hi , any one can tell me , how to logout user??? i use freeradius to my radius server ,i`m testing 802.1x and user login success with username & pw from wireless ap but after user reboot laptop , then the laptop will login again automatic , so , i hope someone to tell me how to logout user after login
This has nothing to do the the radius server. The AP logs out the user, not the radius server. Alex On 09/08/07, wow lala <lala.tw@gmail.com> wrote:
hi , any one can tell me , how to logout user??? i use freeradius to my radius server ,i`m testing 802.1x and user login success with username & pw from wireless ap but after user reboot laptop , then the laptop will login again automatic , so , i hope someone to tell me how to logout user after login
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Alex French wrote:
This has nothing to do the the radius server. The AP logs out the user, not the radius server.
Alex
Not entirely true. See http://wiki.freeradius.org/Disconnect_Messages. Though technically yes, the server doesn't log out the user. Logging out can sometimes be done using the RADIUS protocol depending on the NAS's support for it.
On 09/08/07, wow lala <lala.tw@gmail.com> wrote:
hi , any one can tell me , how to logout user??? i use freeradius to my radius server ,i`m testing 802.1x and user login success with username & pw from wireless ap but after user reboot laptop , then the laptop will login again automatic , so , i hope someone to tell me how to logout user after login
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 19/08/07, Arran Cudbard-Bell <A.Cudbard-Bell@sussex.ac.uk> wrote:
Alex French wrote:
This has nothing to do the the radius server. The AP logs out the user, not the radius server.
Not entirely true.
Yes it is.
Which says "FreeRADIUS server (radiusd) does not currently have internal Disconnect-Request support." Thanks, Alex
Alex French wrote:
Which says "FreeRADIUS server (radiusd) does not currently have internal Disconnect-Request support."
The "radclient" program has Disconnect-Request support. You can run radclient from radiusd. I expect that within 6 months, the server core will have CoA and disconnect request support. Alan DeKok.
Alex French wrote:
On 19/08/07, Arran Cudbard-Bell <A.Cudbard-Bell@sussex.ac.uk> wrote:
Alex French wrote:
This has nothing to do the the radius server. The AP logs out the user, not the radius server.
Not entirely true.
Yes it is.
No it's not. In terms of the RFCs the RADIUS server can have a lot to do with disassociating someone from an access point. To quote the introductory paragraph of RFC 3576 "The RADIUS protocol, defined in [RFC2865], does not support unsolicited messages sent from the RADIUS server to the Network Access Server (NAS). However, there are many instances in which it is desirable for changes to be made to session characteristics... ... several vendors have implemented additional RADIUS commands in order to be able to support unsolicited messages sent from the RADIUS server to the NAS. These extended commands provide support for Disconnect and Change-of-Authorization (CoA) messages."
Which says "FreeRADIUS server (radiusd) does not currently have internal Disconnect-Request support."
Correct the FreeRADIUS server does not support this internally. However radclient, which ships with the FreeRADIUS source, does support sending POD and CoA packets. It is also possible for FreeRADIUS to execute radclient arbitrarily , using it to send a POD to a target NAS.
Thanks,
Alex - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
--- Arran
On 19/08/07, Arran Cudbard-Bell <A.Cudbard-Bell@sussex.ac.uk> wrote:
No it's not.
In terms of the RFCs the RADIUS server can have a lot to do with disassociating someone from an access point.
It can, but it doesn't. Not freeradius. Look, we can go back and forth on this, but the poor guy wants to know how to log people off his APs. The short answer is, 1) The Freeradius server will not do this for you 2) It is unlikely that your AP will allow you to do this through radius *at all*. The majority of access points allow you to log people off only using proprietary methods, or maybe through SNMP if you're lucky. So this list is not going to provide the answer, unfortunately. Alex
Alex French wrote:
It can, but it doesn't. Not freeradius.
FreeRADIUS can run radclient. At that point, it's irrelevant whether or not the code is "internal" to FreeRADIUS. You can make disconnect messages part of your FreeRADIUS policy: that's the only important thing.
Look, we can go back and forth on this, but the poor guy wants to know how to log people off his APs. The short answer is,
You don't. Most cheap AP's have near-zero functionality.
1) The Freeradius server will not do this for you
You have to write maybe 10 lines of configuration to get this done.
2) It is unlikely that your AP will allow you to do this through radius *at all*. The majority of access points allow you to log people off only using proprietary methods, or maybe through SNMP if you're lucky. So this list is not going to provide the answer, unfortunately.
The more expensive AP's will often let you do this. Alan DeKok.
participants (4)
-
Alan DeKok -
Alex French -
Arran Cudbard-Bell -
wow lala