Provided by: freeradius_1.1.0-1ubuntu2_i386 bug


       rlm_attr_filter - FreeRADIUS Module


       The  rlm_attr_filter module exists for filtering certain attributes and
       values in received ( or transmitted ) radius packets from  (  or  to  )
       remote proxy servers.  It gives the proxier ( us ) a flexible framework
       to filter the attributes we  send  to  or  receive  from  these  remote
       proxies.   This  makes  sense,  for  example,  in an out-sourced dialup
       situation to various policy decisions, such as restricting a client  to
       certain ranges of Idle-Timeout or Session-Timeout.

       Filter  rules  are  defined and applied on a per-realm basis, where the
       realm  is  anything  that  is  defined  and  matched   based   on   the
       configuration of the rlm_realm module.

       The  file  that defines the attribute filtering rules follows a similar
       syntax to the users file.  There are a few differences however:

           There are no check-items allowed other than the realm.

           There can only be a single DEFAULT entry.

       The rules for each entry are parsed to top to bottom, and an  attribute
       must  pass *all* the rules which affect it in order to make it past the
       filter.  Order of the rules is  important.   The  operators  and  their
       purpose in defining the rules are as follows:

       =      THIS  OPERATOR  IS NOT ALLOWED.  If used, and warning message is
              printed and it is treated as ==

       :=     Set, this attribute and value  will  always  be  placed  in  the
              output A/V Pairs.  If the attribute exists, it is overwritten.

       ==     Equal, value must match exactly.

       =*     Always Equal, allow all values for the specified attribute.

       !*     Never Equal, disallow all values for the specified attribute.  (
              This is redundant, as any A/V Pair not explicitly permitted will
              be dropped ).

       !=     Not Equal, value must not match.

       >=     Greater Than or Equal

       <=     Less Than or Equal

       >      Greather Than

       <      Less Than

       If  regular  expressions  are  enabled the following operators are also
       possible.  ( Regular Expressions are included by  default  unless  your
       system  doesn’t  support them, which should be rare ).  The value field
       uses standard regular expression syntax.

       =~     Regular Expression Equal

       !~     Regular Expression Not Equal

       See the default /etc/raddb/attrs for working examples  of  sample  rule
       ordering and how to use the different operators.

       The main configuration item is:

              This  specifies the location of the file used to load the filter


       authorization, accounting, preproxy, postproxy


       /etc/raddb/radiusd.conf /etc/raddb/attrs


       radiusd(8), radiusd.conf(5)


       Chris Parker,

                                3 February 2004             rlm_attr_filter(5)