How the hell do you use multiple NOT values with rlm_checkval and sql??
Ok, so after much frustration someone finally pointed out that using multiple values with checkval and sql is possible wen using the += OP. Great, now, how the heck do you specify NOT items? I want to specify the numbers that users can NOT dial to. This seems impossible. I have tried regexp, and using the !=, !~ OPS, none of the methods seem to work. I never knew Radius's configuration would be so frustrating... I'm ready to start pulling my hair out, someone please save my hair!
Mike Jakubik <mikej@rogers.com> wrote:
Great, now, how the heck do you specify NOT items? I want to specify the numbers that users can NOT dial to. This seems impossible.
And what do you want to do after that? Reject the request? Then configure that. In the "users" file, you can do: DEFAULT Called-Station-Id == "5551212", Auth-Type := Reject This doesn't work quite the same in SQL, because the module doesn't support multiple entries. Alan DeKok.
Alan DeKok wrote:
Mike Jakubik <mikej@rogers.com> wrote:
Great, now, how the heck do you specify NOT items? I want to specify the numbers that users can NOT dial to. This seems impossible.
And what do you want to do after that? Reject the request? Then configure that.
In the "users" file, you can do:
DEFAULT Called-Station-Id == "5551212", Auth-Type := Reject
First of all, the above can be accomplished in SQL using the checkval module and the += OP. Thats great and dandy until you need to specify numbers that users can NOT dial to. In any case that will not work for me, as i need to do this for each group defined in SQL, not DEFAULT for all users.
This doesn't work quite the same in SQL, because the module doesn't support multiple entries.
Yes it does, just not with a logical NOT. I installed FreeRadius because it touted SQL support, now im finding out the features are limited, which is disappointing.
Mike Jakubik <mikej@rogers.com> wrote:
First of all, the above can be accomplished in SQL using the checkval module and the += OP. Thats great and dandy until you need to specify numbers that users can NOT dial to. In any case that will not work for me, as i need to do this for each group defined in SQL, not DEFAULT for all users.
So add the group as an additional check item.
This doesn't work quite the same in SQL, because the module doesn't support multiple entries.
Yes it does, just not with a logical NOT.
As I said, it's not really supported.
I installed FreeRadius because it touted SQL support, now im finding out the features are limited, which is disappointing.
There are few programs with unlimited features. That being said, I still think what you want is doable in FreeRADIUS. Perhaps you could try discussing the problem, rather than SQL as a solution. Odds are there's more than one way to reach the goal. If you're fixated on SQL, you may not see another solution. Alan DeKok.
Alan DeKok wrote:
Mike Jakubik <mikej@rogers.com> wrote:
First of all, the above can be accomplished in SQL using the checkval module and the += OP. Thats great and dandy until you need to specify numbers that users can NOT dial to. In any case that will not work for me, as i need to do this for each group defined in SQL, not DEFAULT for all users.
So add the group as an additional check item.
It does not work with the != OP.
This doesn't work quite the same in SQL, because the module doesn't support multiple entries.
Yes it does, just not with a logical NOT.
As I said, it's not really supported.
I installed FreeRadius because it touted SQL support, now im finding out the features are limited, which is disappointing.
There are few programs with unlimited features.
That being said, I still think what you want is doable in FreeRADIUS. Perhaps you could try discussing the problem, rather than SQL as a solution. Odds are there's more than one way to reach the goal. If you're fixated on SQL, you may not see another solution.
If there is a way to accomplish this outside of SQL, im quite open to suggestions. As long as i can refer to the groups which are in SQL. Basically, i need to be able to restrict certain user groups from dialing certain numbers.
Mike Jakubik <mikej@rogers.com> wrote:
If there is a way to accomplish this outside of SQL, im quite open to suggestions. As long as i can refer to the groups which are in SQL. Basically, i need to be able to restrict certain user groups from dialing certain numbers.
Use rlm_passwd to map many dial-in numbers to one dial-in group. Then, do: DEFAULT SQL-Group == "foo", Dial-in-group == "bar", Auth-Type := Reject And repeat for the combinations of SQL groups & dial-in groups. Alan DeKok.
Alan DeKok wrote:
Mike Jakubik <mikej@rogers.com> wrote:
If there is a way to accomplish this outside of SQL, im quite open to suggestions. As long as i can refer to the groups which are in SQL. Basically, i need to be able to restrict certain user groups from dialing certain numbers.
Use rlm_passwd to map many dial-in numbers to one dial-in group. Then, do:
DEFAULT SQL-Group == "foo", Dial-in-group == "bar", Auth-Type := Reject
And repeat for the combinations of SQL groups & dial-in groups.
Uhm, in that case cant i just specify called-station-id in the user file? In any case, is SQL-Group a valid attribute? I cant find it in the documentation. I tried a simple : DEFAULT SQL-Group == "restricted", Called-Station-Id == "number", Auth-Type := Reject Restarted radius, and dialed "number", nothing happened, i logged in just fine.
participants (2)
-
Alan DeKok -
Mike Jakubik