Password == bla%1 (shooting into my foot)

2005-07-14 Thread Stefan Nehlsen 
hello,

trying to get freeradius working (again) I figured out a strange behaviour:

Authentication with CHAP as my testaccount failed until I tried it with
PAP first. After one (or more) successful authentifications with PAP CHAP works.

It took some time until I figured out that my password contained a % and
the daemon tried some variable substitution.

don't do this!

How do I escape special chars in the users file and what characters are
special?

Stefan
-- 
Stefan Nehlsen | ParlaNet Administration | [EMAIL PROTECTED] | +49 431 988-1260


pgpVMEZS6FDti.pgp
Description: PGP signature
- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: Password == bla%1 (shooting into my foot)

2005-07-14 Thread Guy Davies 
Hi Stefan,

I also saw this.  The escape character is \.

Special characters I would think of are !, #, *, ?, ^, $, , % and
(obviously) \.  There may well be others.

Rgds,

Guy

 -Original Message-
 From: [EMAIL PROTECTED] 
 [mailto:[EMAIL PROTECTED] On 
 Behalf Of Stefan Nehlsen
 Sent: 14 July 2005 15:45
 To: freeradius-users@lists.freeradius.org
 Subject: Password == bla%1 (shooting into my foot)
 
 
 hello,
 
 trying to get freeradius working (again) I figured out a 
 strange behaviour:
 
 Authentication with CHAP as my testaccount failed until I 
 tried it with PAP first. After one (or more) successful 
 authentifications with PAP CHAP works.
 
 It took some time until I figured out that my password 
 contained a % and the daemon tried some variable substitution.
 
 don't do this!
 
 How do I escape special chars in the users file and what 
 characters are special?
 
 Stefan
 -- 
 Stefan Nehlsen | ParlaNet Administration | [EMAIL PROTECTED] | 
 +49 431 988-1260
 

This e-mail is private and may be confidential and is for the intended 
recipient only.  If misdirected, please notify us by telephone and confirm that 
it has been deleted from your system and any copies destroyed.  If you are not 
the intended recipient you are strictly prohibited from using, printing, 
copying, distributing or disseminating this e-mail or any information contained 
in it.  We use reasonable endeavours to virus scan all e-mails leaving the 
Company but no warranty is given that this e-mail and any attachments are virus 
free.  You should undertake your own virus checking.  The right to monitor 
e-mail communications through our network is reserved by us. 



- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Password == bla%1 (shooting into my foot)

2005-07-14 Thread Alan DeKok 
Stefan Nehlsen [EMAIL PROTECTED] wrote:
 It took some time until I figured out that my password contained a % and
 the daemon tried some variable substitution.
 
 don't do this!
 
 How do I escape special chars in the users file and what characters are
 special?

  Use '\'.  And for variable substitution, the only real magic
character is %.  If you put quotes into a password, you'll have to
escape it, too.  But the rest of the characters that are usually magic
shell characters should be OK.

  Alan DeKok.

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html