rlm_attr_filter(5)

🎀 rlm_attr_filter — FreeRADIUS Module 💅

okay bestie, settle in, because this is the rlm_attr_filter(5) manual page and it's genuinely iconic once you get what it's doing ✨

---

🌸 NAME 🌸

rlm_attr_filter — it's the FreeRADIUS Module, and it's basically the bouncer at the club door of your RADIUS packets 🫶

---

✨ DESCRIPTION ✨

So the rlm_attr_filter module exists for filtering certain attributes and values in received ( or transmitted ) radius packets. That's the whole vibe. It gives the server a flexible framework to filter the attributes we send to or receive from home servers or NASes. And this makes sense, for example, in an out-sourced dialup situation to various policy decisions, such as restricting a client to certain ranges of Idle-Timeout or Session-Timeout. like, you're not gonna let just anybody set a Session-Timeout of a million seconds, be so fr 😭

Filter rules are normally defined and applied on a per-realm basis, where the realm is anything that is defined and matched based on the configuration of the rlm_realm module. Filter rules can optionally be applied using another attribute, by editing the key configuration for this module. slay, flexible 💅

⚠️ history lesson, bestie, don't skip it: In 2.0.1 and earlier versions, the "accounting" section filtered the Accounting-Request, even though it was documented as filtering the response. This issue has been fixed in version 2.0.2 and later versions. The "preacct" section may now be used to filter Accounting-Request packets. The "accounting" section now filters Accounting-Response packets. Administrators using "attr_filter" in the "accounting" section SHOULD move the reference to "attr_filter" from "accounting" to "preacct". like, actually move it. fr fr. 👑

The file that defines the attribute filtering rules follows a similar syntax to the users file. There are a few differences however:

• There are no check-items allowed other than the name of the key.
• There can only be a single DEFAULT entry.

The rules for each entry are parsed top to bottom, and an attribute must pass all the rules which affect it in order to make it past the filter. Order of the rules is important. highkey important. The operators and their purpose in defining the rules are as follows:

• = — THIS OPERATOR IS NOT ALLOWED. If used, and warning message is printed and it is treated as ==. so like... don't? 🙈
• := — Set, this attribute and value will always be placed in the output A/V Pairs. If the attribute exists, it is overwritten.
• == — Equal, value must match exactly.
• =* — Always Equal, allow all values for the specified attribute.
• !* — Never Equal, disallow all values for the specified attribute. ( This is redundant, as any A/V Pair not explicitly permitted will be dropped ). yes bestie, redundant, we said what we said 💀
• != — Not Equal, value must not match.
• >= — Greater Than or Equal
• <= — Less Than or Equal
• > — Greater Than
• < — Less Than

If regular expressions are enabled the following operators are also possible. ( Regular Expressions are included by default unless your system doesn't support them, which should be rare ). The value field uses standard regular expression syntax.

• =~ — Regular Expression Equal
• !~ — Regular Expression Not Equal

See the default /etc/raddb/mods-config/attr_filter/ for working examples of sample rule ordering and how to use the different operators. literally go look at them, they're right there 🧚

The configuration items are:

• file — This specifies the location of the file used to load the filter rules. This file is used to filter the accounting response, packet before it is proxied, proxy response from the home server, or our response to the NAS.
• key — Usually %{Realm} (the default). Can also be %{User-Name}, or other attribute that exists in the request. Note that the module always keys off of attributes in the request, and NOT in any other packet. read that twice, bestie, it's a whole thing 👀
• relaxed — If set to 'yes', then attributes which do not match any filter rules explicitly, will also be allowed. This behaviour may be overridden for an individual filter block using the Relax-Filter check item. The default for this configuration item is 'no'.

---

🦋 SECTIONS 🦋

okay so these are the places you can drop this module, and each one does something different, iykyk:

• preacct — Filters Accounting-Request packets.
• accounting — Filters Accounting-Response packets.
• pre-proxy — Filters Accounting-Request or Access-Request packets prior to proxying them.
• post-proxy — Filters Accounting-Response, Access-Accept, Access-Reject, or Access-Challenge responses from a home server.
• authorize — Filters Access-Request packets.
• post-auth — Filters Access-Accept or Access-Reject packets.

---

🍓 FILES 🍓

/etc/raddb/radiusd.conf
/etc/raddb/mods-config/attr_filter/*

---

🌈 SEE ALSO 🌈

radiusd(8), radiusd.conf(5) — go read those next, bestie, main character energy 📚

---

💜 AUTHOR 💜

Chris Parker, cparker@segv.org — ty king 🫶

---

and that's the whole page!! ✨ it's giving "raddb royalty" honestly 👑 this was rlm_attr_filter(5) from the FreeRADIUS Module, dated 27 June 2013 — so yeah, a lil vintage, but she still ate 💅🎀 no cap, go filter some attributes. periodt. 🌸