I've been running 2.1.6 in Production with the patch from Bug 17, for a month, and everything has been working fine. As a reminder, this patch corrects a bug in MS-CHAP with the calculation of the MS-CHAPv1 challenge passed to ntlm_auth. It causes inappropriate Logon Failure errors, in certain circumstances having to do with the case of the userid and the logon method (see the bug report and previous posts for more details if you didn't follow the thread). Others have reported this problem in the past and the workaround has been to create all users in a specific case and force the userid to the same case in FR. (I'd really like to see this fix incorporated in the code, as other RADIUS servers don't have this userid case-sensitivity issue and this gives people an opportunity to cast stones at FR.) Arran: You seemed a bit interested in this patch - have you had the time/desire to apply and test it? If anyone else has some time to apply and test the patch, it is very much appreciated. Thanks in advance for your assistance and feedback..
Hi, has a look at this but it's only of interest for classic MS-CHAP activity rather than MSCHAPv2 in PEAP or TTLS - correct? (in this case we wouldnt use this function or be able to test this at our site...but logically it all looks sane) a few changes though (?) - its 'delimiter', not 'delimeter' ;-) and...some RDEBUG2 starts with a white space and others print tight to the line - reason for such differences? alan
Alan Buxey wrote:
Hi,
has a look at this but it's only of interest for classic MS-CHAP activity rather than MSCHAPv2 in PEAP or TTLS - correct? (in this case we wouldnt use this function or be able to test this at our site...but logically it all looks sane)
a few changes though (?) - its 'delimiter', not 'delimeter' ;-) and...some RDEBUG2 starts with a white space and others print tight to the line - reason for such differences?
http://www.googlefight.com/index.php?lang=en_GB&word1=delimiter&word2=delime... -- Johan Meiring Cape PC Services CC Tel: (021) 883-8271 Fax: (021) 886-7782
Hi,
a few changes though (?) - its 'delimiter', not 'delimeter' ;-) and...some RDEBUG2 starts with a white space and others print tight to the line - reason for such differences?
http://www.googlefight.com/index.php?lang=en_GB&word1=delimiter&word2=delime...
your point is? (I win the fight ;-) ) google search for 'define:delimeter' Did you mean: define:delimiter Top 2 results shown :-) alan
Alan Buxey wrote:
Hi,
a few changes though (?) - its 'delimiter', not 'delimeter' ;-) and...some RDEBUG2 starts with a white space and others print tight to the line - reason for such differences?
http://www.googlefight.com/index.php?lang=en_GB&word1=delimiter&word2=delime...
your point is? (I win the fight ;-) )
Oops.... I (like an idiot) read you comment the wrong way around! -- Johan Meiring Cape PC Services CC Tel: (021) 883-8271 Fax: (021) 886-7782
Hi,
http://www.googlefight.com/index.php?lang=en_GB&word1=delimiter&word2=delime...
your point is? (I win the fight ;-) )
Oops.... I (like an idiot) read you comment the wrong way around!
8-) thats okay - I've got a useful URL to settle arguments with now - thanks! :-) alan
Alan, Thank you for taking the time to review the patch and for your feedback.
has a look at this but it's only of interest for classic MS-CHAP activity rather than MSCHAPv2 in PEAP or TTLS - correct? (in this case we wouldnt use this function or be able to test this at our site...but logically it all looks sane)
Actually, the problem definitely impacts PEAP/MSCHAPv2 (and I believe TTLS/MSCHAPv2 also because it's an error in MS-CHAP, but we don't use TTLS so I can't test that). (I haven't thought about it enough to know whether it affects v1, but it definitely occurs with v2 as that's where I found it.) The problem occurs when the client creates the MS-CHAPv2 response and uses a userid whose case differs from what FR subsequently uses to create the challenge for ntlm_auth.
a few changes though (?) - its 'delimiter', not 'delimeter' ;-)
True, but I just copied that line from what was already in the code. I'm ok with fixing the spelling error as part of this patch though ;-)
and...some RDEBUG2 starts with a white space and others print tight to the line - reason for such differences?
I was trying to mimic some of the existing code (when in Rome ;-) )... For instance, there was already an RDEBUG2 for: RDEBUG2(" NT Domain delimeter found, should we have enabled with_ntdomain_hack?"); I'm not opposed to eliminating the leading spaces if you think it is more readable. BTW, I just fixed one of the attachments (rlm_eap_mschapv2.c patch). I inadvertently had all 3 patches included in that one file - the replacement now only contains the changes for rlm_eap_mschapv2.c. Sorry about the confusion..
Hi,
Actually, the problem definitely impacts PEAP/MSCHAPv2 (and I believe TTLS/MSCHAPv2 also because it's an error in MS-CHAP, but we don't use TTLS so I can't test that). (I haven't thought about it enough to know whether it affects v1, but it definitely occurs with v2 as that's where I found it.)
The problem occurs when the client creates the MS-CHAPv2 response and uses a userid whose case differs from what FR subsequently uses to create the challenge for ntlm_auth.
hmm, okay - I'll only be able to introduce core systrems with this patch in place after 2nd October - we currently have a change freeze on main systems until then alan
participants (3)
-
Alan Buxey -
Garber, Neal -
Johan Meiring