On Tue, Jun 05, 2012 at 05:34:30PM +0100, Brian Candler wrote:
Only a gut feeling of "either enforce RFC 2486, or don't". Anything else seems to be a kludge to me.
As another eduroam member, the amount of cr*p out there is unbelieveable. From this perspective only, doing /anything/ to stop that from going off-site is a good thing for the rest of the system, RFC or no RFC. But from a FreeRADIUS package point of view, RFCs are a good place to base code and configuration on. So a policy that enforces certain rules, based on RFC recommendations, that can be locally enhanced can only be a good thing.
Has anyone actually *measured* what proportion of their failed logins are due to usernames containing two dots, or realms which start or end with a dot, or the other things the OP's regexp tests rejected?
Random sample - the whole month of May. awk/grep stats at 1am, and I'm ill and tired - so you choose whether to trust it or not: Less than 10 logins that had '..', or '@.' or ended in '.'. However, 19 unique usernames that included a ' ', which consisted of over 15,000 login attempts, of which 11,000 were one user. That's one of the problems - some broken (IMO) supplicants just keep trying. That individual's problem? A space on the end. Number of unique usernames with random characters - '=', '/', '#', ';', ',', etc. You name it, it's probably there! - around 50. Number of login attempts to *.3gppnetwork.org - over 3,000. Anything to help block this sort of thing (easily, or by default) is useful, especially in a large federation like eduroam where the national proxies can be a choke point. (As to the whole national proxy thing, I'd happily scrap it for national RADIUS, go peer-to-peer, and just use it for international proxying, but it's what we live with at the moment, and that debate is definitely off-topic!) Cheers, Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>