Hello!
This is my first post on this mailing list. I hope someone can give me
an advice over my problem that I am solving over a month. I even bought
a book about freeradius and after reading it twice there is not an
answer to my problem.
I run a captive portal for wireless users with radius and all data
stored in MySQL database. Majority of users type username and password
in captive portal to get access and a few others are automatically
authenticated by their MAC address (as username ) and predefined
password (macauth feature in CoovaChilli) and those never see a captive
portal, they immediately get access as they connect to the network.
Those users don't have any bandwidth limits, all other useres do have.
So far so good.
Then they wanted me to change login procedure. All users would get free
access for 30 minutes per day and they don't have to login through
captive portal. After 30 minutes, captive portal would open and user
would have to login with some coupone to connect to the internet.
I've solved this by writing these two lines in file "hints"
DEFAULT User-Name =~
"^[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9AF]{2}-[0-9A-F]{2}-[0-9A-F]{2}$"
User-Name := "freeinternetfor30minutes"
It worked very well except all users previously authenticated by MAC
address didn't get theis own profiles, but they got logged in as
"freeinternetfor30minutes" with bandwidth limitations.
OK, that was logical, I deleted those two lines and wrote some unlung
logic to the "sites-available/default"
if(notfound){ #if user not in database
update reply {
Reply-Message := "Wrong username or password"
}
# if username was MAC address, try to login as
"freeinternetfor30minutes"
if (User-Name
=~/^([0-9a-f]{2})-([0-9a-f]{2})-([0-9a-f]{2})-([0-9a-f]{2})-([0-9a-f]{2})-([0-9a-f]{2})$/i){
update reply {
Reply-Message := "Hello Guest, I'will
try to give you 30 minutes for free, if you didn't allready used it."
}
update request{
User-Name := "freeinternetfor30minutes"
}
update control {
Auth-Type := "Accept"
}
}
else {
ok = reject
}
#rewrite_user
}
That is working fine, users can connect to the network, BUT accounting
section logges their username in database as original MAC address, not
rewritted username freeinternetfor30minutes . Also no bandwidth
limitations arn't sent with Access-Accept, but I think that could be
solved easyly.
I've also tries to use module "attr_rewrite". I wrote those lines of
code to "modules/attr_rewrite"
attr_rewrite rewrite_user {
attribute = User-Name
# may be "packet", "reply", "proxy", "proxy_reply" or "config"
searchin = packet
searchfor = "%{User-Name}"
replacewith = "freeinternetfor30minutes"
ignore_case = no
new_attribute = no
max_matches = 10
append = no
}
and unhashed rewrite_user in "sites-available/default". I see that
rewriting does happen, BUT then
update control {
Auth-Type := "Accept"
}
seems to stop working even if I put rewrite_user before "update control"
AND also in accounting section User-Name is still MAC address, not
rewritten username.
I am stuck now, without any idea. Can anyone tell me, is this even
possible what I am trying to do and if so, what path should I take.
Would it be possible to create new virtual server and pass rewritten
username to that virtual server, which would try to login as
"freeinternetfor30minutes"
THANK YOU for your help!
Best Regards, Bojan
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
