Hi Guys, i have a problem with 3.0.12 and User-Name. I send a request with domain name included in User-Name: radtest -t mschap "test\radius" radius localhost 1 testing123 On freeradius i see User-Name = "test\radius" in line 2. (0) Received Access-Request Id 61 from 127.0.0.1:34351 to 127.0.0.1:1812 length 142 (0) User-Name = "test\radius" (0) NAS-IP-Address = 10.100.254.174 (0) NAS-Port = 1 (0) Message-Authenticator = 0xdd90f7f9365aca2896632b1a531bb760 (0) Framed-Protocol = PPP (0) MS-CHAP-Challenge = 0xe7d0a3bb2ba11619 (0) MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000f16973c17df493cec36e7f24c5ed837697dbb69248fdb117 (0) # Executing section authorize from file /etc/freeradius/sites-enabled/default (0) authorize { (0) [preprocess] = ok (0) ntdomain: Checking for prefix before "\" (0) ntdomain: No '\' in User-Name = "test adius", looking up realm NULL (0) ntdomain: No such realm "NULL" ... But for ntdomain the User-Name is broken. The blackslash escape the "r" so i seed "test adius" instead "test\radius". I also tried to use split_username_nai but here the same problem. My problem is, that windows send every time a domain. Anybody have an idea to fix this bug? Greets Marco
On Feb 9, 2017, at 5:08 PM, Marco Scholl <mail@marco-scholl.de> wrote:
i have a problem with 3.0.12 and User-Name.
I send a request with domain name included in User-Name:
radtest -t mschap "test\radius" radius localhost 1 testing123
That's the problem. The shell is looking at the string "test\radius", and converting the \r to CR. You need to do: radtest -t mschap "test\\radius" radius localhost 1 testing123 Alan DeKok.
The shell is looking at the string "test\radius", and converting the \r to CR. You need to do: radtest -t mschap "test\\radius" radius localhost 1 testing123
Hi this idea i have, too. I have also tried radtest -t mschap "test\\radius" radius localhost 1 testing123 radtest -t mschap 'test\\radius' radius localhost 1 testing123 radtest -t mschap 'test\radius' radius localhost 1 testing123 And i have tried it with a windows pc who send test\radius as username, too. Every time i got the same result. (3) Received Access-Request Id 162 from 127.0.0.1:47616 to 127.0.0.1:1812 length 142 (3) User-Name = "test\radius" (3) NAS-IP-Address = 10.100.254.174 (3) NAS-Port = 1 (3) Message-Authenticator = 0x04cc54ee9ddacfcabef7363ab9594675 (3) Framed-Protocol = PPP (3) MS-CHAP-Challenge = 0x7cf4f181645b76e7 (3) MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000ded8d17072bccb4f4719a58862797da4bbb9791d54c51aaf (3) # Executing section authorize from file /etc/freeradius/sites-enabled/default (3) authorize { (3) [preprocess] = ok (3) ntdomain: Checking for prefix before "\" (3) ntdomain: No '\' in User-Name = "test adius", looking up realm NULL (3) ntdomain: No such realm "NULL" (3) [ntdomain] = noop greets marco
On 10/02/2017 07:28, Marco Scholl wrote:
this idea i have, too.
I have also tried
radtest -t mschap "test\\radius" radius localhost 1 testing123 radtest -t mschap 'test\\radius' radius localhost 1 testing123 radtest -t mschap 'test\radius' radius localhost 1 testing123
Ah, there's still not enough escaping: root@radtest:~# radtest -t mschap 'test\\radius' radius localhost 1 testing123 Sent Access-Request Id 15 from 0.0.0.0:60124 to 127.0.0.1:1812 length 136 User-Name = "test\radius" By this stage, your '\ \ r' has still become '\r' and radclient rakes this as CR. So it looks like there is another level of unescaping taking place inside radtest (which is a shell script) So you need *four* backslashes, which you can get in single quotes like this: root@radtest:~# radtest -t mschap 'test\\\\radius' radius localhost 1 testing123 Sent Access-Request Id 201 from 0.0.0.0:36290 to 127.0.0.1:1812 length 137 User-Name = "test\\radius" (Without quotes, or in double-quotes, you would need 8 backslashes!) Now you can see that radclient receives "test\\radius" which it should interpret as t e s t \ r a d i u s And at last, tcpdump confirms this: # tcpdump -i lo -nn -s0 -v -X udp port 1812 tcpdump: listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes 11:05:05.119847 IP (tos 0x0, ttl 64, id 19098, offset 0, flags [none], proto UDP (17), length 165) 127.0.0.1.53576 > 127.0.0.1.1812: RADIUS, length: 137 Access-Request (1), id: 0x06, Authenticator: e03656048448efdd3e6345a719fb218f *User-Name Attribute (1), length: 13, Value: test\radius* NAS-IP-Address Attribute (4), length: 6, Value: 127.0.1.1 NAS-Port Attribute (5), length: 6, Value: 1 Message-Authenticator Attribute (80), length: 18, Value: ..g..){.m...%,.) Vendor-Specific Attribute (26), length: 16, Value: Vendor: Microsoft (311) Vendor Attribute: 11, Length: 8, Value: .......f Vendor-Specific Attribute (26), length: 58, Value: Vendor: Microsoft (311) Vendor Attribute: 1, Length: 50, Value: ..........................>.=L.:z.+....c.....}..@ 0x0000: 4500 00a5 4a9a 0000 4011 31ac 7f00 0001 E...J...@.1..... 0x0010: 7f00 0001 d148 0714 0091 fea4 0106 0089 .....H.......... 0x0020: e036 5604 8448 efdd 3e63 45a7 19fb 218f .6V..H..>cE...!. 0x0030: 010d *7465 7374 5c72 6164 6975 73*04 067f *..test\radius...* 0x0040: 0001 0105 0600 0000 0150 1292 8467 0dbf .........P...g.. 0x0050: 297b bf6d 0716 8625 2c82 291a 1000 0001 ){.m...%,.)..... 0x0060: 370b 0afe 00b0 adc9 0da8 661a 3a00 0001 7.........f.:... 0x0070: 3701 3400 0100 0000 0000 0000 0000 0000 7.4............. 0x0080: 0000 0000 0000 0000 0000 0000 003e bc3d .............>.= 0x0090: 4cf6 3a7a a42b 8a96 8ed0 6312 84b4 c7d9 L.:z.+....c..... 0x00a0: 7dba 0d7f 40 }...@ Regards, Brian.
On 09/02/2017 22:14, Alan DeKok wrote:
On Feb 9, 2017, at 5:08 PM, Marco Scholl<mail@marco-scholl.de> wrote:
i have a problem with 3.0.12 and User-Name.
I send a request with domain name included in User-Name:
radtest -t mschap "test\radius" radius localhost 1 testing123 That's the problem.
The shell is looking at the string "test\radius", and converting the \r to CR.
You need to do:
radtest -t mschap "test\\radius" radius localhost 1 testing123 I don't think it's the shell which is doing this; bash doesn't convert \r even in double quotes.
$ echo "test\radius" test\radius However, tcpdump *does* show that by the time the RADIUS packet has been sent, it has been turned into CR: # radtest -t mschap "test\radius" radius localhost 1 testing123 Sent Access-Request Id 155 from 0.0.0.0:40801 to 127.0.0.1:1812 length 136 User-Name = "test\radius" ... 0x0030: 010c 7465 7374 0d61 6469 7573 0406 7f00 ..test.adius.... So I think what's happening is that radtest is sending User-Name = "test\radius" to radclient on stdin, and then radclient is converting \r to CR. Ideally radtest would escape \ to \\. Since it doesn't, you need to pass two real backslashes to radtest. You can do this using either: radtest -t mschap "test\\\\radius" ... # with double-quotes radtest -t mschap 'test\\radius' ... # with single-quotes Both of these will generate the string t e s t \ \ r a d i u s Regards, Brian.
participants (3)
-
Alan DeKok -
Brian Candler -
Marco Scholl