Freeradius 2.1.6: Store Cisco device "enable" password in Postgresql DB
Hey guys, This should be a quick one. When I "enable" on a Cisco device, it sends a request with username "$enab15$". rad_recv: Access-Request packet from host 172.17.254.100 port 1645, id=92, length=84 NAS-IP-Address = 172.17.254.100 NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "$enab15$" Calling-Station-Id = "172.17.1.1" User-Password = "password" Service-Type = Administrative-User I used to store the username and password in the "users" file and it was working fine: $enab15$ Cleartext-Password := "password" Now I am trying to move this user from the file to the postgresql DB and my "radcheck" table looks like: radius=# select * from radcheck; id | username | attribute | op | value ----+----------+--------------------+----+----------- 1 | $enab15$ | Cleartext-Password | := | password And it doesn't work. Then I am checking the debug and I found that the "$" in the username was interpreted to something like "=24": [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '=24enab15=24' ORDER BY id Then I changed the username to this "=24enab15=24" and now it works. I am just curious how freeradius or %{SQL-User-Name} treats special characters in "username"... Is there a way to treat them AS-IS? Thank you! Difan Zhao, M.Eng Network Engineer Guest-Tek Interactive Entertainment Inc. www.guest-tek.com Email: difan.zhao@guest-tek.com Office: +1 (403) 509 1010 ext 3048 Cell: +1 (403) 689 7514
Difan Zhao wrote:
And it doesn't work. Then I am checking the debug and I found that the "$" in the username was interpreted to something like "=24":
Read raddb/sql/postgresql/dialup.conf, and look for "safe-characters" Alan DeKok.
Thank you very much Alan! I added the "$" in the safe-characters and it works great now. However I also added "\" but it doesn't seem to work... My FreeRadius is also setup to handle PEAP for Windows XP PCs and they use "domain\username" format. In debug I see: [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'GTCORP=5Cdzhao' ORDER BY id As you can see the username "GTCORP\dzhao" becomes "GTCORP=5Cdzhao"... I do have "\" in the safe-character list: safe-characters = "\$@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" Any ideas? Thank you! Difan Zhao, M.Eng Network Engineer difan.zhao@guest-tek.com www.guest-tek.com Office: 403-509-1010 ext 3048 Cell: 403-689-7514 -----Original Message----- From: freeradius-users-bounces+difan.zhao=guest-tek.com@lists.freeradius.org [mailto:freeradius-users-bounces+difan.zhao=guest-tek.com@lists.freeradi us.org] On Behalf Of Alan DeKok Sent: Wednesday, May 05, 2010 1:53 AM To: FreeRadius users mailing list Subject: Re: Freeradius 2.1.6: Store Cisco device "enable" password inPostgresql DB Difan Zhao wrote:
And it doesn't work. Then I am checking the debug and I found that the "$" in the username was interpreted to something like "=24":
Read raddb/sql/postgresql/dialup.conf, and look for "safe-characters" Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Sorry guys... I need to change my question a little bit! Please ignore my last emails. I am using my Freeradius 2.1.6 to do PEAP for Windows XP clients. The usernames are in format '<Domain_name>\<username>' I am using postgresql and my "safe-characters" in the dialup.conf is set to: safe-characters = "\\$@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" My radcheck table looks like: id | username | attribute | op | value 4 | GTCORP\dzhao | Auth-Type | = | ntlm_auth When I try to authenticate, in the debug, I see this: [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'GTCORP\dzhao' ORDER BY id However this query returns nothing from the postgresql DB because the DB treats the "\" as an escape character. In order to test I added another entry in the table: 11 | GTCORPdzhao | Auth-Type | = | ntlm_auth And the query worked and found it. I also tried a query on the DB and this one found the orginal entry successfully... select * from radcheck where username = 'GTCORP\\dzhao' I am wondering if there is a setting to automatically add another "\" in the %{SQL-User-Name} if there is already a "\" in it?? Thanks! Difan Zhao, M.Eng Network Engineer difan.zhao@guest-tek.com www.guest-tek.com Office: 403-509-1010 ext 3048 Cell: 403-689-7514 -----Original Message----- From: freeradius-users-bounces+difan.zhao=guest-tek.com@lists.freeradius.org [mailto:freeradius-users-bounces+difan.zhao=guest-tek.com@lists.freeradi us.org] On Behalf Of Difan Zhao Sent: Wednesday, May 05, 2010 12:21 PM To: FreeRadius users mailing list Subject: RE: Freeradius 2.1.6: Store Cisco device "enable" passwordinPostgresql DB Thank you very much Alan! I added the "$" in the safe-characters and it works great now. However I also added "\" but it doesn't seem to work... My FreeRadius is also setup to handle PEAP for Windows XP PCs and they use "domain\username" format. In debug I see: [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'GTCORP=5Cdzhao' ORDER BY id As you can see the username "GTCORP\dzhao" becomes "GTCORP=5Cdzhao"... I do have "\" in the safe-character list: safe-characters = "\$@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" Any ideas? Thank you! Difan Zhao, M.Eng Network Engineer difan.zhao@guest-tek.com www.guest-tek.com Office: 403-509-1010 ext 3048 Cell: 403-689-7514 -----Original Message----- From: freeradius-users-bounces+difan.zhao=guest-tek.com@lists.freeradius.org [mailto:freeradius-users-bounces+difan.zhao=guest-tek.com@lists.freeradi us.org] On Behalf Of Alan DeKok Sent: Wednesday, May 05, 2010 1:53 AM To: FreeRadius users mailing list Subject: Re: Freeradius 2.1.6: Store Cisco device "enable" password inPostgresql DB Difan Zhao wrote:
And it doesn't work. Then I am checking the debug and I found that the "$" in the username was interpreted to something like "=24":
Read raddb/sql/postgresql/dialup.conf, and look for "safe-characters" Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Good morning guys! I asked a question earlier but haven't heard back a reply yet... I guess I am not supposed to include the question in the answer of another question lol. So here is the question again: I am using my Freeradius 2.1.6 to do PEAP for Windows XP clients. The usernames are in format '<Domain_name>\<username>' I am using postgresql and my "safe-characters" in the dialup.conf is set to: safe-characters = "\\$@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" My radcheck table looks like: id | username | attribute | op | value 4 | GTCORP\dzhao | Auth-Type | = | ntlm_auth When I try to authenticate, in the debug, I see this: [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'GTCORP\dzhao' ORDER BY id However this query returns nothing from the postgresql DB because the DB treats the "\" as an escape character. In order to test I added another entry in the table: 11 | GTCORPdzhao | Auth-Type | = | ntlm_auth And the query worked and found it. I also tried the following query in PostSQL and it found the orginal entry successfully... select * from radcheck where username = 'GTCORP\\dzhao' I am wondering if there is a setting to automatically add another "\" in the %{SQL-User-Name} if there is already a "\" in it?? Thanks! Difan Zhao, M.Eng Network Engineer difan.zhao@guest-tek.com www.guest-tek.com Office: 403-509-1010 ext 3048 Cell: 403-689-7514
Hi,
I am using my Freeradius 2.1.6 to do PEAP for Windows XP clients. The usernames are in format '<Domain_name>\<username>'
I am using postgresql and my "safe-characters" in the dialup.conf is set to:
My radcheck table looks like: id | username | attribute | op | value 4 | GTCORP\dzhao | Auth-Type | = | ntlm_auth
do you care for the windows DOMAiN? you could use the realm/suffix modules and ensure that SQL-user-Name is set correctly. alan
participants (3)
-
Alan Buxey -
Alan DeKok -
Difan Zhao