Re :checking authorization in the duration of connection
I found this reply in freeradius mailing list in 2005: " It's impossible to enforce *traffic* limiting *during* a users session. So if a user is a tiny bit below their limit and logs in again, they can go over their limit. The server will only catch & enforce their limit on the next login. This has been discussed multiple times on the list over the past 5 years." Is this possible now in new versions ?
On Mon, May 4, 2009 at 12:26 PM, Eric <bbahar3@gmail.com> wrote:
I found this reply in freeradius mailing list in 2005:
" It's impossible to enforce traffic limiting *during* a users session. So if a user is a tiny bit below their limit and logs in again, they can go over their limit. The server will only catch & enforce their limit on the next login. This has been discussed multiple times on the list over the past 5 years."
Is this possible now in new versions ?
POSSIBLE, yes. See Ivan's response. The prequisite is that the NAS supports Packet of Disconnect (POD). Is it recommended? No. Regards, Fajar
I found this reply in freeradius mailing list in 2005:
" It's impossible to enforce *traffic* limiting *during* a users session. So if a user is a tiny bit below their limit and logs in again, they can go over their limit. The server will only catch & enforce their limit on the next login. This has been discussed multiple times on the list over the past 5 years."
Is this possible now in new versions ?
Enforcing traffic limits is impossible - using standard radius attributes. And this has nothing to do with freeradius version. But most vendors (not just likes of Cisco, but ChilliSpot, Mikrotik, etc.) have vendor specific attributes (VSA) that you can use to limit traffic. Read your vendor documentation (or ask the vendor) to see how it can be done. Then use that VSA in the (sql)counter. Ivan Kalik Kalik Informatika ISP
what about this document? http://www.netexpertise.eu/en/freeradius/daily-accounting.html
what about this document? http://www.netexpertise.eu/en/freeradius/daily-accounting.html
Outdated. Freeradius has gigaword accounting enabled by default now. Ivan Kalik Kalik Informatika ISP
On 5/5/09 14:20, Ivan Kalik wrote:
what about this document? http://www.netexpertise.eu/en/freeradius/daily-accounting.html
Outdated. Freeradius has gigaword accounting enabled by default now.
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
It's possible even if the NAS doesn't support PoD, so long as the NAS supports the 802.1X mib, you should be able to fire off an SNMP-SET with the exec module and force re-authentication. All the required information is available in the Accounting Request the server just received. If you're really having trouble and ask nicely i'll write some example code. Arran -- Arran Cudbard-Bell (A.Cudbard-Bell@sussex.ac.uk), Authentication, Authorisation and Accounting Officer, Infrastructure Services (IT Services), E1-1-08, Engineering 1, University Of Sussex, Brighton, BN1 9QT DDI+FAX: +44 1273 873900 | INT: 3900 GPG: 86FF A285 1AA1 EE40 D228 7C2E 71A9 25BB 1E68 54A2
Hi Ivan, This is outdated since Freeradius 2 but the basics remain true, ie: Create a new record each time an accounting update is received to get (as much as possible) an up-to-date database, especially when sessions last for a long time. This helps to get an updated traffic every hour for instance. I'll write a new version as soon as I get a chance for FR2. David
what about this document? http://www.netexpertise.eu/en/freeradius/daily-accounting.html
Outdated. Freeradius has gigaword accounting enabled by default now. Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (5)
-
Arran Cudbard-Bell -
David -
Eric -
Fajar A. Nugraha -
Ivan Kalik