I have Freeradius authenticating to an Active Directory system via ntlm_auth. When a username in the format "foobar\jdoe" comes in, where "foobar" is the domain and "jdoe" is the real username, the authentication succeeds just fine. But if username is "foobar\tdoe" then it gets expanded to "foobar doe". Here's some real output where the passed in username was "CCSU\tstudent": ``` (0) mschap : Client is using MS-CHAPv1 with NT-Password (0) mschap : Executing: "/bin/ntlm_auth --request-nt-key --username=%{%{mschap:User-Name}:-None} --domain=%{%{mschap:NT-Domain}:-None} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}" (0) mschap : expand: "--username=%{%{mschap:User-Name}:-None}" -> '--username=CCSU student' (0) mschap : No NT-Domain was found in the User-Name. (0) mschap : expand: "--domain=%{%{mschap:NT-Domain}:-None}" -> '--domain=' (0) mschap : mschap1: ac (0) mschap : expand: "--challenge=%{%{mschap:Challenge}:-00}" -> '--challenge=ac132ce03cba1933' (0) mschap : expand: "--nt-response=%{%{mschap:NT-Response}:-00}" -> '--nt-response=ff768eafb00738e62a3a92e103bf5c7baa7d926da2248b88' (0) mschap : Program returned code (1): Logon failure (0xc000006d) (0) mschap : External script failed. (0) ERROR: mschap : External script says: Logon failure (0xc000006d) ``` How do I prevent the escape sequence from being expanded?
On 2015-02-27 15:28:32 +0000, A.L.M.Buxey@lboro.ac.uk said:
Hi,
authentication succeeds just fine. But if username is "foobar\tdoe" then it gets expanded to "foobar doe".
looks very much like an old old bug. upgrade. what version are you running? (you dont say)
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
``` $ yum info freeradius Loaded plugins: langpacks, product-id, rhnplugin, subscription-manager Installed Packages Name : freeradius Arch : x86_64 Version : 3.0.1 Release : 6.el7 Size : 2.9 M Repo : installed
From repo : rhel-x86_64-server-7
So, the version included with RHEL 7. If this is a bug in the package,
I will take it up with Red Hat. Is there a Freeradius bugzilla I can
link to? I only brought this to the list because I haven't had any luck
whatsoever searching the Internet for information on it.
On Feb 27, 2015, at 10:49 AM, James Sumners <james.sumners@clayton.edu> wrote:
So, the version included with RHEL 7. If this is a bug in the package, I will take it up with Red Hat. Is there a Freeradius bugzilla I can link to? I only brought this to the list because I haven't had any luck whatsoever searching the Internet for information on it.
Try 3.0.7, and set “correct_escapes = true” in radiusd.conf. You will have to double-check your use of \\ in the configuration, though. You want to use fewer backslashes. A lot fewer. Usually half. Alan DeKok.
On 2015-02-27 18:23:24 +0000, Alan DeKok said:
Try 3.0.7, and set “correct_escapes = true” in radiusd.conf.
You will have to double-check your use of \\ in the configuration, though. You want to use fewer backslashes. A lot fewer. Usually half.
Alan DeKok.
I have submitted a support ticket with RH. But until they do something, I don't have access to 3.0.7 on this system. I'd like some clarification on your suggestion, though. In `mods-enabled/realm` the ntdomain is defined as (by default): ``` realm ntdomain { format = prefix delimiter = "\\" } ``` Are you suggesting that it should be?: ``` realm ntdomain { format = prefix delimiter = "\" } ```
On Feb 27, 2015, at 2:39 PM, James Sumners <james.sumners@clayton.edu> wrote:
I have submitted a support ticket with RH. But until they do something, I don't have access to 3.0.7 on this system.
You can test it...
I'd like some clarification on your suggestion, though. In `mods-enabled/realm` the ntdomain is defined as (by default):
``` realm ntdomain { format = prefix delimiter = "\\” }
Which is correct.
Are you suggesting that it should be?:
No. Alan DeKok.
On 2015-02-27 20:34:34 +0000, Alan DeKok said:
On Feb 27, 2015, at 2:39 PM, James Sumners <james.sumners@clayton.edu> wrote:
I have submitted a support ticket with RH. But until they do something, I don't have access to 3.0.7 on this system.
You can test it...
Not without significant trouble (i.e. there's no pre-built package to use). Plus, if they have a bug in their package, they need to fix it.
Hi Alan, On 02/27/2015 08:23 PM, Alan DeKok wrote:
On Feb 27, 2015, at 10:49 AM, James Sumners <james.sumners@clayton.edu> wrote:
So, the version included with RHEL 7. If this is a bug in the package, I will take it up with Red Hat. Is there a Freeradius bugzilla I can link to? I only brought this to the list because I haven't had any luck whatsoever searching the Internet for information on it.
Try 3.0.7, and set “correct_escapes = true” in radiusd.conf.
You will have to double-check your use of \\ in the configuration, though. You want to use fewer backslashes. A lot fewer. Usually half.
I'm looking for a solution for this. Do I understand it right, that 3.0.4 has escape fixes only for regex matching? Also, how hard do you think it would be to backport "correct_escapes" to 3.0.4? Thank you. Nick
On Mar 11, 2015, at 7:08 AM, Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> wrote:
I'm looking for a solution for this. Do I understand it right, that 3.0.4 has escape fixes only for regex matching?
No. 3.0.4 has no escaping fixes.
Also, how hard do you think it would be to backport "correct_escapes" to 3.0.4?
Very hard. It involves a series of changes to rather a lot of the code. Alan DeKok.
On 2015-03-11 11:08:08 +0000, Nikolai Kondrashov said:
Hi Alan,
On 02/27/2015 08:23 PM, Alan DeKok wrote:
On Feb 27, 2015, at 10:49 AM, James Sumners <james.sumners@clayton.edu> wrote:
So, the version included with RHEL 7. If this is a bug in the package, I will take it up with Red Hat. Is there a Freeradius bugzilla I can link to? I only brought this to the list because I haven't had any luck whatsoever searching the Internet for information on it.
Try 3.0.7, and set “correct_escapes = true” in radiusd.conf.
You will have to double-check your use of \\ in the configuration, though. You want to use fewer backslashes. A lot fewer. Usually half.
I'm looking for a solution for this. Do I understand it right, that 3.0.4 has escape fixes only for regex matching?
Also, how hard do you think it would be to backport "correct_escapes" to 3.0.4?
Thank you.
Nick
I _finally_ got a chance to work on this some more. RH is working on a fix for their packages in 7.2, but I can't wait that long. So I built 3.0.7 packages from the tarball on freeradius.org -- https://github.com/jsumners/freeradius-rpm That works just fine (except for the bit where the systemd service doesn't get enabled; just `sytemctl enable radiusd`). I literally copied my local additions to the Freeradius config into new files in the configuration installed by those packages and it worked.
On 13 Apr 2015, at 14:38, James Sumners <james.sumners@clayton.edu> wrote:
On 2015-03-11 11:08:08 +0000, Nikolai Kondrashov said:
Hi Alan, On 02/27/2015 08:23 PM, Alan DeKok wrote:
On Feb 27, 2015, at 10:49 AM, James Sumners <james.sumners@clayton.edu> wrote:
So, the version included with RHEL 7. If this is a bug in the package, I will take it up with Red Hat. Is there a Freeradius bugzilla I can link to? I only brought this to the list because I haven't had any luck whatsoever searching the Internet for information on it. Try 3.0.7, and set “correct_escapes = true” in radiusd.conf. You will have to double-check your use of \\ in the configuration, though. You want to use fewer backslashes. A lot fewer. Usually half. I'm looking for a solution for this. Do I understand it right, that 3.0.4 has escape fixes only for regex matching? Also, how hard do you think it would be to backport "correct_escapes" to 3.0.4? Thank you. Nick
I _finally_ got a chance to work on this some more. RH is working on a fix for their packages in 7.2, but I can't wait that long. So I built 3.0.7 packages from the tarball on freeradius.org -- https://github.com/jsumners/freeradius-rpm
Basing the packages for 7.2 on 3.0.7 or 3.0.8 would be a good idea. From 3.0.8 onwards 3.0.x will mostly bugfix only, as demonstrated by the feature to bug ratio in the changelog :). https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/doc/ChangeLog
That works just fine (except for the bit where the systemd service doesn't get enabled; just `sytemctl enable radiusd`).
That's pretty normal for rpms that install daemons? Or i'm assuming so... If it's not we can fix it. The unit file was a recent addition.
I literally copied my local additions to the Freeradius config into new files in the configuration installed by those packages and it worked.
Great -Arran
On 2015-04-13 19:13:15 +0000, Arran Cudbard-Bell said:
That works just fine (except for the bit where the systemd service doesn't get enabled; just `sytemctl enable radiusd`).
That's pretty normal for rpms that install daemons? Or i'm assuming so... If it's not we can fix it. The unit file was a recent addition.
I really don't know. I'm not a systemd fan, and am just getting into RHEL 7. So I'm not sure what the expected default is. I backported the 3.0.8 unit file stuff in the SPEC file to the 3.0.7 SPEC file. It created the file in `/usr/lib/systemd/system` correctly, but it errored on (what I'm guessing is) activation. ~shrug~ Maybe I fat fingered something in my backport.
participants (5)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Arran Cudbard-Bell -
James Sumners -
Nikolai Kondrashov