#   Script name:  BlockSecondMAC
#   To be placed in the Login section of the User Profile (for UM only)
#
#   Attempt to eliminate use of (UM) ticket users to pass their ticket information to others,
#   thus sharing tickets.
#
#   The script is not water thight, as it travers through the (UM)session list for getting the current user,
#   another user may have logged in in the meantime, thus giving the wrong user name 
#   to this script, which doesn't really harm.  Chanches that a faking user gets missed is minimal.
#
#   If someone knows how to get the current user in a more eligant way.  Please let us know.
#
#   In this script the original (paying) user, doesn't get blocked.  A catch 22 situation as he is probably 
#   part of the fooling process.   If you want him out too, remove all #22 comments.
#   
#  
:local CurrentUser
:local SessionID
:local FirstMAC 0
:local LastMAC
:local LastI
#
/tool user-manager session
:foreach i in=[find user!="x"] do={
   :set LastI $i
}
# LastI now points to last session information
#
:set CurrentUser [get $LastI user]
:set LastMAC [get $LastI calling-station-id]
:set SessionID [get $LastI acct-session-id]
#
:foreach i in=[find user="$CurrentUser"] do={
   :if ($FirstMAC = 0) do={
      :set FirstMAC [get $i calling-station-id]
   }
}
#
:if ($FirstMAC != $LastMAC) do={
   :log warning "User: $CurrentUser; Session-ID: $SessionID ($FirstMAC and $LastMAC) tempering with network"
#
#    Cancel user session
#
   /ip hotspot active
   remove [find user="$CurrentUser"]
#
#   Remove from active Host list
#
   /ip hotspot host
#22   remove [find mac-address="$FirstMAC"]
   remove [find mac-address="$LastMAC"]
#
#   Disable user
#
#22   /tool user-manager user
#22   disable "$CurrentUser"
#
#   Block MAC(s)
#
   /ip dhcp-server lease
#22   remove [find active-mac-address="$FirstMAC"]
   remove [find active-mac-address="$LastMAC"]
#22   add mac-address="$FirstMAC" block-access=yes
   add mac-address="$LastMAC" block-access=yes
#
#   Remove user cookie
#
   /ip hotspot cookie
   :foreach i in=[find user="$CurrentUser"] do={
      remove $i
   }
#
#   Notify End of Script
#
} else= {
   :log info "User: $CurrentUser; Session-ID: $SessionID ($LastMAC) OK"
}