Rejected: Realm does not have at least one dot separator
Hello, I am redeploying 3.0.8 on a new system using the same config files as my existing prod systems... but in the new system, I get this error... Username does have a dot in the realm... but the expression somehow fails... (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (User-Name != "%{tolower:%{User-Name}}") { (0) EXPAND %{tolower:%{User-Name}} (0) --> *georgetown_test@eduroamus.edu <georgetown_test@eduroamus.edu>* (0) if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (0) if (User-Name =~ / /) { (0) if (User-Name =~ / /) -> FALSE (0) if (User-Name =~ /@.*@/ ) { (0) if (User-Name =~ /@.*@/ ) -> FALSE (0) if (User-Name =~ /\\.\\./ ) { (0) if (User-Name =~ /\\.\\./ ) -> FALSE (0) if ((User-Name =~ /@/) && (User-Name !~ /@(.+)\\.(.+)$/)) { (0) * if ((User-Name =~ /@/) && (User-Name !~ /@(.+)\\.(.+)$/)) -> TRUE* (0) if ((User-Name =~ /@/) && (User-Name !~ /@(.+)\\.(.+)$/)) { (0) update reply { (0) Reply-Message += "*Rejected: Realm does not have at least one dot separator*" (0) } # update reply = noop (0) [reject] = reject (0) } # if ((User-Name =~ /@/) && (User-Name !~ /@(.+)\\.(.+)$/)) = reject (0) } # policy filter_username = reject (0) } # authorize = reject (0) Using Post-Auth-Type Reject In the config, the rule looks like so: sudo grep -A4 -B5 -r "dot separator" /etc/raddb /etc/raddb/policy.d/filter- # must have at least 1 string-dot-string after @ /etc/raddb/policy.d/filter- # e.g. "user@site.com" /etc/raddb/policy.d/filter- # /etc/raddb/policy.d/filter- if ((User-Name =~ /@/) && (User-Name !~ /@(.+)\\.(.+)$/)) { /etc/raddb/policy.d/filter- update reply { /etc/raddb/policy.d/filter: Reply-Message += "Rejected: Realm does not have at least one dot separator" /etc/raddb/policy.d/filter- } /etc/raddb/policy.d/filter- reject /etc/raddb/policy.d/filter- } /etc/raddb/policy.d/filter- Thanks, Mohamed.
I built this 3.0.8, on redhat 6.6, by tweaking the src rpm from http://software.opensuse.org/download.html?project=home%3Afreeradius%3A3.0.x... Could it be that I need specific version pcre ? I installed pcre-devel, rebuilt the rpms, also tried dirct "make install" frm the build dir... any hints highly appreciated... as I can't see how to further troubleshoot this issue... Thanks, Mohamed. On Fri, Jun 26, 2015 at 12:03 PM, Mohamed Lrhazi < Mohamed.Lrhazi@georgetown.edu> wrote:
Hello,
I am redeploying 3.0.8 on a new system using the same config files as my existing prod systems... but in the new system, I get this error...
Username does have a dot in the realm... but the expression somehow fails...
(0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (User-Name != "%{tolower:%{User-Name}}") { (0) EXPAND %{tolower:%{User-Name}} (0) --> *georgetown_test@eduroamus.edu <georgetown_test@eduroamus.edu>* (0) if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (0) if (User-Name =~ / /) { (0) if (User-Name =~ / /) -> FALSE (0) if (User-Name =~ /@.*@/ ) { (0) if (User-Name =~ /@.*@/ ) -> FALSE (0) if (User-Name =~ /\\.\\./ ) { (0) if (User-Name =~ /\\.\\./ ) -> FALSE (0) if ((User-Name =~ /@/) && (User-Name !~ /@(.+)\\.(.+)$/)) { (0) * if ((User-Name =~ /@/) && (User-Name !~ /@(.+)\\.(.+)$/)) -> TRUE* (0) if ((User-Name =~ /@/) && (User-Name !~ /@(.+)\\.(.+)$/)) { (0) update reply { (0) Reply-Message += "*Rejected: Realm does not have at least one dot separator*" (0) } # update reply = noop (0) [reject] = reject (0) } # if ((User-Name =~ /@/) && (User-Name !~ /@(.+)\\.(.+)$/)) = reject (0) } # policy filter_username = reject (0) } # authorize = reject (0) Using Post-Auth-Type Reject
In the config, the rule looks like so:
sudo grep -A4 -B5 -r "dot separator" /etc/raddb /etc/raddb/policy.d/filter- # must have at least 1 string-dot-string after @ /etc/raddb/policy.d/filter- # e.g. "user@site.com" /etc/raddb/policy.d/filter- # /etc/raddb/policy.d/filter- if ((User-Name =~ /@/) && (User-Name !~ /@(.+)\\.(.+)$/)) { /etc/raddb/policy.d/filter- update reply { /etc/raddb/policy.d/filter: Reply-Message += "Rejected: Realm does not have at least one dot separator" /etc/raddb/policy.d/filter- } /etc/raddb/policy.d/filter- reject /etc/raddb/policy.d/filter- } /etc/raddb/policy.d/filter-
Thanks, Mohamed.
On 26 Jun 2015, at 17:03, Mohamed Lrhazi <Mohamed.Lrhazi@georgetown.edu> wrote:
Username does have a dot in the realm... but the expression somehow fails…
You haven’t provided enough information to confirm (full debug log when asking for assistance please!), but I can make an educated guess - if it’s not correct, please post a full debug log from both your old and new servers. Your old system is running 3.0.4? A change was made to FreeRADIUS 3.0.5 regarding how it handles forward slashes in regexps. See ‘correct escapes’ in radiusd.conf: https://github.com/FreeRADIUS/freeradius-server/blob/fb0f8f94e774eb03e98ce9b... If you’re porting your old configuration forward, you need to make sure that correct_escapes is set to the behaviour you want in your version of radiusd.conf, and that the regexps in your config files agree with that setting. It looks like the files (policy.d/filter) are default ones too, so it’s probably easiest to set correct_escapes to true and restore the contents of that file to the default. This may make upgrades easier in future, too: http://wiki.freeradius.org/guide/Git-config-management Regards, Adam Bishop gpg: 0x6609D460 jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.
Thanks a lot Adam... am gonna try to understand what am doing better... but here is the thing: - My old system is 3.0.8. (in a docker container based on an Ubuntu base image) - New one is also 3.0.8 (on a RedHat Enterprise Linux 6.6 VM) - Indeed, changing correct_escapes from true to false, make my new setup work! Thanks, Mohamed. On Sat, Jun 27, 2015 at 11:41 AM, Adam Bishop <Adam.Bishop@jisc.ac.uk> wrote:
On 26 Jun 2015, at 17:03, Mohamed Lrhazi <Mohamed.Lrhazi@georgetown.edu> wrote:
Username does have a dot in the realm... but the expression somehow fails…
You haven’t provided enough information to confirm (full debug log when asking for assistance please!), but I can make an educated guess - if it’s not correct, please post a full debug log from both your old and new servers.
Your old system is running 3.0.4?
A change was made to FreeRADIUS 3.0.5 regarding how it handles forward slashes in regexps. See ‘correct escapes’ in radiusd.conf:
https://github.com/FreeRADIUS/freeradius-server/blob/fb0f8f94e774eb03e98ce9b...
If you’re porting your old configuration forward, you need to make sure that correct_escapes is set to the behaviour you want in your version of radiusd.conf, and that the regexps in your config files agree with that setting.
It looks like the files (policy.d/filter) are default ones too, so it’s probably easiest to set correct_escapes to true and restore the contents of that file to the default.
This may make upgrades easier in future, too: http://wiki.freeradius.org/guide/Git-config-management
Regards,
Adam Bishop
gpg: 0x6609D460
jisc.ac.uk
Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.
Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Oh.. I was not using the same radiusd.conf in the two environments! Thanks a lot, Mohamed. On Sat, Jun 27, 2015 at 1:49 PM, Mohamed Lrhazi < Mohamed.Lrhazi@georgetown.edu> wrote:
Thanks a lot Adam... am gonna try to understand what am doing better... but here is the thing:
- My old system is 3.0.8. (in a docker container based on an Ubuntu base image) - New one is also 3.0.8 (on a RedHat Enterprise Linux 6.6 VM) - Indeed, changing correct_escapes from true to false, make my new setup work!
Thanks, Mohamed.
On Sat, Jun 27, 2015 at 11:41 AM, Adam Bishop <Adam.Bishop@jisc.ac.uk> wrote:
On 26 Jun 2015, at 17:03, Mohamed Lrhazi <Mohamed.Lrhazi@georgetown.edu> wrote:
Username does have a dot in the realm... but the expression somehow fails…
You haven’t provided enough information to confirm (full debug log when asking for assistance please!), but I can make an educated guess - if it’s not correct, please post a full debug log from both your old and new servers.
Your old system is running 3.0.4?
A change was made to FreeRADIUS 3.0.5 regarding how it handles forward slashes in regexps. See ‘correct escapes’ in radiusd.conf:
https://github.com/FreeRADIUS/freeradius-server/blob/fb0f8f94e774eb03e98ce9b...
If you’re porting your old configuration forward, you need to make sure that correct_escapes is set to the behaviour you want in your version of radiusd.conf, and that the regexps in your config files agree with that setting.
It looks like the files (policy.d/filter) are default ones too, so it’s probably easiest to set correct_escapes to true and restore the contents of that file to the default.
This may make upgrades easier in future, too: http://wiki.freeradius.org/guide/Git-config-management
Regards,
Adam Bishop
gpg: 0x6609D460
jisc.ac.uk
Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.
Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Adam Bishop -
Mohamed Lrhazi