Re: Authentication Problem with PEAP and openldap

2009-01-15 Thread Michael Poser
smbencrypt is distributed with the server. Use it to check the password hash. Ivan Kalik Kalik Informatika ISP The authentication is half finished. The hint with the smbencrypt showed that the stored nt passwords in our ldap directory was wrong. The hint with ldap.attrmap pointed to a wrong

Re: Authentication Problem with PEAP and openldap

2009-01-12 Thread Michael Poser
password 4183... in check items You want to map this to the NT-Password attribute. Alan DeKok. -- Michael Poser, HRZ - Abteilung Netze Tel.:069/798-28052 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Authentication Problem with PEAP and openldap

2009-01-09 Thread Michael Poser
Hello, native wired xp 802.1X client with PEAP (mschapv2) tries to authenticate via freeradius against openldap with an md4 encoded utf-16e password hash. The authentication fails. If we use the hash instead of the clear-text password with the xp client, the authentication works fine. There must

RE: Authentication Problem with PEAP and openldap

2009-01-09 Thread Michael Poser
Hello Thiabault, native wired xp 802.1X client with PEAP (mschapv2) tries to authenticate via freeradius against openldap with an md4 encoded utf-16e password hash. This is just not possible. PEAP (mschapv2) requires you can read the user password either as a cleartext password or as a

RE: User-Name - Reg Expr - auth-type accept

2005-08-17 Thread Michael Poser
- auth-type accept Michael Poser wrote: The regular expression match with the Mac-Address, but 4 lines behind it, the log says: auth: No authenticate method (Auth-Type) configuration found for the request: I am confused, in the users file is the statement Auth-Type := Accept,. What

User-Name - Reg Expr - auth-type accept

2005-08-16 Thread Michael Poser
Hello, an extraction from my users file --8-- DEFAULT User-Name =~ ^([0-9a-fA-F]){6}-([0-9a-fA-F]{6})$ Auth-Type := Accept, Reply-Message = Hallo Regulaerer Ausdruck `%{User-Name}` --8-- My suggestion is: Every Mac-Address has to authenticate. But in real life it doesn't work: