlydownload] sql_xlat [monthlydownload] expand: %{User-Name} -> hrh [monthlydownload] sql_set_user escaped user --> 'hrh' [monthlydownload] expand: SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='hrh' AND AcctStartTime > FROM_UNIXTIME('1257021000') -> SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='hrh' AND AcctStartTime > FROM_UNIXTIME('1257021000') [monthlydownload] expand: /usr/var/log/radius/sqltrace.sql -> /usr/var/log/radius/sqltrace.sql rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_mysql: query: SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='hrh' AND AcctStartTime > FROM_UNIXTIME('1257021000') [monthlydownload] sql_xlat finished rlm_sql (sql): Released sql socket id: 3 [monthlydownload] expand: %{sql:SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='hrh' AND AcctStartTime > FROM_UNIXTIME('1257021000')} -> 100213 rlm_sqlcounter: Check item is greater than query result rlm_sqlcounter: Authorized user hrh, check_item=600000000, counter=100213 rlm_sqlcounter: Sent Reply-Item for user hrh, Type=Session-Octets-Limit, value=600106145 ++[monthlydownload] returns ok . . . Sending Access-Accept of id 222 to 127.0.0.1 port 32769 Framed-IP-Address := 20.20.20.1 Framed-IP-Netmask := 255.255.255.0 Session-Timeout = 5460 Finished request 0. Going to the next request Waking up in 4.9 seconds.
I'm using freeradius-2.1.6, and I'm going to make a download limitation for my users. I used sqlcounter module and config it as follow:
According to the log messages, it shows anything is OK:
Where is my problem?
rlm_sqlcounter: Reply attribute Session-Octets-Limit is number 3009
Did you actually read the comments in raddb/dictionary? Ivan Kalik
Do you manage to fix your problem? Kindly share your solution. I am interested in knowing how I can configure my freeradius to limit users by both time and max download size e.g. 1usd for 1 hour or 20MB (whichever comes first). charles ----- Original Message ----- From: Hamid Reza Hasani To: freeradius-users@lists.freeradius.org Sent: Sunday, November 29, 2009 5:45 PM Subject: Session-Octets-Limit and sqlcounter Hi, I'm using freeradius-2.1.6, and I'm going to make a download limitation for my users. I used sqlcounter module and config it as follow: sqlcounter monthlydownload { counter-name = "Monthly-Download-Byte" check-name = "Max-Monthly-Download" reply-name = "Session-Octets-Limit" key = "User-Name" sqlmod-inst = "sql" query = "SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='%{%k}' AND AcctStartTime > FROM_UNIXTIME('%b')" reset = "monthly" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } According to the log messages, it shows anything is OK: rlm_sqlcounter: Sent Reply-Item for user hrh, Type=Session-Octets-Limit, value=600106145 ++[monthlydownload] returns ok But in proceeding it shows me what it sent, and there isn't Session-Octets-Limit! as you can see bellow: Sending Access-Accept of id 222 to 127.0.0.1 port 32769 Framed-IP-Address := 20.20.20.1 Framed-IP-Netmask := 255.255.255.0 Session-Timeout = 5460 Finished request 0. Where is my problem? more log is available at the end of message. Thanks for you helps. ------ Ya Ali Hamid Reza Hasani More Log: Module: Linked to module rlm_sqlcounter Module: Instantiating monthlydownload sqlcounter monthlydownload { counter-name = "Monthly-Download-Byte" check-name = "Max-Monthly-Download" reply-name = "Session-Octets-Limit" key = "User-Name" sqlmod-inst = "sql" query = "SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='%{%k}' AND AcctStartTime > FROM_UNIXTIME('%b')" reset = "monthly" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sqlcounter: Reply attribute Session-Octets-Limit is number 3009 rlm_sqlcounter: Counter attribute Monthly-Download-Byte is number 11273 rlm_sqlcounter: Check attribute Max-Monthly-Download is number 11274 rlm_sqlcounter: Current Time: 1259506851 [2009-11-29 18:30:51], Next reset 1259613000 [2009-12-01 00:00:00] rlm_sqlcounter: Current Time: 1259506851 [2009-11-29 18:30:51], Prev reset 1257021000 [2009-11-01 00:00:00] Module: Checking preacct {...} for more modules to load . . . rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='%{User-Name}' AND AcctStartTime > FROM_UNIXTIME('1257021000')' [monthlydownload] expand: SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='%{User-Name}' AND AcctStartTime > FROM_UNIXTIME('1257021000') -> SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='hrh' AND AcctStartTime > FROM_UNIXTIME('1257021000') sqlcounter_expand: '%{sql:SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='hrh' AND AcctStartTime > FROM_UNIXTIME('1257021000')}' [monthlydownload] sql_xlat [monthlydownload] expand: %{User-Name} -> hrh [monthlydownload] sql_set_user escaped user --> 'hrh' [monthlydownload] expand: SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='hrh' AND AcctStartTime > FROM_UNIXTIME('1257021000') -> SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='hrh' AND AcctStartTime > FROM_UNIXTIME('1257021000') [monthlydownload] expand: /usr/var/log/radius/sqltrace.sql -> /usr/var/log/radius/sqltrace.sql rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_mysql: query: SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='hrh' AND AcctStartTime > FROM_UNIXTIME('1257021000') [monthlydownload] sql_xlat finished rlm_sql (sql): Released sql socket id: 3 [monthlydownload] expand: %{sql:SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='hrh' AND AcctStartTime > FROM_UNIXTIME('1257021000')} -> 100213 rlm_sqlcounter: Check item is greater than query result rlm_sqlcounter: Authorized user hrh, check_item=600000000, counter=100213 rlm_sqlcounter: Sent Reply-Item for user hrh, Type=Session-Octets-Limit, value=600106145 ++[monthlydownload] returns ok . . . Sending Access-Accept of id 222 to 127.0.0.1 port 32769 Framed-IP-Address := 20.20.20.1 Framed-IP-Netmask := 255.255.255.0 Session-Timeout = 5460 Finished request 0. Going to the next request Waking up in 4.9 seconds. ________________________________________________________________ 5 free Domains with Select Hosting Plans. Get yours! com net org info us name biz cc tv ws mobi ------------------------------------------------------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Buy a domain : http://www.1and1.com/?k_id=25085883
Charles wrote:
Do you manage to fix your problem? Kindly share your solution. I am interested in knowing how I can configure my freeradius to limit users by both time and max download size
As with *ALL* of these questions: Does your NAS support this? Go read the NAS documentation. FreeRADIUS is *not* a firewall. The NAS is a firewall. FreeRADIUS simply tells the NAS which rules to apply. Alan DeKok.
Thanks Alan for your help. My NAS is m0n0wall (http://m0n0.ch/wall/features.php) and its captive portal features are briefly outlined here: http://doc.m0n0.ch/handbook/ch12s06.html . It mentions bandwidth setings. In my current setup, I use session_timeout and it works very well but I have users who download heavily within an hour. So I would like to limit using both Session_Timeout and max octes (which ever is reached first). Kindly help me by checking the features to see if I can use this NAS for this purpose. I dont know what they mean by "Bandwidth Settings" Charles ----- Original Message ----- From: "Alan DeKok" <aland@deployingradius.com> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Monday, November 30, 2009 3:04 PM Subject: Re: Session-Octets-Limit and sqlcounter
Charles wrote:
Do you manage to fix your problem? Kindly share your solution. I am interested in knowing how I can configure my freeradius to limit users by both time and max download size
As with *ALL* of these questions:
Does your NAS support this?
Go read the NAS documentation.
FreeRADIUS is *not* a firewall. The NAS is a firewall. FreeRADIUS simply tells the NAS which rules to apply.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
__________________________________________________ Buy a domain : http://www.1and1.com/?k_id=25085883
__________________________________________________ Buy a domain : http://www.1and1.com/?k_id=25085883
Charles wrote:
My NAS is m0n0wall (http://m0n0.ch/wall/features.php) and its captive portal features are briefly outlined here: http://doc.m0n0.ch/handbook/ch12s06.html . It mentions bandwidth setings.
How nice.
In my current setup, I use session_timeout and it works very well but I have users who download heavily within an hour. So I would like to limit using both Session_Timeout and max octes (which ever is reached first).
You already said that.
Kindly help me by checking the features to see if I can use this NAS for this purpose.
Why?
I dont know what they mean by "Bandwidth Settings"
So... ask the Monowall people. We didn't write Monowall, and we didn't write it's documentation. if you don't understand it, ask them for help. Alan DeKok.
Thanks Allan, I think you are right, I will ask in the monowall forum. Just that the forum is not very active on Captive Portal issues. Could you be kind to suggest a NAS that you know which can help me achieve my goal? Thanks in advance - I know I am asking too much. Charles ----- Original Message ----- From: "Alan DeKok" <aland@deployingradius.com> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Monday, November 30, 2009 4:08 PM Subject: Re: Session-Octets-Limit and sqlcounter
Charles wrote:
My NAS is m0n0wall (http://m0n0.ch/wall/features.php) and its captive portal features are briefly outlined here: http://doc.m0n0.ch/handbook/ch12s06.html . It mentions bandwidth setings.
How nice.
In my current setup, I use session_timeout and it works very well but I have users who download heavily within an hour. So I would like to limit using both Session_Timeout and max octes (which ever is reached first).
You already said that.
Kindly help me by checking the features to see if I can use this NAS for this purpose.
Why?
I dont know what they mean by "Bandwidth Settings"
So... ask the Monowall people. We didn't write Monowall, and we didn't write it's documentation. if you don't understand it, ask them for help.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
__________________________________________________ Buy a domain : http://www.1and1.com/?k_id=25085883
__________________________________________________ Buy a domain : http://www.1and1.com/?k_id=25085883
On Mon, Nov 30, 2009 at 4:44 PM, Charles <charles@goma.kivu-online.com> wrote:
Thanks Allan,
I think you are right, I will ask in the monowall forum. Just that the forum is not very active on Captive Portal issues.
Could you be kind to suggest a NAS that you know which can help me achieve my goal?
Thanks in advance - I know I am asking too much.
Charles
Charles, m0n0wall has an option in the CP settings to re-authenticate every minute. It makes your life real easy in setting up radius. Just set a check item in radcheck containing your datacap and set sql counter appropiate. But as suggested, the m0n0wall list will definately help you out. kind regards Y.
Thanks YvesDM, I saw it - the attribute - and my problem is now solved!!!! Many thinks! the Last line ! 1.236 (09/30/2009) a.. fixed a security issue in the DHCP client (CVE-2009-0692) b.. captive portal fixes (jdegraeve): a.. changed RADIUS timeout/maxtries from 5/3 to 3/2 reducing failover time from 30 to 15 seconds b.. added RADIUS attribute support for: ChilliSpot-Bandwidth-Max-Up/ChilliSpot-Bandwidth-Max-Down ----- Original Message ----- From: "YvesDM" <ydmlog@gmail.com> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Monday, November 30, 2009 11:09 PM Subject: Re: Session-Octets-Limit and sqlcounter
On Mon, Nov 30, 2009 at 4:44 PM, Charles <charles@goma.kivu-online.com> wrote:
Thanks Allan,
I think you are right, I will ask in the monowall forum. Just that the forum is not very active on Captive Portal issues.
Could you be kind to suggest a NAS that you know which can help me achieve my goal?
Thanks in advance - I know I am asking too much.
Charles
Charles,
m0n0wall has an option in the CP settings to re-authenticate every minute. It makes your life real easy in setting up radius. Just set a check item in radcheck containing your datacap and set sql counter appropiate. But as suggested, the m0n0wall list will definately help you out.
kind regards Y. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
__________________________________________________ Buy a domain : http://www.1and1.com/?k_id=25085883
__________________________________________________ Buy a domain : http://www.1and1.com/?k_id=25085883
I think you are right, I will ask in the monowall forum. Just that the forum is not very active on Captive Portal issues.
Could you be kind to suggest a NAS that you know which can help me achieve my goal?
Thanks in advance - I know I am asking too much.
Yes you do. Now go and read monowall changelog and all will be answered. Ivan Kalik
participants (5)
-
Alan DeKok -
Charles -
Hamid Reza Hasani -
tnt＠kalik.net -
YvesDM