I do not want to define an expiration date after the first login. I want to configure the account to only authenticate successfully at a specified date that is greater than or equal to the value provided in the radcheck table. This way I can pre-populate usernames into the radcheck table and the user(s) will not be able to authenticate successfully until after the specified date and before the expiration date. I'm trying to setup a Cisco Lab scheduling app that will allow people to reserve timeslots on a specific date and between two specific times. i.e; 4:00 to 8:00. If there is an attribute that matches the current date; "Date == Jun 15 2011" than I can use login time and that would work perfect as well.

I do not want to define an expiration date after the first login. I want to configure the account to only authenticate successfully at a specified date that is greater than or equal to the value provided in the radcheck table. This way I can pre-populate usernames into the radcheck table and the user(s) will not be able to authenticate successfully until after the specified date and before the expiration date. I'm trying to setup a Cisco Lab scheduling app that will allow people to reserve timeslots on a specific date and between two specific times. i.e; 4:00 to 8:00. If there is an attribute that matches the current date; "Date == Jun 15 2011" than I can use login time and that would work perfect as well. From: freeradius-users-bounces+mgeorge=geores.net@lists.freeradius.org [mailto:freeradius-users-bounces+mgeorge=geores.net@lists.freeradius.org] On Behalf Of Suman Dash Sent: Friday, June 17, 2011 1:32 AM To: FreeRadius users mailing list Subject: Re: Opposite of Expiraton attribute? Or Else ! Expiration = First-Login + N (Days , Hours , Minutes ). This can be done by any script or Web Frontend. It will allow you to define an Expiration of N from the date of first login. Regards On 6/17/2011 10:53 AM, Matthew George wrote: Is there an attribute that is the opposite of expiration? I'm trying to setup accounts to have a specific login time range. For example; Start-Time >= 5 June 2011 00:00:00 Expiration == 5 June 2011 02:00:00 I've been hunting googling for hours but I've been unable to find an attribute that would let me specific a "start-time" or a "valid-after" attribute. Any suggestions? __________ Information from ESET NOD32 Antivirus, version of virus signature database 6042 (20110414) __________ The message was checked by ESET NOD32 Antivirus. http://www.eset.com - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________ Information from ESET NOD32 Antivirus, version of virus signature database 6042 (20110414) __________ The message was checked by ESET NOD32 Antivirus. http://www.eset.com

http://wiki.freeradius.org/Rlm_logintime Regards, Ryan Williams Network Engineer -----Original Message----- From: freeradius-users-bounces+ryan=integritynet.com.au@lists.freeradius.org [mailto:freeradius-users-bounces+ryan=integritynet.com.au@lists.freeradius.o rg] On Behalf Of George Chelidze Sent: Friday, 17 June 2011 4:02 PM To: freeradius-users@lists.freeradius.org Subject: **Filtered as SPAM** Re: Opposite of Expiraton attribute? On 06/17/2011 09:23 AM, Matthew George wrote:

Is there an attribute that is the opposite of expiration?

I'm trying to setup accounts to have a specific login time range.

For example; Start-Time >= 5 June 2011 00:00:00 Expiration == 5 June 2011 02:00:00

I've been hunting googling for hours but I've been unable to find an attribute that would let me specific a "start-time" or a "valid-after" attribute.

Any suggestions?

check modules/logintime BR, George Chelidze - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

On 06/17/2011 11:50 PM, Matthew George wrote:

Using logintime I cannot specify a date and time, its uucp.

I need to be able to specify a date and time. I'm curious as to why the "Date" attribute does not exist.

None the less, I still need to get this working even if it involves me having to pay someone.

I can think of a few ways of doing this; you probably don't need to pay someone. At the end of the day, it's just an attribute comparison. All you need to do is make sure the attributes are populated. Can you be a bit more specific about where you want to read the validity range from, and how you want to do the comparisons? Are they stored in SQL or LDAP for example? What format are they stored in? Here's an example of how you could implement it yourself, using unix timestamps read from a file, and integer comparisons: raddb/dictionary: ATTRIBUTE Account-Starttime 3000 integer ATTRIBUTE Account-Endtime 3001 integer ATTRIBUTE Current-Time 3002 integer raddb/policy.conf: policy { check_validity { update control { Current-Time := "%l" } if (Account-Starttime > control:Current-Time) { update reply { Reply-Message := "account not yet active" } reject } if (Account-Endtime < control:Current-Time) { update reply { Reply-Message := "account no longer active" } reject } } } raddb/modules/start_end_time: passwd start_end_time { # Entries in this file are of the format: # # username:epochstart:epochend # # date -d "$THEDATE" +%s can be used to convert strings # to epoch at the unix shell filename = ${raddbdir}/start_end format = "*User-Name:~Account-Starttime:~Account-Endtime" } raddb/sites-enabled/xxx: authorize { .... # read the validity from file start_end_time # check it check_validity ... } But there are probably very many ways of doing this. If you can be more specific, I or others can make more suggestions, but better would be to break the problem down into parts, then look at the tools FreeRADIUS gives you (namely - lots of ways to populate attributes from data sources, and lots of ways to compare them) and factor a solution.

On 06/18/2011 07:30 PM, Matthew George wrote:

Thanks you so much for your assistance p.mayers

In a nutshell, probably the easiest way to do what I'm trying to do is maybe to use an attribute called "Current-Time-Date"

Ok, so you can do this: raddb/dictionary: ATTRIBUTE Current-Time-Date 3001 string raddb/sites-enabled/xx: authorize { ... update request { Current-Time-Date := "%S" } sql ... } %S expands to an "SQL time"; e.g. a few minutes ago: 2011-06-20 10:48:49 ...so in radcheck you can put: Current-Time-Date >= 2011-07-01 00:00:00 ...and that will let them log in from midnight on July 1st. This works because (as I'm sure you realise) a string comparison is the same as a date comparison as long as the date gets more specific as you go right->left and is padded and formatted appropriately.

Works perfectly!!! Thank you so much Phil. ------------------------------- raddb/dictionary: ATTRIBUTE Current-Date 3000 string raddb/sites-enabled/xx: authorize { ... update request { Current-Time-Date := " %m-%d-%Y" } sql ... } MySQL radcheck table +----+----------+--------------+----+------------+ | id | username | attribute | op | value | +----+----------+--------------+----+------------+ | 5 | test | Current-Date | = | 06-21-2011 | +----+----------+--------------+----+------------+ Works like a charm. If you use the == operator it will not work, has to be =, >= or <=. -----Original Message----- From: freeradius-users-bounces+mgeorge=geores.net@lists.freeradius.org [mailto:freeradius-users-bounces+mgeorge=geores.net@lists.freeradius.org] On Behalf Of Phil Mayers Sent: Monday, June 20, 2011 6:01 AM To: freeradius-users@lists.freeradius.org Subject: Re: Opposite of Expiraton attribute? On 06/20/2011 10:53 AM, Phil Mayers wrote:

%S expands to an "SQL time"; e.g. a few minutes ago:

2011-06-20 10:48:49

...so in radcheck you can put:

Current-Time-Date >= 2011-07-01 00:00:00

FYI, there is also: %D ...which expands to: 20110701 ...so you can use this to populate a Current-Date attribute, do day comparisons without time, and optionally use the build-in Current-Time to compare times within the day. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html