Re: Change of Authorization
Alan DeKok
> Apologies if this has been addressed before, but I can't find any
> references in the Wiki or the archives for the use of rfc 3576 Change
> of Authorization messages.
The server doesn't support it, but there have been discussions around
the topic.
> Does FreeRADIUS have any built in way to trigger and/or send a CoA?
radclient can send a CoA packet. FreeRADIUS can be triggered to send
one by some policy decision, and fork a shell script that runs radclient.
> How have others dealt with users who have exceeded certain limits but
> have not yet reached session-timout?
Run a script that runs radclient to send a disconnect or CoA packet.
Alan DeKok.
--
http://deployingradius.com - The web site of the book
http://deployingradius.com/blog/ - The blog
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Peter Nixon
Content-Type: multipart/signed; boundary="nextPart10374740.yZAEjMe2am";
protocol="application/pgp-signature"; micalg=pgp-sha1
Content-Transfer-Encoding: 7bit
--nextPart10374740.yZAEjMe2am
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
On Sat 27 Jan 2007 02:08, Jeffrey Sewell wrote:
> Apologies if this has been addressed before, but I can't find any
> references in the Wiki or the archives for the use of rfc 3576 Change
> of Authorization messages.
>
> Does FreeRADIUS have any built in way to trigger and/or send a CoA?
> How have others dealt with users who have exceeded certain limits but
> have not yet reached session-timout?
Hi Jeffrey
As it would turn out I was reading RFC 3576 yesterday and added support for=
=20
CoA and Disconnect packets to pyrad (A python RADIUS library not part of th=
e=20
=46reeRADIUS project, but written by Wichert who is one of the FR developer=
s=20
also)
radiusd does not currently respond to or natively send CoA or Disconnect=20
packets however radclient DOES suport them. This means that you can quite=20
happily write an exec/perl/python module which executes radclient (or uses=
=20
the pyrad library) to send CoA or Disconnect packets.. Please read my threa=
d=20
titled "RADIUS Disconnect support" on the freeradius-devel list which=20
started on Tuesday this week for a little more dicussion of how I think thi=
s=20
could be added natively to radiusd...
If you have any further suggestions please reply to that thread..
=2D-=20
Peter Nixon
http://www.peternixon.net/
PGP Key: http://www.peternixon.net/public.asc
--nextPart10374740.yZAEjMe2am
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)
iD8DBQBFuy2yAcdsUt9pJjwRAhxaAKD/ZTUqZifluXiNVIvuBYvZ9IYE2gCfd0Dn
CXKrABm6XThd9bmOKcX2ip8=
=PYhE
-----END PGP SIGNATURE-----
--nextPart10374740.yZAEjMe2am--
--===============1179814836==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
--===============1179814836==--
Jeffrey Sewell
subscribe to the freeradius-devel list. I've not used python much (no
particular reason, just circumstance) but I'm all about using whatever
tool fits the need.
Edge device vendors have some very creative solutions for this problem
(read there "bloated and clunky" for "creative"), but it seems to me
that it makes more sense to happen at the AAA/RADIUS side of things.
Thanks again,
Jeffrey
On 1/27/07, Peter Nixon <list...@peternixon.net> wrote:
> On Sat 27 Jan 2007 02:08, Jeffrey Sewell wrote:
> > Apologies if this has been addressed before, but I can't find any
> > references in the Wiki or the archives for the use of rfc 3576 Change
> > of Authorization messages.
> >
> > Does FreeRADIUS have any built in way to trigger and/or send a CoA?
> > How have others dealt with users who have exceeded certain limits but
> > have not yet reached session-timout?
>
> Hi Jeffrey
>
> As it would turn out I was reading RFC 3576 yesterday and added support for
> CoA and Disconnect packets to pyrad (A python RADIUS library not part of the
> FreeRADIUS project, but written by Wichert who is one of the FR developers
> also)
>
> radiusd does not currently respond to or natively send CoA or Disconnect
> packets however radclient DOES suport them. This means that you can quite
> happily write an exec/perl/python module which executes radclient (or uses
> the pyrad library) to send CoA or Disconnect packets.. Please read my thread
> titled "RADIUS Disconnect support" on the freeradius-devel list which
> started on Tuesday this week for a little more dicussion of how I think this
> could be added natively to radiusd...
>
> If you have any further suggestions please reply to that thread..
>
> --
>
> Peter Nixon
> http://www.peternixon.net/
> PGP Key: http://www.peternixon.net/public.asc
>
>
