June 2012 - Freeradius-Devel - lists.freeradius.org

Regexp match wrongly copied to control list
by Brian Candler 18 Jun '12

18 Jun '12

I have an issue with FreeRadius 2.1.12. If I make use of a check/control regexp match in either rlm_sql or rlm_files, and the match succeeds, then a spurious attribute is added onto the control list containing the regexp which was matched. To demonstrate: authorize { update reply { Reply-Message += "Before: %{control:User-Name}" } testuser update reply { Reply-Message += "After: %{control:User-Name}" } ... testuser is an instance of rlm_files which contains: DEFAULT User-Name =~ "@example\\.com$" Reply-Message += "Matched" Then send a test packet: # radtest test(a)example.com secret localhost 1 testing123 The response includes: Reply-Message = "Before: " Reply-Message = "Matched" Reply-Message = "After: @example\\.com$" Debug output: rad_recv: Access-Request packet from host 127.0.0.1 port 49269, id=27, length=86 User-Name = "test(a)example.com" User-Password = "secret" NAS-IP-Address = 192.168.56.101 NAS-Port = 1 Message-Authenticator = 0x476a68f002b8b1f49df07064f8e1411a # Executing section authorize from file /etc/freeradius/sites-enabled/stratRadius +- entering group authorize {...} expand: Before: %{control:User-Name} -> Before: ++[reply] returns notfound [testuser] expand: %{Called-Station-Id} -> [testuser] expand: %{User-Name} -> test(a)example.com [testuser] users: Matched entry DEFAULT at line 1 ++[testuser] returns ok expand: After: %{control:User-Name} -> After: @example\.com$ ++[reply] returns ok This is a problem because I was using the attribute in the control list for something else. It only seems to be a side-effect of the regexp match. If instead I use: DEFAULT User-Name == "test(a)example.com" Reply-Message += "Matched" then the control:User-Name is not updated. Regards, Brian.

2 2

Security considerations for SSL_get_quiet_shutdown
by august huber 13 Jun '12

13 Jun '12

Hi All, While performing some integration work with FreeRadius I have hit some barriers in providing meaningful errors to clients during failed SSL (eap_tls) transactions. I was perplexed to discover that all SSL contexts receive SSL_get_quiet_shutdown(ctx,1) called before shutdown. I'm curious about the logic behind this decision; specifically is it targeted to decrease attacker awareness of failure modes or a function of poor client integration causing some platform to barf when it receives a TLS Alert message? If neither, does anyone know how this change made it there? Adding a conflg flag seems relatively straightforward for this case to preserve the silent functionality when desired, but wanted to query the list to see if anyone has a strong opinion before I do.

2 5

Freeradius logs analyzer
by carlos.jc1986 06 Jun '12

06 Jun '12

Hi: I'm trying to find a log analyzer for freeradius to Ubuntu. I could provide some help. Greetings. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Freeradius-logs-analyzer-tp5713597.… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

1 0

addition to policy.conf
by alan buxey 06 Jun '12

06 Jun '12

hi, a little something that I've been meaning to send out for a while. basically, a small addition to policy.conf (that probably could do with a few little extra additions) that will allow sites to easily check for NAI 4282 compliance - simply, that a User-Name is valid for proxying to other locations - a great boon for sites using eduroam , for example, as it stops end sites filling up the heirarchical proxy system with junk requests.... many sites have a lot of messy rules in place...with this addition to policy.conf all they need to do is call check_nai_compliance in their authorize section and things are nice. attached (should be all okay for 2.1.13 and 3.x ) alan

7 20

Re: addition to policy.conf
by Alan Buxey 06 Jun '12

06 Jun '12

Each sites NAS should be configured to block EAP attacks or DoS or multitude of failures. But anyways, it doesn't matter for each END site what their LOCAL auth levels are - huge sites work 10k concurrent local campus users will have big numbers. The problem is the proxy packets as proxying is the Achilles heel where many bad things can happen. Remote sites not responding etc etc Anyway, thus us just diversion. I saw no complaints when 'reject if not EAP' , for example, went into proxy.conf. noone is forced to use any of the existing policies (many dont!) However here we have a valid use case and many freeradius sites that will work better, out of the box, than other RADIUS solutions ;) alan -- This smartphone has free WiFi worldwide with eduroam, now that IS smart

1 0

Re: addition to policy.conf
by Alan Buxey 05 Jun '12

05 Jun '12

At least RFC 4282 which takes over the one you stated. I still believe it is good to separate it out to comprehensible checks as that will allow further enhancements/future changes to be trivial...and for less skilled admin to understand what it does On a bad day, more than 60% of our failed logins are due to duff realms with non-real format :( alan ----- Reply message ----- From: "Brian Candler" <B.Candler(a)pobox.com> Date: Tue, Jun 5, 2012 18:35 Subject: addition to policy.conf To: "FreeRadius developers mailing list" <freeradius-devel(a)lists.freeradius.org> On Mon, Jun 04, 2012 at 10:31:10PM +0200, Stefan Winter wrote: > Hi, > > > In that case though, I would be inclined to write a validation regexp > > which fully matches the ABNF in RFC 2486. > > Elsewhere in the thread I presented arguments why a full check is a bad > idea. > > Do you have arguments to back up your "inclinedness" or is it just a gut > feeling? Only a gut feeling of "either enforce RFC 2486, or don't". Anything else seems to be a kludge to me. Has anyone actually *measured* what proportion of their failed logins are due to usernames containing two dots, or realms which start or end with a dot, or the other things the OP's regexp tests rejected? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html

1 0