|
||||||||||
There is indeed a function in Radius How RADIUS-Initiated Disconnect Works For the disconnect feature, the router is the disconnect server and the RADIUS server is the disconnect client. Disconnect Messages To centrally control the disconnection of remote access users, RADIUS clients must be able to receive and process unsolicited disconnect requests from RADIUS servers. The RADIUS disconnect feature uses the existing format of RADIUS disconnect request and response messages. The code field used in disconnect messages has three codes: Disconnect-Request (40) Disconnect-ACK (41) Disconnect-NAK (42) Message Exchange The RADIUS server (the disconnect client) and the RADIUS client(the disconnect server) exchange messages using UDP. The Disconnect-Request sent from the disconnect client is a RADIUS-formatted packet with the Disconnect-Request and one or more attributes. The disconnect response is either a Disconnect-ACK or a Disconnect-NAK: If AAA is successful in disconnecting the user, the response is a RADIUS formatted packet with a Disconnect-ACK. If AAA is unsuccessful in disconnecting the user, the request is malformed, or the request is missing attributes, the response is a RADIUS-formatted packet with a Disconnect-NAK. Qualifications for Disconnect To disconnect a user, the Disconnect-Request must contain an attribute with a session ID. The Disconnect-Request can contain an Acct-Session-Id (44) attribute and/or a Multi-Session-Id (50) attribute for the session ID. If both the Acct-Session-Id and Multi-Session-Id attributes are present in the request, the router uses both attributes. If the User-Name (1) attribute is also present in the request, the username and session ID are used to perform the disconnection. AAA services handle the actual request. Security/Authentication The RADIUS server (the disconnect client) must calculate the Authenticator as specified for an Account-Request in RFC 2866. The RADIUS client verifies the request using Authenticator calculation as specified for an Accounting-Request in RFC 2866. A secret, as specified in RFC 2865, must be configured and used in the calculation of the Authenticator. The disconnect response Authenticator is calculated as specified for an Account-Response in RFC 2866. -----Oorspronkelijk bericht----- Van: Manuel Kasper [mailto:mk at neon1 dot net] Verzonden: donderdag 9 juni 2005 18:32 Aan: Jonathan De Graeve CC: m0n0wall at lists dot m0n0 dot ch Onderwerp: Re: [m0n0wall] RE: Captive Portal/Radius Prepaid On 09.06.05 18:25 +0200, Jonathan De Graeve wrote: > I have the same problem here. I know theres a Radius logout feature > (some sort of disconnect) wich tells the nas to disconnect a > certain user. Is there? That wouldn't work for m0n0wall anyway as there's no program running that listens to RADIUS packets all the time. > I will be implementing this feature in M0n0wall as soon I have time > (our if somebody could help me doing it) I've already done that (optional feature where the captive portal reauthenticates all connected users once every minute and disconnects those for whom the RADIUS server returns an Access-Reject). Accounting can also be handled with RADIUS interim updates (code 3) if desired. This was paid work for a Swiss company; I think they agree to this code being released in public versions, but I'll have to ask again to make sure. - Manuel --------------------------------------------------------------------- To unsubscribe, e-mail: m0n0wall dash unsubscribe at lists dot m0n0 dot ch For additional commands, e-mail: m0n0wall dash help at lists dot m0n0 dot ch |