Subject: (usr-tc) Special user groups under HiperArc

From: [email-masked]
Date: Mon, 31 Jul 2000 18:34:08 +0000

Is there a way to have the HiperArc "segregate" deal with a special
group of users, so that all it allows them to do is httpd services?

  THe reason for asking is, that AOL is not a local dialup for people in
this area and they "piggyback" us to get to AOL via the Internet.

  What I would like to do is assign then a user ID like aolusername and
then have the HiperArcs "filter" the accounts with the aol PREFIX and then
only allow the connection to AOL.  I do not want them to have access to
pop, ftp or news on our network at all since we are providing the dialup
for AOL.

  Does any of this make any sense ?   Would like any comments and/or
suggestions on how we might handle this.

  Thanks again!

==============================================================================
Phillip Ferraro				WorldNet Access, Inc
[email-masked]	Onslow County's PREMIER InterNet Service 
Voice (910) 346-0835		    824 Gumbranch Square, Suite Q
FAX   (910) 455-1933		     Jacksonville, Nc  28540-6269
==============================================================================

-
 To unsubscribe to usr-tc, send an email to "[email-masked]"
 with "unsubscribe usr-tc" in the body of the message.
 For information on digests or retrieving files and old messages send
 "help" to the same address.  Do not use quotes in your message.

---

From: Charles Sprickman <[email-masked]>
Date: Tue, 01 Aug 2000 00:29:38 +0000

> group of users, so that all it allows them to do is httpd services?

Yes...  It's totally possible.  Since we use radiator as our radius server
(http://www.open.com.au/radiator/), I'll use that as an example.  You
would define a filter on all your arcs that only allows access to the "AOL
port" (see webmaster.aol.com for details on how AOL works) and give it a
name such as "aolfilter".  You could then mark all of these users as AOL
users in whatever authentication scheme you use as AOL users (the simplest
example would be making a unix group called "aoluser").  Radiator, and
likely other radius servers, could then have a rule that states "if a user
logs in and is in group 'aoluser', send a filter-id in this request for
'aolfilter'".

That's it in a nutshell.  The arcs allow filters on a per user basis to be
set in radius replies...

Charles

-

---

From: [email-masked]
Date: Wed, 02 Aug 2000 19:23:35 +0000

I am looking for a good filter to place on our HUBS (HiperArcs) to
block a particular usergroup from access to OUR standard services ie.
telnet, pop, smtp, dns, nntp.   I am not that familiar with filters, but
have been reading several examples to include a few 3Com ones, however
they are a little vague!

  I would assume that since the dialup group will use tcp port 5190, that
I can effectively block everything else here.   I want to assign the
Filter-Id in my radius users file.

  I would also need to know how to "Globally" apply the filter to all
modem slots so that I would not have to do it to each individual slot.

  I can use a little help here...  Any comments/samples appreciated

-