Kostas Kalevras wrote:

On Wed, 24 May 2006, Mike Jakubik wrote:

...

Hello,

I am trying to setup group checks for Called-Station-Id in freeradius 1.1.1 and mysql. I have enabled the checkval module in radiusd.conf and set notfound-reject = yes. In my radgroupcheck table when i specify "restricted Called-Station-Id := number", it works fine. However i need to specify more than one number. I have tried the following format; number, number, number and "number, number, number" and "number", "number" but none of those seem to work. Could someone please tell me how this can be accomplished?

You just need to add more attribute/value pairs, one for each number you wantto allow. You can also use a regular expression if you use the =~ operator.

I have tried that, but it does not work either. I have also tried using regexp, while it seems to function, it no longer seems to use the checkval module and throws the following notice: Info: rlm_sql (sql): No matching entry in the database for request from user [user] But the checkval module shows: Auth: Invalid user (rlm_checkval: This Called-Station-Id is not allowed for the user) Whats the point of this checkval module if it can only check a single value?

On Thu, 25 May 2006, Mike Jakubik wrote:

Kostas Kalevras wrote:

...

On Wed, 24 May 2006, Mike Jakubik wrote:

...

Hello,

I am trying to setup group checks for Called-Station-Id in freeradius 1.1.1 and mysql. I have enabled the checkval module in radiusd.conf and set notfound-reject = yes. In my radgroupcheck table when i specify "restricted Called-Station-Id := number", it works fine. However i need to specify more than one number. I have tried the following format; number, number, number and "number, number, number" and "number", "number" but none of those seem to work. Could someone please tell me how this can be accomplished?

You just need to add more attribute/value pairs, one for each number you wantto allow. You can also use a regular expression if you use the =~ operator.

I have tried that, but it does not work either. I have also tried using regexp, while it seems to function, it no longer seems to use the checkval module and throws the following notice:

Info: rlm_sql (sql): No matching entry in the database for request from user [user]

But the checkval module shows:

Auth: Invalid user (rlm_checkval: This Called-Station-Id is not allowed for the user)

Whats the point of this checkval module if it can only check a single value?

As i said before you should just add more attribute/value pairs. It works. What does your radgroupcheck table look like when you add more than one number?

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

-- Kostas Kalevras Network Operations Center kkalev@noc.ntua.gr National Technical University of Athens, Greece Work Phone: +30 210 7721861 'Go back to the shadow' Gandalf

Kostas Kalevras wrote:

As i said before you should just add more attribute/value pairs. It works. What does your radgroupcheck table look like when you add more than one number?

Could someone please help me with this? I am stumped, is there a bug in the rlm_checkval module? --- Well, it does not in my case. Here is the table: +----+------------+-------------------+----+------------+ | id | GroupName | Attribute | op | Value | +----+------------+-------------------+----+------------+ | 11 | restricted | Called-Station-Id | := | 4166231473 | | 16 | restricted | Called-Station-Id | := | 4166231474 | | 17 | restricted | Called-Station-Id | := | 4166231475 | | 18 | restricted | Called-Station-Id | := | 4168489499 | I dial in to 4168489499 and this is what happens: Fri May 26 10:26:12 2006 : Auth: Invalid user (rlm_checkval: This Called-Station-Id is not allowed for the user): [mikej/xxx] (from client xxx port 1487 cli xxx)

Alan DeKok wrote:

Mike Jakubik <mikej@rogers.com> wrote:

...

Well, it does not in my case. Here is the table:

+----+------------+-------------------+----+------------+ | id | GroupName | Attribute | op | Value | +----+------------+-------------------+----+------------+ | 11 | restricted | Called-Station-Id | := | 4166231473 | | 16 | restricted | Called-Station-Id | := | 4166231474 |

What you're trying to do is to "OR" the different entries. The SQL module doesn't do that, unfortunately.

You'll have to have one entry & a regular expression for it to work.

Thanks for clarifying that shortcoming. I guess i should just disable the checkval module then and just use regexp.

Kostas Kalevras wrote:

...

Well, it does not in my case. Here is the table:

+----+------------+-------------------+----+------------+ | id | GroupName | Attribute | op | Value | +----+------------+-------------------+----+------------+ | 11 | restricted | Called-Station-Id | := | 4166231473 | | 16 | restricted | Called-Station-Id | := | 4166231474 | | 17 | restricted | Called-Station-Id | := | 4166231475 | | 18 | restricted | Called-Station-Id | := | 4168489499 |

I dial in to 4168489499 and this is what happens:

Fri May 26 10:26:12 2006 : Auth: Invalid user (rlm_checkval: This Called-Station-Id is not allowed for the user): [mikej/xxx] (from client xxx port 1487 cli xxx)

You r using the := operator. That way u ll be overwriting the Called-Station-Id value. Use the += operator instead.

Ahh, finally!!! Thanks for that, this seems to do it. Do you by any chance know if there is a way to do a logical NOT on the numbers? I.e. I want to specify that the users can not call a list of specified numbers.