Hi, its possible some domains autheticated (proxies) hide Realm (Realm NULL) ? In 'Autorize' the User-Name contains @domain... but in 'Accounting' Realm = NULL...
How to get the domain, or not permit this change? I detected one external domain hide... I use Accounting to log the access.... -----Mensagem original----- De: A.L.M.Buxey@lboro.ac.uk [mailto:A.L.M.Buxey@lboro.ac.uk] Enviada em: quinta-feira, 28 de julho de 2016 11:00 Para: Marcio Luiz Ota <ota@univali.br>; FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Assunto: Re: Eduroam: Realm NULL in Accounting Hi,
its possible some domains autheticated (proxies) hide Realm (Realm NULL) ?
yes, if they return the inner username in the accept-accept - which means your NAS knows that name...and uses it. alan
Hi,
How to get the domain, or not permit this change?
I detected one external domain hide...
I use Accounting to log the access....
you could cache the realm so when the reply comes back you might be able to do something with it. accounting captures the CSI and the user-name..... so you already have the details. you can combine RADIUS logs with your NAS info so you can say where that user comes from anyway. ideally you'd just be using the CUI for all info anyway :) alan
--- Sending Access-Request Id 94 from 0.0.0.0:45569 to 127.0.0.1:1830 User-Name = 'username@domain' --- ... --- Received Access-Accept Id 94 from 127.0.0.1:1830 to 127.0.0.1:45569 length 179 Message-Authenticator = 0xb2e9c72060b703e899e05e0f5d7cfa34 User-Name = 'username' --- -----Mensagem original----- De: Freeradius-Users [mailto:freeradius-users-bounces+ota=univali.br@lists.freeradius.org] Em nome de Marcio Luiz Ota via Freeradius-Users Enviada em: quinta-feira, 28 de julho de 2016 11:10 Para: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Assunto: RES: Eduroam: Realm NULL in Accounting How to get the domain, or not permit this change? I detected one external domain hide... I use Accounting to log the access.... -----Mensagem original----- De: A.L.M.Buxey@lboro.ac.uk [mailto:A.L.M.Buxey@lboro.ac.uk] Enviada em: quinta-feira, 28 de julho de 2016 11:00 Para: Marcio Luiz Ota <ota@univali.br>; FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Assunto: Re: Eduroam: Realm NULL in Accounting Hi,
its possible some domains autheticated (proxies) hide Realm (Realm NULL) ?
yes, if they return the inner username in the accept-accept - which means your NAS knows that name...and uses it. alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
A.L.M.Buxey＠lboro.ac.uk -
Marcio Luiz Ota