Hello Team, I am a newbie to radius server. I have installed free-radius in linux machine with accounting support and was able to authenticate using radtest client.and also I was also successfully authenticate with squid proxy server. I need to assign quota to squid users based on the weekly/hourly basis. I need users radius server to return packet reject when time is expired. is it possible in radius? I am using only linux machine with proxy server. whether NAS is needed? If so, can anyone help me in framing the rules for quota . eg 2 hours a day. I have basic configuration and now when a user authenticates login time is updated in the radpostauth. Thanks, Senthil
senthil kumar wrote:
I have installed free-radius in linux machine with accounting support and was able to authenticate using radtest client.and also I was also successfully authenticate with squid proxy server.
That's good to hear.
I need to assign quota to squid users based on the weekly/hourly basis. I need users radius server to return packet reject when time is expired. is it possible in radius?
Yes. See the "counter" module, or the "sqlcounter" module. The main issue is that they require the NAS to send accounting packets. I don't know if squid does that.
I am using only linux machine with proxy server. whether NAS is needed?
In this case, squid is the NAS. (i.e. machine sending Access-Request)
If so, can anyone help me in framing the rules for quota . eg 2 hours a day. I have basic configuration and now when a user authenticates login time is updated in the radpostauth.
This is documented in the sqlcounter module. Look there first. Alan DeKok.
On Fri, Oct 21, 2011 at 9:07 PM, Alan DeKok <aland@deployingradius.com>wrote:
I need to assign quota to squid users based on the weekly/hourly basis. I need users radius server to return packet reject when time is expired. is it possible in radius?
Yes. See the "counter" module, or the "sqlcounter" module.
The main issue is that they require the NAS to send accounting packets. I don't know if squid does that.
Yes it does. There are many configuration examples available on the net. Kind regards, Yves
Thanks i will check in and let you know On Sat, Oct 22, 2011 at 12:37 AM, Alan DeKok <aland@deployingradius.com> wrote:
senthil kumar wrote:
I have installed free-radius in linux machine with accounting support and was able to authenticate using radtest client.and also I was also successfully authenticate with squid proxy server.
That's good to hear.
I need to assign quota to squid users based on the weekly/hourly basis. I need users radius server to return packet reject when time is expired. is it possible in radius?
Yes. See the "counter" module, or the "sqlcounter" module.
The main issue is that they require the NAS to send accounting packets. I don't know if squid does that.
I am using only linux machine with proxy server. whether NAS is needed?
In this case, squid is the NAS. (i.e. machine sending Access-Request)
If so, can anyone help me in framing the rules for quota . eg 2 hours a day. I have basic configuration and now when a user authenticates login time is updated in the radpostauth.
This is documented in the sqlcounter module. Look there first.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hello Team The user can authenticate and browse at any time. May i know which entry i have to add to make user 'test' deny authenticate after 1 hour? When ever a user authenticates it is logged in radpostauth. In /etc/raddb/users file i have a user test "test" Cleartext-Password := "hello" my database details are as follows mysql> select * from radcheck; +----+----------+-----------------+----+-------+ | id | username | attribute | op | value | +----+----------+-----------------+----+-------+ | 45 | test | Max-All-Session | := | 540 | +----+----------+-----------------+----+-------+ INSERT into radcheck VALUES ('','test','Max-All-Session',':=','5400'); mysql> select * from radpostauth; +----+----------+------+---------------+---------------------+ | id | username | pass | reply | authdate | +----+----------+------+---------------+---------------------+ | 54 | test | test | Access-Accept | 2011-10-19 13:59:18 | | 55 | test | test | Access-Accept | 2011-10-19 13:59:34 | | 56 | test | test | Access-Accept | 2011-10-19 14:22:57 | | 57 | test | test | Access-Accept | 2011-10-21 22:32:54 | | 58 | test | test | Access-Accept | 2011-10-25 15:11:34 | +----+----------+------+---------------+---------------------+ 5 rows in set (0.00 sec) radtest test hello localhost 0 testing123 Sending Access-Request of id 67 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "hello" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=67, length=20 Please help me , thanks in advance Thanks, Senthil On Tue, Oct 25, 2011 at 3:06 PM, senthil kumar <senthilkumaar2021@gmail.com> wrote:
Thanks i will check in and let you know
On Sat, Oct 22, 2011 at 12:37 AM, Alan DeKok <aland@deployingradius.com> wrote:
senthil kumar wrote:
I have installed free-radius in linux machine with accounting support and was able to authenticate using radtest client.and also I was also successfully authenticate with squid proxy server.
That's good to hear.
I need to assign quota to squid users based on the weekly/hourly basis. I need users radius server to return packet reject when time is expired. is it possible in radius?
Yes. See the "counter" module, or the "sqlcounter" module.
The main issue is that they require the NAS to send accounting packets. I don't know if squid does that.
I am using only linux machine with proxy server. whether NAS is needed?
In this case, squid is the NAS. (i.e. machine sending Access-Request)
If so, can anyone help me in framing the rules for quota . eg 2 hours a day. I have basic configuration and now when a user authenticates login time is updated in the radpostauth.
This is documented in the sqlcounter module. Look there first.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
You have not instantiated the counters in Post-Auth . Read more about counter and how it works and how you can enable the same. Regards Suman On Sat, Oct 29, 2011 at 4:40 PM, senthil kumar <senthilkumaar2021@gmail.com>wrote:
Hello Team
The user can authenticate and browse at any time. May i know which entry i have to add to make user 'test' deny authenticate after 1 hour?
When ever a user authenticates it is logged in radpostauth.
In /etc/raddb/users file i have a user test "test" Cleartext-Password := "hello"
my database details are as follows
mysql> select * from radcheck; +----+----------+-----------------+----+-------+ | id | username | attribute | op | value | +----+----------+-----------------+----+-------+ | 45 | test | Max-All-Session | := | 540 | +----+----------+-----------------+----+-------+ INSERT into radcheck VALUES ('','test','Max-All-Session',':=','5400');
mysql> select * from radpostauth; +----+----------+------+---------------+---------------------+ | id | username | pass | reply | authdate | +----+----------+------+---------------+---------------------+ | 54 | test | test | Access-Accept | 2011-10-19 13:59:18 | | 55 | test | test | Access-Accept | 2011-10-19 13:59:34 | | 56 | test | test | Access-Accept | 2011-10-19 14:22:57 | | 57 | test | test | Access-Accept | 2011-10-21 22:32:54 | | 58 | test | test | Access-Accept | 2011-10-25 15:11:34 | +----+----------+------+---------------+---------------------+ 5 rows in set (0.00 sec)
radtest test hello localhost 0 testing123 Sending Access-Request of id 67 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "hello" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=67, length=20
Please help me , thanks in advance
Thanks, Senthil
On Tue, Oct 25, 2011 at 3:06 PM, senthil kumar <senthilkumaar2021@gmail.com> wrote:
Thanks i will check in and let you know
On Sat, Oct 22, 2011 at 12:37 AM, Alan DeKok <aland@deployingradius.com> wrote:
senthil kumar wrote:
I have installed free-radius in linux machine with accounting support and was able to authenticate using radtest client.and also I was also successfully authenticate with squid proxy server.
That's good to hear.
I need to assign quota to squid users based on the weekly/hourly basis. I need users radius server to return packet reject when time is expired. is it possible in radius?
Yes. See the "counter" module, or the "sqlcounter" module.
The main issue is that they require the NAS to send accounting packets. I don't know if squid does that.
I am using only linux machine with proxy server. whether NAS is needed?
In this case, squid is the NAS. (i.e. machine sending Access-Request)
If so, can anyone help me in framing the rules for quota . eg 2 hours a day. I have basic configuration and now when a user authenticates login time is updated in the radpostauth.
This is documented in the sqlcounter module. Look there first.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I added monthlycounter ,dailycounter, noresetcounter in post-auth i get follwing error /etc/raddb/sites-enabled/default[514]: "SQL Counter" modules aren't allowed in 'post-auth' sections -- they have no such method. /etc/raddb/sites-enabled/default[440]: Errors parsing post-auth section. When i added in authorize , radius can start and works but quota not works radtest doe hello localhost 0 testing123 Sending Access-Request of id 85 to 127.0.0.1 port 1812 User-Name = "doe" User-Password = "hello" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=85, length=26 Session-Timeout = 540 i also get following error ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[monthlycounter] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[dailycounter] returns noop Please help me. Thanks, Senthil On Sat, Oct 29, 2011 at 5:12 PM, Suman Dash <sumandash@gmail.com> wrote:
You have not instantiated the counters in Post-Auth . Read more about counter and how it works and how you can enable the same.
Regards Suman
On Sat, Oct 29, 2011 at 4:40 PM, senthil kumar <senthilkumaar2021@gmail.com> wrote:
Hello Team
The user can authenticate and browse at any time. May i know which entry i have to add to make user 'test' deny authenticate after 1 hour?
When ever a user authenticates it is logged in radpostauth.
In /etc/raddb/users file i have a user test "test" Cleartext-Password := "hello"
my database details are as follows
mysql> select * from radcheck; +----+----------+-----------------+----+-------+ | id | username | attribute | op | value | +----+----------+-----------------+----+-------+ | 45 | test | Max-All-Session | := | 540 | +----+----------+-----------------+----+-------+ INSERT into radcheck VALUES ('','test','Max-All-Session',':=','5400');
mysql> select * from radpostauth; +----+----------+------+---------------+---------------------+ | id | username | pass | reply | authdate | +----+----------+------+---------------+---------------------+ | 54 | test | test | Access-Accept | 2011-10-19 13:59:18 | | 55 | test | test | Access-Accept | 2011-10-19 13:59:34 | | 56 | test | test | Access-Accept | 2011-10-19 14:22:57 | | 57 | test | test | Access-Accept | 2011-10-21 22:32:54 | | 58 | test | test | Access-Accept | 2011-10-25 15:11:34 | +----+----------+------+---------------+---------------------+ 5 rows in set (0.00 sec)
radtest test hello localhost 0 testing123 Sending Access-Request of id 67 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "hello" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=67, length=20
Please help me , thanks in advance
Thanks, Senthil
On Tue, Oct 25, 2011 at 3:06 PM, senthil kumar <senthilkumaar2021@gmail.com> wrote:
Thanks i will check in and let you know
On Sat, Oct 22, 2011 at 12:37 AM, Alan DeKok <aland@deployingradius.com> wrote:
senthil kumar wrote:
I have installed free-radius in linux machine with accounting support and was able to authenticate using radtest client.and also I was also successfully authenticate with squid proxy server.
That's good to hear.
I need to assign quota to squid users based on the weekly/hourly basis. I need users radius server to return packet reject when time is expired. is it possible in radius?
Yes. See the "counter" module, or the "sqlcounter" module.
The main issue is that they require the NAS to send accounting packets. I don't know if squid does that.
I am using only linux machine with proxy server. whether NAS is needed?
In this case, squid is the NAS. (i.e. machine sending Access-Request)
If so, can anyone help me in framing the rules for quota . eg 2 hours a day. I have basic configuration and now when a user authenticates login time is updated in the radpostauth.
This is documented in the sqlcounter module. Look there first.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (4)
-
Alan DeKok -
senthil kumar -
Suman Dash -
YvesDM