Case sensitivity of built-in RADIUS server

juibar · Tue Jun 20, 2006 12:39 am

It looks to me that the RADIUS server is case-sensitive for both username and password, right?

Is there a way of setting it up such that ONLY passwords are case-sensitive?

Thanks,
juibar

wildbill442 · Tue Jun 20, 2006 5:55 am

Good question.. I'd like to know as well

Mitak · Tue Jun 20, 2006 8:10 am

For freeradius:

My /etc/freeradius/radiusd.conf

#  Whether or not we want to treat "user" the same
#  as "USER", or "User".  Some systems have problems
#  with case sensitivity, so this should be set to
#  'no' to enable the comparisons of the key attribute
#  to be case insensitive.


                case_sensitive = yes

/etc/freeradius/sql.conf:

# Use these for case sensitive usernames.
authorize_check_query = "SELECT id, UserName, Attribute,               Value, op \
FROM ${authcheck_table} \
WHERE Username = BINARY '%{SQL-User-Name}' \
ORDER BY id"
authorize_reply_query = "SELECT id, UserName, Attribute, Value, op \
FROM ${authreply_table} \
WHERE Username = BINARY '%{SQL-User-Name}' \
ORDER BY id"

savage · Tue Jun 20, 2006 9:01 am

You can also ammend your SQL queries to lower / upper what you want, you can also trim to remove leading/ trailing white spaces, etc etc etc

I normally use WHERE blah = TRIM(LOWER('value')) which removes all leading/trailing white spaces, and moves the value to lower case - not that SQL is by default case sensitive.

Tue Jun 20, 2006 10:38 am

we have added that to the usermanager todo list, you will be able to specify that for each router in the usermanger configuration.

arturportella · Fri Feb 03, 2017 2:24 pm

Well, I'm trying to make RouterOS accept Radius commands as "non case sensitive". My freeradius accepts requests from my users logins: Potato - PoTaTo - POTATO - potatO, etc and Mikrotik put them online with no clues... But when sending a command from FreeRadius to mikrotik to drop user "POTATO", it only works if my user have logged in as POTATO, otherwise it will not drop the user and my Mikrotik Log prints an error in memory saying that "hotspot, error, info, debug - Radius disconnect request for unknown ip X.X.X.X", even if my user is logged using PPPoE. But If I send the command using the "uppercase" credentials, everything works fine. Is there anything that I can do to fix this in a way that I don't need to change my user / radius configuration? I might think that have something in RouterOS configuration that accept non case sensitive radius or a script to put global parameters on login to "change" my user PPP login input.

I already found a way to fix my "lowercase" from users at HOTSPOT just coding the login.htm to uppercase any name input, doesn't matter if my customer put in lower/upper/mixed case. But I still figuring how to find a solution to "mixed cases" in PPPoE.

Thank you in advance!

savage · Fri Feb 03, 2017 2:29 pm

Lower case the username in an authetnication packet, but leave it as is in an accounting packet?

Surely, you are using ACCOUNTING data to send PODs, not AUTHENTICATION data?

arturportella · Fri Feb 03, 2017 5:39 pm

Lower case the username in an authetnication packet, but leave it as is in an accounting packet?

Surely, you are using ACCOUNTING data to send PODs, not AUTHENTICATION data?

The company I work today have a control software that uses Accounting data to send the POD to mikrotik. They don't want to change the actual software to something that allow to drop user from Authentication data. Actually, yes, we have an "online customers" list in this software that gather information from ACK login at Radius on MK and register it, that I can drop anyone (Diconnect) without any issues at all. The problem is that we have about 4K customers using mixed case mode in their login forms (either Hotspot/PPPoE). The automatic proccess of blocking an access or releasing an access is not working properly. Well, almost now is only not working for PPP users, as I told before they are obligated to use UPPERCASE in hotspot page. But this doesn't occur in PPPoE.
At least you got my point, but why MK don't allow a function to drop a user, ignoring the way it was typed in "login" at PPP session but just comparing upper+lower case?

EDIT 1 = The accounting infos are located in an remote DB. The control software uses raddb + mysql to do the control, keeping users and passwords inside this DB.

Case sensitivity of built-in RADIUS server

Case sensitivity of built-in RADIUS server

radiusd.conf

Re: Case sensitivity of built-in RADIUS server

Re: Case sensitivity of built-in RADIUS server

Re: Case sensitivity of built-in RADIUS server

Who is online