Re: (PM) Radius question

Dave Burgess (burgess@cynjut.neonramp.com)
Sun, 31 May 1998 14:35:23 -0500 (CDT)

>
> > Can you specify in the user file for a person a certain
> > amount of time that user is allowed?
> >
> > I have a client that would like to purchase access based on
> > an amount of time as apposed to a
> > month to month contract. Is there a way to setup something
> > like below
> >
> > User wants to purchase 50 hours. When 50 hours are used
> > (However many months that might take) they would be expired
> > or not able to log in.
> >

I would handle this a little differently.

I've modified the standard Portmaster RADIUSd to honor the 'expire' date
in the password file for BSD style systems. What I would do is keep an
'hourly' count (run a cron job, maybe once an hour) and when they've
used a total of 'n' hours, change their 'expire' date in the password
file to '60' (or some other reasonably small number, like the number of
hours they buy). This way, you never actually modify the RADIUS
databases, you are using a feature of BSD the way it was intended to be
used, and you can update it using a standard BSD utility.

The patchfile for my changes to 2.0.whatever are on
ftp://cynjut.neonramp.com/. They may have even been included in a more
recent version of Livingston's RADIUSd source, so you might want to look
at your Release Notes carefully to see if your version honors the
pw->expire field in the password database.

Writing the 'scanner' should be fairly trivial. If you run it once an
hour, you can start at the point you stopped (in time) and just add up
his user time. Once he's exceeded the magic number, you cut him off by
giving his expire a value. As soon as his current session is over, he's
unable to log back on. If you want to be truly anal about it, you can
even kick him off every half hour just to keep him from exceeding his
purchased time by more than 30 minutes.

-- 
Dave Burgess                   Network Engineer - Nebraska On-Ramp, Inc.
*bsd FAQ Maintainer / SysAdmin for the NetBSD system in my spare bedroom
"Just because something is stupid doesn't mean there isn't someone that 
doesn't want to do it...."
-
To unsubscribe, email 'majordomo@livingston.com' with
'unsubscribe portmaster-users' in the body of the message.
Searchable list archive: <URL:http://www.livingston.com/Tech/archive/>