Hm,
I am really stuck :-(
Let me try to explain what I inted to do:
1.) PAP is just the clear-text password???
-> I thought pap is hashing the password with a challenge (MD-5). This
means the client is then transmitting this Hash to the radius, which
might hold the password in cleartext or as a MD-5-Hash as well. Either
comparing the Hashes or the passwords.
So I want to the server to hold a crypted Password (MD-5) for PAP, but
retrieving that from the ldap server.
2.) I do not want to do any binding to the ldap for authentication!
I just want to retrieve the information from the ldap, but then
authenticate only by the radius itself!!
3.) For authentication I want to provide PAP, CHAP, and PEAP+TLS using
MsCHAPv2.
How can I do that? If use the radiusd.conf as it comes the radius
wants to use ldap for authentication.
If I use the ldap-Authentication-module with the pap-instruction
instead of ldap:
authenticate {
...
ldap {
pap
}
...
}
it says "Login incorrect (rlm_pap: CRYPT password check failed)",
but the password is correct, but not encrypted at the radius!!
-> CHAP works fine!
If I provide the encrypted password at the radius, PAP works fine (still
trying ldap (i.e. PAP)) but CHAP fails, because the password do not
match, of course not it is encrypted!!
So what can I do??
I have both the encrypted and the clear-text password, but I can not
tell the radius what to use when?
Do I need a specific mapping in te ldap.attrmap? I map against the
radius Password attribute, because this seems to be overruling everything!?!
Thanks
Florian
Alan DeKok wrote:
Florian Prester <[EMAIL PROTECTED]> wrote:
Why? Just use the clear-text password to do all of the
authentication. You're making work for yourself without any gain.
But how can I do PAP with a clear-text password?
Are you joking? PAP *is* just the clear-text password!
You're listing EAP in that group. DON'T.
Sorry, didn`t wanna do that!
But I want to achieve that the authentication is first trying CHAP, then
PAP and so on.
Then use the default configuration. IT WORKS.
So how can I tell the radius to take the proper authentication and
therefore a specific password using the LDAP profile?
You don't. The default configuration does this.
In LDAP the clear-text password is given as well as the crypt one?
Use the clear-text password. It's all you need to get everything to
work.
I am sorry, if I am annoying you, but I am kind of confused and do not
know what to do anymore.
If you don't know what the configuration file does, make as FEW
changes as possible.
All you need to do is take the default radiusd.conf, uncomment the
references to "ldap", and configure the "ldap" module to point to your
LDAP server.
What you did wrong was to make massive changes to the configuration
file without really understanding what the changes meant.
Alan DeKok.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
--
--------------------------------------------------------------
Dipl. Inf. Florian Prester
Network Administration
Regionales RechenZentrum Erlangen
Universitaet Erlangen-Nuernberg
Germany
Tel.: +499131 8527813
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
