Re: very long regular expression...

23 Nov 2006

      Norbert Grochal wrote:
...
...
...
I want to disallow login to access points for every hosts that are not
in my network.
So at the end of /usr/local/etc/raddb/users file I put regular
expression that checks if Calling-Station-Id IS NOT in list of my
hosts...
DEFAULT Auth-Type := REJECT, Calling-Station-Id !~
"008012323244|002938475473|<and many other macs...>"
  Don't do that.  It's ugly.  Use rlm_passwd.  See "man rlm_passwd".
That lets you list all of the MACs in one flat text file, which is a
LOT easier to manage by a script than the "users" file.
I still haven't idea how to do it, may you show me any example?
The man page is pretty clear

Do something like:

modules {
   passwd mac2ok {
     filename = /etc/raddb/mac2ok
     format = "*Calling-Station-Id:~My-Local-String"
     hashsize = 100
   }

   # other modules
}

authorize {
   preprocess
   mac2ok
   files
   # other modules
}

Make "/etc/raddb/mac2ok" read:

008012323244:ok
002938475473:ok

...then in "users" put:

DEFAULT	My-Local-String != "ok", Auth-Type := Reject
	Reply-Message = "calling station id not allowed",
	Fall-Through = No

# Other config items

Depending on the version of the server, you might need the following in 
/etc/raddb/dictionary:

ATTRIBUTE	My-Local-String		3000	string

...where 3000 can be any number between 3000 and 4000 and 
My-Local-String is an arbitrary name you can use for a local config 
attribute.
...
Is it possible to 'mark' good request and then at the end of users file
write
DEFAULT Auth-Type := REJECT, REQUEST_NOT_MARKED
??
Norboro
- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: very long regular expression...

Phil Mayers