[Asterisk-Users] limit the length of extensions

[Chris A. Icide]

On 07:05 AM 8/31/2004, Deon Rodden wrote:
 >How do I limit the length of an extension? In my test IVR/Automated
 >Attendant (whatever it's called), at the beginning it plays "if you know
 >your parties 3 digit extension, you may enter it now) and then it gives
 >a list of options. If the caller puts the 3 digit extension, it goes
 >through fine, if they press 1, or 2 it goes to the selected menu option,
 >but if they dial 91235551212 it dials that phone number. Which of
 >course, is a big security risk.
 >
 >Is there a way to limit the length of an extension for an incoming call?
 >My only solution right now is to duplicate ever single extension (about
 >50 of them) in a seperate context, one that does not have the _9.
 >extension in it, and then make the call in menu have access to that
 >context.  However, if I put a limit in the entire context of 3 digits,
 >then my coworkers who's phones are in that context can only dial each
 >other, not 9 and an outside number. So it has to be an incoming limit or
 >something.

It sounds like you need to break your dialplan into more focused 
contexts.  Create a context for access to an outside line (you can even 
break this down into access for toll-free, long distance, local, 
local-toll, international, '976' numbers, etc.  Create contexts for each 
set of company extensions, create contexts for all the ivr systems 
separately, so only the options you want are available.  Then use include 
statements to only include the access you want for each context.  When I 
set systems up like this I also include 'anti' contexts.  For example, if I 
include a local context that allows 7, 10, or 11 digit dialing, I also 
include a context !local that plays back an unauthorized message if someone 
dials a matching number.  This way you can not only catch access to 
unauthorized features by implicitly denying access, but you provide the 
user with a reason why they are not able to place the call they just dialed.

-Chris