Can FreeRADIUS send non-standard VSAs?
I'm beating my head against the RBAC VSAs used by a couple of Dell / Force 10 switches. Specifically, I am trying to figure out the binary format of the "Force10-avpair" VSA that is documented here: https://www.dell.com/support/manuals/us/en/04/force10-s3048-on/s3048-on-9.10... You'll note that the documentation makes no mention of a vendor-specific ID for the Force10-avpair attribute. Neither does anything else that Google can find, and Dell support is completely flummoxed. I'm starting to think that it's possible that there is no ID. Maybe Force 10 ignored the latter part of section 5.26 of RFC 2865 and just defined their VSA(s) as a simple string (without any vendor type or vendor length fields). Is it possible to get FreeRADIUS to send a VSA like this? -- ======================================================================== Ian Pilcher arequipeno@gmail.com -------- "I grew up before Mark Zuckerberg invented friendship" -------- ========================================================================
On Apr 26, 2019, at 2:54 PM, Ian Pilcher <arequipeno@gmail.com> wrote:
I'm beating my head against the RBAC VSAs used by a couple of Dell / Force 10 switches. Specifically, I am trying to figure out the binary format of the "Force10-avpair" VSA that is documented here:
https://www.dell.com/support/manuals/us/en/04/force10-s3048-on/s3048-on-9.10...
You'll note that the documentation makes no mention of a vendor-specific ID for the Force10-avpair attribute. Neither does anything else that Google can find, and Dell support is completely flummoxed.
Given that they're copying the Cisco-AVPair functionality, the best guess is that it's ID 1. https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/share/dictionary...
I'm starting to think that it's possible that there is no ID. Maybe Force 10 ignored the latter part of section 5.26 of RFC 2865 and just defined their VSA(s) as a simple string (without any vendor type or vendor length fields).
Is it possible to get FreeRADIUS to send a VSA like this?
Sure. Vendor-Specific := 0x010203040506070809 ... Alan DeKok.
On 4/26/19 3:16 PM, Alan DeKok wrote:
Given that they're copying the Cisco-AVPair functionality, the best guess is that it's ID 1.
That was my guess as well. Unfortunately it's not working with ID 1, and Dell hasn't been able to tell me what it should be (or even demonstrate that they understand the question).
Sure.
Vendor-Specific := 0x010203040506070809 ...
Hmm. That doesn't work for me. I tried: Vendor-Specific := 0x0000178B466F72636531302D6176706169723D227368656C6C3A707269762D6C766C3D313522 (The Force10 vendor ID followed by Force10-avpair="shell:priv-lvl=15", right out of Dell's documentation.) This gives me: Must use 'Attr-26 = ...' instead of 'Vendor-Specific = ...' So I tried: Attr-26 := 0x0000178B466F72636531302D6176706169723D227368656C6C3A707269762D6C766C3D313522 And got: Attribute overflows container Is 3.0.13 too old or have I messed up the syntax somehow? Thanks! -- ======================================================================== Ian Pilcher arequipeno@gmail.com -------- "I grew up before Mark Zuckerberg invented friendship" -------- ========================================================================
On Apr 26, 2019, at 5:12 PM, Ian Pilcher <arequipeno@gmail.com> wrote:
On 4/26/19 3:16 PM, Alan DeKok wrote:
Given that they're copying the Cisco-AVPair functionality, the best guess is that it's ID 1.
That was my guess as well. Unfortunately it's not working with ID 1,
That's terrible.
and Dell hasn't been able to tell me what it should be (or even demonstrate that they understand the question).
You're talking to support, not to the crazy engineer who wrote their RADIUS client. :(
Sure. Vendor-Specific := 0x010203040506070809 ...
Hmm. That doesn't work for me. I tried: ... Must use 'Attr-26 = ...' instead of 'Vendor-Specific = ...'
Ah yes. Sorry.
So I tried:
Attr-26 := 0x0000178B466F72636531302D6176706169723D227368656C6C3A707269762D6C766C3D313522
And got:
Attribute overflows container
Is 3.0.13 too old or have I messed up the syntax somehow?
That exact string works for me in 3.0.19. So, upgrade I guess. But if they have ignored the RFC suggestions, it's stupid. That makes it harder for everyone to use their product. Alan DeKok.
On 4/26/19 4:23 PM, Alan DeKok wrote:
You're talking to support, not to the crazy engineer who wrote their RADIUS client. :(
... while working for Force 10 Networks, 10+ years ago, and has probably worked for 5 other companies since.
But if they have ignored the RFC suggestions, it's stupid. That makes it harder for everyone to use their product.
To be fair, I don't actually know that they've done that. I'm just thrashing around at this point. It's entirely possible that the correct vendor type is 1, and it's not working for some other reason. (My guess is that the functionality hasn't actually been in FTOS for years, and they've just been blindly copying some ancient bit of pre-acquisition verbiage into every single configuration guide.) -- ======================================================================== Ian Pilcher arequipeno@gmail.com -------- "I grew up before Mark Zuckerberg invented friendship" -------- ========================================================================
On 4/26/19 4:23 PM, Alan DeKok wrote:
But if they have ignored the RFC suggestions, it's stupid. That makes it harder for everyone to use their product.
So I heard back from Dell:
The ID the Cx is referencing [in windows NPS this would be the 'Vendor-Assigned attribute number' under 'Configure VSA (RFC Compliant)'] is not listed in the documentation because it genuinely does not matter what number is used, I've tried random #s from 0 to 5000 [in capture packets show "VSA: l=19 t=Unknown-Attribute(255): 7368656c6c3a707269762d6c766c3d3135" where the t=string(#), that # is the OID/Vendor-Assigned attribute number. Any value configured greater than 255 just shows as 255. It really doesn't matter what number you pick.] and any will work so long as the string is present and the line configuration on the switch includes both authENTICATION and authorization
(My root problem was that I had configured the switch for RADIUS authentication, but not RADIUS authorization. Sigh.) I have pointed out to them that they might want to document this wee factoid, since every RADIUS server under the sun is going to want *some* value entered for the vendor type, whether it matters or not. So their VSAs are at least properly formatted ... -- ======================================================================== Ian Pilcher arequipeno@gmail.com -------- "I grew up before Mark Zuckerberg invented friendship" -------- ========================================================================
participants (2)
-
Alan DeKok -
Ian Pilcher