Hi, We've started to look at SoH with the intention to implement it for the new academic session in September, but are having an issue. The server is setup using the example soh-server, but find that the condition in the example (below) isn't being satisfied when a client with no AV returns it's SoH status. (SoH Reply below) It appears after some trial that only the first of the "SoH-MS-Windows-Health-Status =" attributes is considered, if I manipulate the condition to check the firewall status which is returned first it works. Is this a bug or something I've done wrong? Example condition... if (SoH-MS-Windows-Health-Status =~ /antivirus (warn|error) /) { SoH Status Reply... SoH-MS-Windows-Health-Status = "firewall ok snoozed=0 microsoft=1 up2date=1 enabled=0" SoH-MS-Windows-Health-Status = "antivirus error not-installed" SoH-MS-Windows-Health-Status = "antispyware ok snoozed=0 microsoft=1 up2date=1 enabled=1" SoH-MS-Windows-Health-Status = "auto-updates ok action=download" SoH-MS-Windows-Health-Status = "security-updates ok all-installed" Separate to this, an observation from the SoH reply after I'd installed Microsoft Security Essentials; the two hashed lines below show that Microsoft Security Essentials is classed as being non-Microsoft. I presume this the NAP service on the client making this decision, not FreeRADIUS? SoH-MS-Windows-Health-Status = "firewall ok snoozed=0 microsoft=1 up2date=1 enabled=1" ## SoH-MS-Windows-Health-Status = "antivirus ok snoozed=0 microsoft=0 up2date=1 enabled=1" (MSE) ## SoH-MS-Windows-Health-Status = "antispyware ok snoozed=0 microsoft=0 up2date=1 enabled=1" (MSE) SoH-MS-Windows-Health-Status = "antispyware ok snoozed=0 microsoft=1 up2date=1 enabled=0" (Windows Defender) SoH-MS-Windows-Health-Status = "auto-updates ok action=download" SoH-MS-Windows-Health-Status = "security-updates warn some-missing" Thanks, Jezz. Jezz Palmer Information Services and Systems Swansea University Singleton Park Swansea SA2 8PP J.D.F.Palmer@swan.ac.uk
On 14/07/11 14:30, Palmer J.D.F. wrote:
Hi,
We've started to look at SoH with the intention to implement it for the new academic session in September, but are having an issue.
Cool (I wrote it)
The server is setup using the example soh-server, but find that the condition in the example (below) isn't being satisfied when a client with no AV returns it's SoH status. (SoH Reply below) It appears after some trial that only the first of the "SoH-MS-Windows-Health-Status =" attributes is considered, if I manipulate the condition to check the firewall status which is returned first it works. Is this a bug or something I've done wrong?
Hmm. I thought that the =~ regexp operator tried all attributes on the left-hand side; that is, I thought it looped through until it got first-match. If it doesn't, then the idea of squeezing all the SoH data into a multiple instances of a single text attribute is going to need revisiting (or the "foreach" unlang operator will need backporting!) Can you post a full debug?
Example condition... if (SoH-MS-Windows-Health-Status =~ /antivirus (warn|error) /) {
SoH Status Reply...
SoH-MS-Windows-Health-Status = "firewall ok snoozed=0 microsoft=1 up2date=1 enabled=0" SoH-MS-Windows-Health-Status = "antivirus error not-installed" SoH-MS-Windows-Health-Status = "antispyware ok snoozed=0 microsoft=1 up2date=1 enabled=1" SoH-MS-Windows-Health-Status = "auto-updates ok action=download" SoH-MS-Windows-Health-Status = "security-updates ok all-installed"
Separate to this, an observation from the SoH reply after I'd installed Microsoft Security Essentials; the two hashed lines below show that Microsoft Security Essentials is classed as being non-Microsoft. I presume this the NAP service on the client making this decision, not FreeRADIUS?
Correct. The SoH code just parses the horrible binary payload that the client sends. It's not clear what the "microsoft" bit in that payload means semantically; I suspect it means "built-in windows component"
Example condition... if (SoH-MS-Windows-Health-Status =~ /antivirus (warn|error) /) {
I'm not sure alternate submatches are supported. Could you try: if ((SoH-MS-Windows-Health-Status =~ /antivirus warn/) || (SoH-MS-Windows-Health-Status =~ /antivirus error/)) Just to make sure... -Arran Arran Cudbard-Bell a.cudbardb@freeradius.org RADIUS - Half the complexity of Diameter
On Jul 14, 2011, at 4:39 PM, Phil Mayers wrote:
On 14/07/11 15:31, Arran Cudbard-Bell wrote:
Example condition... if (SoH-MS-Windows-Health-Status =~ /antivirus (warn|error) /) {
I'm not sure alternate submatches are supported.
I'm fairly sure they are; we use them locally.
You're right, they work fine now. Back when I was writing the JANET eduroam case study they used to cause the server to segfault... -Arran Arran Cudbard-Bell a.cudbardb@freeradius.org RADIUS - Half the complexity of Diameter
On 14/07/11 15:24, Phil Mayers wrote:
I thought that the =~ regexp operator tried all attributes on the left-hand side; that is, I thought it looped through until it got first-match.
If it doesn't, then the idea of squeezing all the SoH data into a multiple instances of a single text attribute is going to need revisiting (or the "foreach" unlang operator will need backporting!)
Damn. You're right. It just looks at the first attribute. Erm.... Hmm. That's a problem. It makes checking the attributes really painful. Blast. Sorry about that. Maybe try this, which is a horrible hack: if ("%{SoH-MS-Windows-Health-Status[*]}" =~ /antivirus (warn|error)/) { ... }
On Jul 14, 2011, at 4:44 PM, Phil Mayers wrote:
On 14/07/11 15:24, Phil Mayers wrote:
I thought that the =~ regexp operator tried all attributes on the left-hand side; that is, I thought it looped through until it got first-match.
If it doesn't, then the idea of squeezing all the SoH data into a multiple instances of a single text attribute is going to need revisiting (or the "foreach" unlang operator will need backporting!)
Damn. You're right. It just looks at the first attribute.
Erm.... Hmm. That's a problem. It makes checking the attributes really painful. Blast. Sorry about that.
Maybe try this, which is a horrible hack:
if ("%{SoH-MS-Windows-Health-Status[*]}" =~ /s )/) { ... }
Or just checkout 3.x, then you can use: foreach SoH-MS-Windows-Health-Status { if("%{Foreach-Variable-0}" =~ /^antivirus (warn|error/i){ .... do stuff here break } } -Arran Arran Cudbard-Bell a.cudbardb@freeradius.org RADIUS - Half the complexity of Diameter
Thanks Phil & Arran, I keep starting reply emails and another arrives before I get to send them. I've tried array hack, that fails even with 'firewall' as the condition. if ("%{SoH-MS-Windows-Health-Status[*]}" =~ /firewall/), where as if (SoH-MS-Windows-Health-Status =~ /firewall/) is satisfied. Cheers, Jezz.
-----Original Message----- From: freeradius-users- bounces+j.d.f.palmer=swansea.ac.uk@lists.freeradius.org [mailto:freeradius-users- bounces+j.d.f.palmer=swansea.ac.uk@lists.freeradius.org] On Behalf Of Phil Mayers Sent: 14 July 2011 15:45 To: freeradius-users@lists.freeradius.org Subject: Re: SoH - FR 2.1.11
On 14/07/11 15:24, Phil Mayers wrote:
I thought that the =~ regexp operator tried all attributes on the left-hand side; that is, I thought it looped through until it got first-match.
If it doesn't, then the idea of squeezing all the SoH data into a multiple instances of a single text attribute is going to need revisiting (or the "foreach" unlang operator will need backporting!)
Damn. You're right. It just looks at the first attribute.
Erm.... Hmm. That's a problem. It makes checking the attributes really painful. Blast. Sorry about that.
Maybe try this, which is a horrible hack:
if ("%{SoH-MS-Windows-Health-Status[*]}" =~ /antivirus (warn|error)/) { ... } - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 14/07/11 15:59, Palmer J.D.F. wrote:
Thanks Phil& Arran,
I keep starting reply emails and another arrives before I get to send them.
Hehe.
I've tried array hack, that fails even with 'firewall' as the condition. if ("%{SoH-MS-Windows-Health-Status[*]}" =~ /firewall/), where as if (SoH-MS-Windows-Health-Status =~ /firewall/) is satisfied.
Really? Hmm, that's odd. I'll take a look.
On 14/07/11 16:14, Phil Mayers wrote:
On 14/07/11 15:59, Palmer J.D.F. wrote:
Thanks Phil& Arran,
I keep starting reply emails and another arrives before I get to send them.
Hehe.
I've tried array hack, that fails even with 'firewall' as the condition. if ("%{SoH-MS-Windows-Health-Status[*]}" =~ /firewall/), where as if (SoH-MS-Windows-Health-Status =~ /firewall/) is satisfied.
Really? Hmm, that's odd. I'll take a look.
I can't reproduce this; can you post a full debug of it failing with the array hack?
participants (3)
-
Arran Cudbard-Bell -
Palmer J.D.F. -
Phil Mayers