policy filter_username
Hello, I have a problem with the filter_username policy in FR 3.0.7 The rules checking double dots and starting / ending dot evaluate to TRUE for a correct username (2) User-Name = 'mgw@umk.pl' (2) NAS-IP-Address =... ... (2) # Executing section authorize from file /opt/FR/etc/raddb/sites-enabled/default-umk (2) authorize { (2) policy filter_username { (2) if (!&User-Name) { (2) if (!&User-Name) -> FALSE (2) if (&User-Name =~ / /) { (2) if (&User-Name =~ / /) -> FALSE (2) if (&User-Name =~ /@.*@/ ) { (2) if (&User-Name =~ /@.*@/ ) -> FALSE (2) if (&User-Name =~ /\.\./ ) { (2) if (&User-Name =~ /\.\./ ) -> TRUE (2) if (&User-Name =~ /\.\./ ) { (2) update reply { (2) &Reply-Message += 'Rejected: Username contains ..s' (2) } # update reply = noop (2) [reject] = reject (2) } # if (&User-Name =~ /\.\./ ) = reject (2) } # policy filter_username = reject .. (2) Invalid user: [mgw@umk.pl] (from client ... ) Maja -- Maja Gorecka-Wolniewicz mgw@umk.pl Uczelniane Centrum Information & Communication Informatyczne Technology Centre Uniwersytet Mikolaja Kopernika Nicolaus Copernicus University Coll. Maximum, pl. Rapackiego 1, 87-100 Torun, Poland tel.: +48 56-611-27-40 fax: +48 56-622-18-50 tel. kom.: +48-693032574
W dniu 05.03.2015 o 14:26, Alan DeKok pisze:
On Mar 5, 2015, at 8:24 AM, A.L.M.Buxey@lboro.ac.uk wrote:
nah, you have a problem with the new slash escape handling code in FreeRADIUS 3.0.7 ;-) The default configuration is tested and works.
Edited configurations… may be different. I'm using the default configuration. .... # # reject double dots # e.g. "user@site..com" # if (&User-Name =~ /\.\./ ) { update reply { &Reply-Message += 'Rejected: Username contains ..s' } reject }
Maja
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Maja Gorecka-Wolniewicz mgw@umk.pl Uczelniane Centrum Information & Communication Informatyczne Technology Centre Uniwersytet Mikolaja Kopernika Nicolaus Copernicus University Coll. Maximum, pl. Rapackiego 1, 87-100 Torun, Poland tel.: +48 56-611-27-40 fax: +48 56-622-18-50 tel. kom.: +48-693032574
On 05-03-15 14:16, Maja Wolniewicz wrote:
Hello,
I have a problem with the filter_username policy in FR 3.0.7 The rules checking double dots and starting / ending dot evaluate to TRUE for a correct username (2) if (&User-Name =~ /\.\./ ) -> TRUE
Did you set "correct_escapes" in radiusd.conf to "true"? -- Herwin Weststrate
W dniu 05.03.2015 o 15:00, Herwin Weststrate pisze:
On 05-03-15 14:16, Maja Wolniewicz wrote:
Hello,
I have a problem with the filter_username policy in FR 3.0.7 The rules checking double dots and starting / ending dot evaluate to TRUE for a correct username (2) if (&User-Name =~ /\.\./ ) -> TRUE Did you set "correct_escapes" in radiusd.conf to "true"? Thanks! it helped. My radiusd.conf was from 3.0.6
Maja -- Maja Gorecka-Wolniewicz mgw@umk.pl Uczelniane Centrum Information & Communication Informatyczne Technology Centre Uniwersytet Mikolaja Kopernika Nicolaus Copernicus University Coll. Maximum, pl. Rapackiego 1, 87-100 Torun, Poland tel.: +48 56-611-27-40 fax: +48 56-622-18-50 tel. kom.: +48-693032574
participants (4)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Herwin Weststrate -
Maja Wolniewicz