Decisionmaking in FreeRADIUS & Check/Reply Items
Hello list, I am trying to use the 'files' module of Freeradius to do decisionmaking, based on information pulled in from the sql module, and the sqlcounter thing. First off, is this the right way of doing this? I want to assign users a different Pool-Name for each assigned speed, and send Max-Download-Speed and Max-Upload-Speed vendor-specific variables to the client on each request. My actual problem relates to the following errors, pulled from radiusd -X: ............ Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" [/etc/raddb/users]:214 WARNING! Check item "Pool-Name" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:214 WARNING! Check item "Max-Download-Rate" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:214 WARNING! Check item "Max-Upload-Rate" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:220 WARNING! Check item "Pool-Name" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:220 WARNING! Check item "Max-Download-Rate" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:220 WARNING! Check item "Max-Upload-Rate" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:226 WARNING! Check item "Pool-Name" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:226 WARNING! Check item "Max-Download-Rate" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:226 WARNING! Check item "Max-Upload-Rate" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:232 WARNING! Check item "Pool-Name" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:232 WARNING! Check item "Max-Download-Rate" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:232 WARNING! Check item "Max-Upload-Rate" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items Module: Instantiated files (files) radiusd.conf: "files" modules aren't allowed in 'post-auth' sections -- they have no such method. radiusd.conf[327] Failed to parse post-auth section. root@betabitch [/etc/raddb]# The offending rules are in users: DEFAULT User-Bytes-Used < 21474836480 , Group == "512k" # user gets high speed service if under 20gb Pool-Name := "512k_high", Max-Download-Rate := 524288, Max-Upload-Rate := 262144 DEFAULT User-Bytes-Used > 21474836480 , Group == "512k" # user gets low speed service if under 20gb Pool-Name := "512k_low", Max-Download-Rate := 262144, Max-Upload-Rate := 131072 DEFAULT User-Bytes-Used < 53687091200 , Group == "10m" # user gets high speed service if under 50gb Pool-Name := "10m_high", Max-Download-Rate := 10485760, Max-Upload-Rate := 10485760 DEFAULT User-Bytes-Used > 53687091200 , Group == "10m" # user gets low speed service if over 50gb Pool-Name := "10m_low", Max-Download-Rate := 1048576, Max-Upload-Rate := 1048576 But... but... the bottom 3 attributes *aren't* check attributes! I want to *set* them! Or am I getting entirely the wrong end of the stick here? Can somebody point out how these rules are meant to be arranged, and perhaps how I could do this in sql? It's all quite confusing. ##### radiusd.conf - important bits ###### sqlcounter monthlybytecounter { counter-name = User-Bytes-Used check-name = Max-User-Bytes sqlmod-inst = sql key = User-Name reset = monthly # this query is awesome in every way. # it selects the traffic used by the user since they last paid for their subscription # and adds up the input and output bytes together to get a composite usage figure. query = "SELECT SUM(AcctInputOcte.......................... } instantiate { monthlybytecounter } authorize { preprocess sql } authenticate { pap } preacct { preprocess # acct_unique } accounting { #acct_unique #detail radutmp # ? 512k_high 512k_low 10m_high 10m_low sql } session { #radutmp # ? sql } post-auth { sql files 512k_high 512k_low 10m_high 10m_low } Thank you everyone :) Jan
My actual problem relates to the following errors, pulled from radiusd -X:
[/etc/raddb/users]:214 WARNING! Check item "Pool-Name" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items The offending rules are in users:
As you can read in the logs, Pool-Name is a check Item and must go to the first line of your users file.
DEFAULT User-Bytes-Used < 21474836480 , Group == "512k" # user gets high speed service if under 20gb Pool-Name := "512k_high", Max-Download-Rate := 524288, Max-Upload-Rate := 262144
But... but... the bottom 3 attributes *aren't* check attributes!
Pool-Name IS a check Item even and Check Item can be set in your users' rules. Try: DEFAULT User-Bytes-Used < 21474836480 , Group == "512k", Pool-Name := "512k_high" Max-Download-Rate := 524288, Max-Upload-Rate := 262144 HTH, Thibault
On 10/11/06, Jan Mulders <lastchancehotel@gmail.com> wrote:
Hello list,
I am trying to use the 'files' module of Freeradius to do decisionmaking, based on information pulled in from the sql module, and the sqlcounter thing.
I'm not really knowing much about that. But a quick glance over the provided bits leads to a few internal "huh?"s You don't seem to actually use "files" anywhere. Where do you use "monthlybytecounter"? And those references to the (allegedly) "Pool-Name"s in post-auth{} and accounting {} look strange too. Putting that aside for the moment, (as it doesn't even get that far).
First off, is this the right way of doing this? I want to assign users a different Pool-Name for each assigned speed, and send Max-Download-Speed and Max-Upload-Speed vendor-specific variables to the client on each request.
My actual problem relates to the following errors, pulled from radiusd -X:
But... but... the bottom 3 attributes *aren't* check attributes! I want to *set* them! Or am I getting entirely the wrong end of the stick here?
hm, well, they _are_! You might not want them to be so, but... 1. Pool-Name is in freeradius.internal dictionary, so you shouldn't mess with that. 2. The other ones produce the same message from lines 195ff in rlm_files.c. I don't find them in the provided dictionaries. Where\how do you define them? Obviously they are encoded to a range reserved for non-reply items and the exception for VSA doesn't kick in. finally:
radiusd.conf: "files" modules aren't allowed in 'post-auth' sections -- they have no such method. radiusd.conf[327] Failed to parse post-auth section. is quite clear.
Can somebody point out how these rules are meant to be arranged, and perhaps how I could do this in sql? It's all quite confusing.
Uh, as much as I could infer, you should get rid of this Pool-Name. Afaik it is unneeded for the purpose of sending back reply attributes in general as it has to do with ippools. Provide a sane dictionary for the other two attributes. Please check man 5 users, the comments in radius.conf at the top of sqlcounter stanza. Roughly put, you should append "monthlybytecounter" and "files" to authenticate {}, get rid of "files" "512*" etc and probably "sql" in post-auth{} and minus "sql" in accounting{}. Make small changes and check how they work by looking at debug output. Then you could contemplate putting the logic in users file to sql tables. regards K. Hoercher
participants (3)
-
Jan Mulders -
K. Hoercher -
Thibault Le Meur