users file case sensitive
Hi,
Background:
FreeRadius Version: 2.1.1-7.10.1 Users are stored in LDAP, I am using the users file to assign static IP Addresses to certain users.
It seems that the users file is case sensitive, I found a few articles on the net regarding this, but none really supplied a definitive answer.
Is there a way to prevent the users file from being case sensitive ? If not, what is the recommended method to elegantly avoid this problem.
files myfiles { key = "%{lower:%{User-Name}}" ... }
...or something similar.
Sorry, where do I implement this ?
Hi, If I use the suggestion as follows in the my files file, the users file is still case sensitive: myfiles { key = "%{lower:%{User-Name}}" } In the users file the username is all lower case - piet piet LDAP-Group=="radius", Auth-Type:=Accept Reply-Message="You are allowed to connect", Framed-IP-Address = x.x.x.x, Fall-Through = Yes When I use ntradping with the username all in lower case - piet, I get the following: ++[ldap] returns ok ++[exec] returns noop Sending Access-Accept of id 5 to y.y.y.y port 50018 Reply-Message = "You are allowed to connect" Framed-IP-Address = x.x.x.x When I use ntradping with the username all in upper case - PIET, I get the following: ++[ldap] returns ok ++[exec] returns noop Sending Access-Accept of id 6 to 147.110.250.195 port 46364 Regards Gregg On Tue, Sep 18, 2012 at 2:27 PM, Alan DeKok <aland@deployingradius.com>wrote:
Gregg Douglas wrote:
>>files myfiles { >> key = "%{lower:%{User-Name}}" >> ... >>}
>>...or something similar.
Sorry, where do I implement this ?
raddb/files
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Wed, Sep 19, 2012 at 2:24 PM, Gregg Douglas <douglagm@gmail.com> wrote:
Hi,
If I use the suggestion as follows in the my files file, the users file is still case sensitive:
myfiles { key = "%{lower:%{User-Name}}" }
In the users file the username is all lower case - piet
piet LDAP-Group=="radius", Auth-Type:=Accept Reply-Message="You are allowed to connect", Framed-IP-Address = x.x.x.x, Fall-Through = Yes
When I use ntradping with the username all in lower case - piet, I get the following:
++[ldap] returns ok ++[exec] returns noop Sending Access-Accept of id 5 to y.y.y.y port 50018 Reply-Message = "You are allowed to connect" Framed-IP-Address = x.x.x.x
The useful part is actually above that. The one from authorize, which says something like "++[files] returns updated" or something. Also, did you have "myfiles" in your authorize section, or do you still use "files"? -- Fajar
On Wed, Sep 19, 2012 at 9:38 AM, Fajar A. Nugraha <list@fajar.net> wrote:
On Wed, Sep 19, 2012 at 2:24 PM, Gregg Douglas <douglagm@gmail.com> wrote:
Hi,
If I use the suggestion as follows in the my files file, the users file is still case sensitive:
myfiles { key = "%{lower:%{User-Name}}" }
In the users file the username is all lower case - piet
piet LDAP-Group=="radius", Auth-Type:=Accept Reply-Message="You are allowed to connect", Framed-IP-Address = x.x.x.x, Fall-Through = Yes
When I use ntradping with the username all in lower case - piet, I get the following:
++[ldap] returns ok ++[exec] returns noop Sending Access-Accept of id 5 to y.y.y.y port 50018 Reply-Message = "You are allowed to connect" Framed-IP-Address = x.x.x.x
The useful part is actually above that. The one from authorize, which says something like "++[files] returns updated" or something.
Also, did you have "myfiles" in your authorize section, or do you still use "files"?
Using the "files"
-- Fajar - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Gregg Douglas wrote:
Hi,
If I use the suggestion as follows in the my files file, the users file is still case sensitive:
myfiles {
That is not quite correct. You can edit the default "files" configuration. It has a commented-out example of using the key. Uncomment it, and replace it with the text below.
key = "%{lower:%{User-Name}}"
...
When I use ntradping with the username all in upper case - PIET, I get the following:
Well, read the full debug log to see what's going on. Is it parsing the "key" field? Is it using the "myfiles" module instead of "files"? The underlying code in the "files" module is case-sensitive. So if you get the case right, and configured right, then it should work. Alan DeKok.
On Wed, Sep 19, 2012 at 9:42 AM, Alan DeKok <aland@deployingradius.com>wrote:
Gregg Douglas wrote:
Hi,
If I use the suggestion as follows in the my files file, the users file is still case sensitive:
myfiles {
That is not quite correct.
You can edit the default "files" configuration. It has a commented-out example of using the key. Uncomment it, and replace it with the text below.
key = "%{lower:%{User-Name}}"
...
I have added the line, files content: files { key = "%{lower:%{User-Name}}" usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } Ran radiusd -XX Wed Sep 19 11:18:59 2012 : Info: [files] WARNING: Unknown module "lower" in string expansion "%{lower:%{User-Name}}" Wed Sep 19 11:18:59 2012 : Info: [files] expand: %{lower:%{User-Name}} -> Wed Sep 19 11:18:59 2012 : Debug: rlm_ldap: Entering ldap_groupcmp() Wed Sep 19 11:18:59 2012 : Info: [files] expand: o=USERS -> o=USERS Wed Sep 19 11:18:59 2012 : Info: [files] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details Wed Sep 19 11:18:59 2012 : Info: [files] expand: (cn=%{Stripped-User-Name:-%{User-Name}}) -> (cn=PIET)
When I use ntradping with the username all in upper case - PIET, I get the following:
Well, read the full debug log to see what's going on. Is it parsing the "key" field? Is it using the "myfiles" module instead of "file
The underlying code in the "files" module is case-sensitive. So if you get the case right, and configured right, then it should work.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Wed, Sep 19, 2012 at 4:33 PM, Gregg Douglas <douglagm@gmail.com> wrote:
files { key = "%{lower:%{User-Name}}"
Wed Sep 19 11:18:59 2012 : Info: [files] WARNING: Unknown module "lower" in string expansion "%{lower:%{User-Name}}"
Peeking at raddb/policy.conf, it seems you should use "tolower" instead of "lower" instead. -- Fajar
files { key = "%{lower:%{User-Name}}"
Wed Sep 19 11:18:59 2012 : Info: [files] WARNING: Unknown module "lower" in string expansion "%{lower:%{User-Name}}"
Peeking at raddb/policy.conf, it seems you should use "tolower" instead of "lower" instead.
Still does the same:
Wed Sep 19 11:54:04 2012 : Info: [files] WARNING: Unknown module "tolower" in string expansion "%{tolower:%{User-Name}}" Wed Sep 19 11:54:04 2012 : Info: [files] expand: %{tolower:%{User-Name}} -> Wed Sep 19 11:54:04 2012 : Debug: rlm_ldap: Entering ldap_groupcmp() Wed Sep 19 11:54:04 2012 : Info: [files] expand: o=USERS -> o=USERS Wed Sep 19 11:54:04 2012 : Info: [files] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details Wed Sep 19 11:54:04 2012 : Info: [files] expand: (cn=%{Stripped-User-Name:-%{User-Name}}) -> (cn=piet) My policy.conf: policy { forbid_eap { if (EAP-Message) { reject } } permit_only_eap { if (!EAP-Message) { if (!"%{outer.request:EAP-Message}") { reject } } } deny_realms { if (User-Name =~ /@|\\/) { reject } } }
-- Fajar - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi, Freeradius version: freeradius-server-2.1.1-7.10.1 OS: SLES11sp2 + Post SP2 Patches I did not compile FreeRadius I used the default OS supplied rpms. Gregg On Wed, Sep 19, 2012 at 12:18 PM, alan buxey <A.L.M.Buxey@lboro.ac.uk>wrote:
Hi,
what version are you running? 2.1.12 (or ideally 2.2.0 ?)
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Wed, Sep 19, 2012 at 5:32 PM, Gregg Douglas <douglagm@gmail.com> wrote:
Hi,
Freeradius version: freeradius-server-2.1.1-7.10.1 OS: SLES11sp2 + Post SP2 Patches
I did not compile FreeRadius I used the default OS supplied rpms.
Definitely upgrade :) http://download.opensuse.org/repositories/network:/aaa/SLE_11/ ... or, if for whatever reason you can't (or won't) upgrade, probably use something other than files? IIRC mysql is case-insensitive by default. -- Fajar
Definitely upgrade :)
http://download.opensuse.org/repositories/network:/aaa/SLE_11/
This repo contains version freeradius-server-2.1.12-5.1.x86_64, will this
include the "tolower" ?
... or, if for whatever reason you can't (or won't) upgrade, probably use something other than files? IIRC mysql is case-insensitive by default.
-- Fajar - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 19/09/12 12:19, Gregg Douglas wrote:
>Definitely upgrade :)
>http://download.opensuse.org/repositories/network:/aaa/SLE_11/
This repo contains version freeradius-server-2.1.12-5.1.x86_64, will this include the "tolower" ?
Yes. Be aware that there is a security issue with 2.1.12 which is fixed in 2.2.0. Either upgrade manually or have SLES backport the fix.
I did the upgrade and it works like a charm, thanks for the warning, I think I will look into upgrading to 2.2.0. Thanks to every for all the help!!
On Wed, Sep 19, 2012 at 6:47 PM, Gregg Douglas <douglagm@gmail.com> wrote:
I did the upgrade and it works like a charm, thanks for the warning, I think I will look into upgrading to 2.2.0.
http://wiki.freeradius.org/building/Build#Building-SUSE-packages Tested on opensuse 12.1 anyway, should work for SLE11 as well. -- Fajar
On Wed, Sep 19, 2012 at 4:57 PM, Gregg Douglas <douglagm@gmail.com> wrote:
files { key = "%{lower:%{User-Name}}"
Wed Sep 19 11:18:59 2012 : Info: [files] WARNING: Unknown module "lower" in string expansion "%{lower:%{User-Name}}"
Peeking at raddb/policy.conf, it seems you should use "tolower" instead of "lower" instead.
Still does the same:
Wed Sep 19 11:54:04 2012 : Info: [files] WARNING: Unknown module "tolower" in string expansion "%{tolower:%{User-Name}}"
Hmm... upgrade? commit 05c0de0754abd569e560ab8ead5784f8658c740c Author: Alan T. DeKok <aland@freeradius.org> Date: Mon Sep 20 16:49:13 2010 +0200 Added tolower function I don't think 2.1.1 has that function. -- Fajar
Damn, sorry, my fault.
That should be:
key = "%{tolower:%{User-Name}}"
Sorry for the confusion
No problem, still does the same Info: [files] WARNING: Unknown module "tolower" in string expansion "%{tolower:%{User-Name}}" Wed Sep 19 11:59:48 2012 : Info: [files] expand: %{tolower:%{User-Name}} ->
- List info/subscribe/unsubscribe? See http://www.freeradius.org/** list/users.html <http://www.freeradius.org/list/users.html>
Gregg Douglas <douglagm@gmail.com> wrote:
Damn, sorry, my fault.
That should be:
key = "%{tolower:%{User-Name}}"
Sorry for the confusion
No problem, still does the same
Info: [files] WARNING: Unknown module "tolower" in string expansion "%{tolower:%{User-Name}}"
Wed Sep 19 11:59:48 2012 : Info: [files] expand: %{tolower:%{User-Name}} ->
- List info/subscribe/unsubscribe? See http://www.freeradius.org/** list/users.html <http://www.freeradius.org/list/users.html>
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Sent from my phone. Please excuse brevity and typos.
Gah, sorry everyone. This is my mobile device being oh-so-helpful and sending empty emails when I fat-finger the menu.
participants (5)
-
alan buxey -
Alan DeKok -
Fajar A. Nugraha -
Gregg Douglas -
Phil Mayers