Skip to content

Commit 7d0e51a

Browse files
noladealandekok
nolade
authored and
alandekok
committed
docs-v4: Update/rewrite content for v4 prepaid tutorial (replaces PR 5472)
1 parent b461cea commit 7d0e51a

File tree

1 file changed

+177
-29
lines changed

1 file changed

+177
-29
lines changed

‎doc/antora/modules/tutorials/pages/prepaid.adoc‎

Lines changed: 177 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,46 +1,194 @@
1-
= A simple pre-paid example
2-
3-
include::ROOT:partial$v3_warning.adoc[]
4-
1+
= Prepaid
52

63
*Goal:* To implement a simple "prepaid" functionality in the server.
74

85
*Time:* 15-25 minutes
96

107
*Files:*
118

12-
- `mods-available/counter`
9+
- `mods-enabled/sqlcounter`
10+
- `sites-enabled/default`
11+
- `mods-config/files/authorize`
12+
1313
1414
Many system administrators wish to implement "prepaid" billing for
1515
their systems. In this exercise, we will configure the server to use a
1616
simple "prepaid" scheme, wherein all users will be permitted to log in
17-
for only one hour a day.
18-
19-
Read `mods-available/counter` and look for the `counter daily` instance
20-
The documentation for the module consists solely of the comments in
21-
`mods-available/counter`, so those comments should be read carefully.
22-
Search the rest of the configuration file for references to the `daily` module
23-
and un-comment any references you find.
24-
25-
Add an entry that sets the `Max-Daily-Session`
26-
to have the value 3600 to the top of the file. Start the server, and test it with the `bob.sh`
27-
script. Note that unlike previous responses from the server, this one
28-
contains a `Session-Timeout` attribute with value 3600.
29-
30-
Wait five to ten seconds, and then use the `bob-acct-stop.sh` script to
31-
tell the server that user "bob" has logged off. Observe that the `counter`
32-
module is called and that this module updates the user's login time. Now send the
33-
server another login request (`bob.sh`), and observe that the
34-
"Session-Timeout" attribute has a value less than 3600. The value
35-
should be near 3600. This value depends on the length of time passed
36-
between when the server is started and when the `bob-acct-stop.sh` script is run.
17+
for only one hour a day using the `sqlcounter` module.
18+
19+
== SQLCounter Module Configuration
20+
21+
Create a symbolic link from `mods-available/` to `mods-enabled/`:
22+
23+
[source,text]
24+
----
25+
$ cd mods-enabled
26+
$ ln -s ../mods-available/sqlcounter sqlcounter
27+
----
28+
29+
Verify the symbolic link was created:
30+
31+
[source,text]
32+
----
33+
$ cat mods-enabled/sqlcounter
34+
----
35+
36+
The `mods-enabled/sqlcounter` should contain a `daily counter` instance similar to the following:
37+
38+
[source,unlang]
39+
----
40+
sqlcounter dailycounter {
41+
sql_module_instance = sql
42+
dialect = ${modules.sql.dialect}
43+
44+
# reset_period_start_name = control.${.:instance}-Reset-Start
45+
# reset_period_end_name = control.${.:instance}-Reset-End
46+
counter_name = control.Daily-Session-Time
47+
check_name = control.Max-Daily-Session
48+
reply_name = reply.Session-Timeout
49+
auto_extend = yes
50+
key="%{Stripped-User-Name || User-Name}"
51+
reply_message_name = Reply-Message
52+
53+
reset = daily
54+
55+
$INCLUDE ${modconfdir}/sql/counter/${dialect}/${.:instance}.conf
56+
}
57+
----
58+
59+
See xref:reference:raddb/mods-available/sqlcounter.adoc[sqlcounter]
60+
for detail on what each configuration item means.
61+
62+
63+
=== 1. Add the user to the SQL database
64+
65+
[source,sql]
66+
----
67+
INSERT INTO radcheck (username, attribute, op, value)
68+
VALUES ('alice', 'Cleartext-Password', ':=', 'testing123');
69+
----
70+
71+
=== 2. Set User Limits
72+
73+
Edit `mods-config/files/authorize` and add following entry to the file :
74+
75+
[source,text]
76+
----
77+
DEFAULT control.Max-Daily-Session := 3600
78+
----
79+
80+
=== 3. Enable SQLCounter dailycounter
81+
82+
Edit `etc/sites-enabled/default` and add the `dailycounter` module to the `recv Access-Request` section:
83+
84+
[source,unlang]
85+
----
86+
recv Access-Request {
87+
...
88+
dailycounter # Add this line
89+
pap
90+
}
91+
----
92+
93+
=== 4. Enable dailycounter in the Accounting Start Section
94+
95+
Verify accounting start is enabled in `etc/sites-enabled/default`:
96+
97+
[source,unlang]
98+
----
99+
accounting Start {
100+
...
101+
-sql
102+
dailycounter # Add this line
103+
}
104+
----
105+
106+
=== 5. Enable dailycounter in the Accounting Stop Section
107+
108+
Verify accounting stop is enabled in `etc/sites-enabled/default`:
109+
110+
[source,unlang]
111+
----
112+
accounting Stop {
113+
....
114+
-sql
115+
dailycounter # Add this line
116+
}
117+
----
118+
119+
== Testing
120+
121+
Start FreeRADIUS in debug mode:
122+
123+
[source,bash]
124+
----
125+
$ radiusd -X
126+
----
127+
128+
=== Send Authentication Request
129+
130+
From another terminal, test user authentication:
131+
132+
[source,bash]
133+
----
134+
echo 'User-Name = "alice", CHAP-Password = "hello", NAS-IP-Address = 127.0.0.1, NAS-Port = 501, NAS-Port-Type = Virtual' | radclient -x 127.0.0.1 auth testing123
135+
----
136+
137+
* Expected Output:
138+
139+
[source,bash]
140+
----
141+
Received Access-Accept Id 48 from 127.0.0.1:1812 to 0.0.0.0:53031 via lo length 99
142+
Message-Authenticator = 0xc8b4a4caa88f7b70217c9ae1d6c91c98
143+
Reply-Message = "Hello! You authenticated via the SQL database."
144+
Session-Timeout = 3600
145+
User-Name = "alice"
146+
----
147+
148+
Note the `Session-Timeout = 3600` attribute in the response.
149+
150+
=== Start a simulated session
151+
152+
[source,bash]
153+
----
154+
echo 'User-Name = "alice", Acct-Status-Type = Start, Acct-Session-Id = "01020304", NAS-IP-Address = 127.0.0.1, NAS-Port = 501, NAS-Port-Type = Virtual, Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 192.168.100.55' | radclient -x 127.0.0.1:1813 acct testing123
155+
----
156+
157+
=== Send Accounting Stop
158+
159+
Wait a minute or so, and then send an Accounting-Stop to end the session:
160+
161+
[source,bash]
162+
----
163+
echo "User-Name = alice, Acct-Session-Id = 'test-session-1', NAS-IP-Address = 127.0.0.1, NAS-Port = 501, Acct-Status-Type = Stop, Acct-Session-Time = 10" | radclient -x 127.0.0.1:1813 acct testing123
164+
----
165+
166+
=== Test Reduced Session Timeout
167+
168+
Authenticate the user again:
169+
170+
[source,bash]
171+
----
172+
echo 'User-Name = "alice", CHAP-Password = "hello", NAS-IP-Address = 127.0.0.1, NAS-Port = 501, NAS-Port-Type = Virtual' | radclient -x 127.0.0.1 auth testing123
173+
----
174+
175+
* Expected Output:
176+
177+
[source,text]
178+
----
179+
Received Access-Accept Id 167 from 127.0.0.1:1812 to 0.0.0.0:57205 via lo length 99
180+
Message-Authenticator = 0x0e96f55860e0af123286fcb9ccdfd6db
181+
Reply-Message = "Hello! You authenticated via the SQL database."
182+
Session-Timeout = 3590
183+
User-Name = "alice"
184+
----
185+
186+
The Session-Timeout should now be approximately 3590 seconds (3600 - 10 used).
37187

38188
== Questions
39189

40190
1. How would you configure the server to obtain the daily access limits
41-
from an SQL database?
42-
2. Why is it useful to enforce time-based restrictions on users, in
43-
addition to enforcing `Simultaneous-Use`?
191+
from an SQL database?
44192

45-
// Copyright (C) 2021 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
193+
// Copyright (C) 2026 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
46194
// This documentation was developed by Network RADIUS SAS.

0 commit comments

Comments
 (0)