<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
<br><div><div>Am 11.06.2008 um 14:48 schrieb Matt Ashfield:</div><br class="Apple-interchange-newline"><blockquote type="cite"> <!-- Converted from text/rtf format --><p dir="LTR"><span lang="en-us"></span><span lang="en-us"></span><span lang="en-us"><font face="Calibri">Hi</font></span></p><p dir="LTR"><span lang="en-us"></span><span lang="en-us"></span><span lang="en-us"><font face="Calibri">I</font></span><span lang="en-us"></span><span lang="en-us"></span><span lang="en-us"><font face="Calibri">’</font></span><span lang="en-us"></span><span lang="en-us"></span><span lang="en-us"><font face="Calibri">m still trying to get this working. I</font></span><span lang="en-us"></span><span lang="en-us"></span><span lang="en-us"><font face="Calibri">’</font></span><span lang="en-us"></span><span lang="en-us"></span><span lang="en-us"><font face="Calibri">m using an XP</font></span><span lang="en-us"></span><span lang="en-us"></span><span lang="en-us"> <font face="Calibri">machine</font></span><span lang="en-us"></span><span lang="en-us"></span><span lang="en-us"><font face="Calibri"> plugged into an edge switch acting as a NAS. I</font></span><span lang="en-us"></span><span lang="en-us"></span><span lang="en-us"><font face="Calibri">’</font></span><span lang="en-us"></span><span lang="en-us"></span><span lang="en-us"><font face="Calibri">m using the PEAP/MSCHAP in XP to authenticate against an LDAP directory. In that directory, we have created an attribute called ntPasssword</font></span><span lang="en-us"></span><span lang="en-us"></span><span lang="en-us"> <font face="Calibri">which I have populated with</font></span><span lang="en-us"></span><span lang="en-us"></span><span lang="en-us"> <font face="Calibri">the</font></span><span lang="en-us"></span><span lang="en-us"></span><span lang="en-us"><font face="Calibri"> word</font></span><span lang="en-us"></span><span lang="en-us"></span><span lang="en-us"> <font face="Calibri">‘</font></span><span lang="en-us"></span><span lang="en-us"></span><span lang="en-us"><font face="Calibri">password</font></span><span lang="en-us"></span><span lang="en-us"></span><span lang="en-us"><font face="Calibri">’</font></span><span lang="en-us"></span><span lang="en-us"></span><span lang="en-us"><font face="Calibri"> (create, I know!). Below is what</font></span><span lang="en-us"></span><span lang="en-us"></span><span lang="en-us"> <font face="Calibri">I</font></span><span lang="en-us"></span><span lang="en-us"></span><span lang="en-us"><font face="Calibri"> get when I run in debug mode.</font></span></p></blockquote><div><br></div><div>You have coded "Password" in UTF-16LE and applied the MD4 hash on it, before putting it in "ntPassword", haven't you?</div><div><br></div>Have a nice day!<br><blockquote type="cite"><p dir="LTR"><span lang="en-us"></span><span lang="en-us"></span><span lang="en-us"></span></p><p dir="LTR"><span lang="en-us"><font face="Calibri">In ldap.attrmap I have the line:</font></span></p><p dir="LTR"><span lang="en-us"></span><span lang="en-us"></span><span lang="en-us"><font face="Calibri">checkItem NT-Password ntPassword</font></span><span lang="en-us"></span><span lang="en-us"></span><span lang="en-us"></span></p><p dir="LTR"><span lang="en-us"><font face="Calibri">in</font></span><span lang="en-us"></span><span lang="en-us"></span><span lang="en-us"> <font face="Calibri">radius</font></span><span lang="en-us"></span><span lang="en-us"></span><span lang="en-us"><font face="Calibri">d.conf</font></span><span lang="en-us"></span><span lang="en-us"></span><span lang="en-us"> <font face="Calibri">in my ldap declaration,</font></span><span lang="en-us"></span><span lang="en-us"></span><span lang="en-us"> <font face="Calibri">I have:</font></span></p><p dir="LTR"><span lang="en-us"></span><span lang="en-us"></span><span lang="en-us"><font face="Calibri">password_attribute = ntPassword</font></span><span lang="en-us"></span><span lang="en-us"></span><span lang="en-us"><font face="Calibri"> </font></span></p><p dir="LTR"><span lang="en-us"><font face="Calibri">I can</font></span><span lang="en-us"></span><span lang="en-us"></span><span lang="en-us"><font face="Calibri">’</font></span><span lang="en-us"></span><span lang="en-us"></span><span lang="en-us"><font face="Calibri">t quite figure out what</font></span><span lang="en-us"></span><span lang="en-us"></span><span lang="en-us"><font face="Calibri">’</font></span><span lang="en-us"></span><span lang="en-us"></span><span lang="en-us"><font face="Calibri">s going on below. Looks to</font></span><span lang="en-us"></span><span lang="en-us"></span><span lang="en-us"> <font face="Calibri">me like</font></span><span lang="en-us"></span><span lang="en-us"></span><span lang="en-us"><font face="Calibri"> the passwords are not matching. Any advice is appreciated.</font></span></p><p dir="LTR"><span lang="en-us"><font face="Calibri">Thanks</font></span><span lang="en-us"></span><span lang="en-us"></span><span lang="en-us"></span></p><div><br></div></blockquote><br><div>[...]</div><br><blockquote type="cite"><div><span lang="en-us"></span></div><p dir="LTR"><span lang="en-us"></span><span lang="en-us"><font face="Consolas">Matt </font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas"><a href="mailto:mda@unb.ca">mda@unb.ca</a></font></span></p><div><span lang="en-us"></span><br class="khtml-block-placeholder"></div><p dir="LTR"><span lang="en-us"><font face="Consolas">-----Original Message-----<br> From: freeradius-users-bounces+mda=<a href="mailto:unb.ca@lists.freeradius.org">unb.ca@lists.freeradius.org</a> [<a href="mailto:freeradius-users-bounces+mda=unb.ca@lists.freeradius.org">mailto:freeradius-users-bounces+mda=unb.ca@lists.freeradius.org</a>] On Behalf Of Ivan Kalik<br> Sent: Tuesday, June 10, 2008 11:21 AM<br> To: <a href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a><br> Subject: RE: FR and PEAP question</font></span><span lang="en-us"></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">eapol_test from wpa_supplicant</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">JRadius Simulator</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">Ivan Kalik</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">Kalik Informatika ISP</font></span></p> <br><p dir="LTR"><span lang="en-us"><font face="Consolas">Dana 10/6/2008, "Matt Ashfield" <<a href="mailto:mda@unb.ca">mda@unb.ca</a>> piše:</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>I'd like to test this with PEAP/MSCHAP requests if possible. Is there a</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>howto? Clearly I'm down the wrong path here.</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>Matt </font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">><a href="mailto:mda@unb.ca">mda@unb.ca</a></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>-----Original Message-----</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>From: freeradius-users-bounces+mda=<a href="mailto:unb.ca@lists.freeradius.org">unb.ca@lists.freeradius.org</a></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>[<a href="mailto:freeradius-users-bounces+mda=unb.ca@lists.freeradius.org">mailto:freeradius-users-bounces+mda=unb.ca@lists.freeradius.org</a>] On Behalf</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>Of Ivan Kalik</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>Sent: Tuesday, June 10, 2008 11:02 AM</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>To: <a href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>Subject: RE: FR and PEAP question</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>FreeRADIUS-Proxied-To == 127.0.0.1 will match only for eap requests. You</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>can't test for it with pap requests (radtest).</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>Ivan Kalik</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>Kalik Informatika ISP</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>Dana 10/6/2008, "Matt Ashfield" <<a href="mailto:mda@unb.ca">mda@unb.ca</a>> piše:</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>I thought it would get referenced because in my users file I have:</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Huntgroup-Name == UNBFWSS,</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>unbldap-Ldap-Group == staff, Autz-Type := Ldap1</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>> User-Name=`%{User-Name}`,</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>> Tunnel-Private-Group-Id=staff,</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>> Tunnel-Type=VLAN,</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>> Fall-Through = no</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>And in huntgroups I have this. Although I am unsure if this is correct.</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>UNBFWSS NAS-IP-Address == 127.0.0.1</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>Matt</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>><a href="mailto:mda@unb.ca">mda@unb.ca</a></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>-----Original Message-----</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>From: freeradius-users-bounces+mda=<a href="mailto:unb.ca@lists.freeradius.org">unb.ca@lists.freeradius.org</a></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>[<a href="mailto:freeradius-users-bounces+mda=unb.ca@lists.freeradius.org">mailto:freeradius-users-bounces+mda=unb.ca@lists.freeradius.org</a>] On Behalf</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>Of Ivan Kalik</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>Sent: Tuesday, June 10, 2008 10:36 AM</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>To: <a href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>Subject: RE: FR and PEAP question</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>>The password that is being supplied by radtest is in plain-text, should I</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>be</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>>supplying it in ntPassword-encrypted format?</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>No.</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>>It looks to me like I have something wrong with my authenticate section.</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>>My authorize section looks like:</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>>authorize {</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>> preprocess</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>> chap</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>> mschap</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>> suffix</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>> eap</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>> Autz-Type Ldap1 {</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>> redundant-load-balance{</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>> unbldap</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>> unbldap2</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>> }</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>> mschap</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>> }</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>>}</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>Not really. You just haven't called that Autz-Type anywhere.</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>Ivan Kalik</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>Kalik Informatika ISP</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>-</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>>List info/subscribe/unsubscribe? See</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>><a href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</a></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>-</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>List info/subscribe/unsubscribe? See</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">><a href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</a></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>-</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">>List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</a></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">></font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">-</font></span></p><p dir="LTR"><span lang="en-us"><font face="Consolas">List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</a></font></span></p><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">-</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</a></div> </blockquote></div><br><div> <span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px 0px; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: auto; -khtml-text-decorations-in-effect: none; text-indent: 0px; -apple-text-size-adjust: auto; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px; "><div>Nicolas Goutte</div><div><br class="khtml-block-placeholder"></div><div> </div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">extragroup GmbH - Karlsruhe</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">Waldstr. 49</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">76133 Karlsruhe</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">Germany</div><div> </div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">Geschäftsführer: Stephan Mönninghoff, Hans Martin Kern, Tilman Haerdle</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">Registergericht: Amtsgericht Münster / HRB: 5624</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">Steuer Nr.: 337/5903/0421 / UstID: DE 204607841</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><br class="khtml-block-placeholder"></div><br class="Apple-interchange-newline"></span> </div><br></body></html>