<DIV>Matthew,</DIV>
<DIV> </DIV>
<DIV>Great!</DIV>
<DIV> </DIV>
<DIV>Thanks for your reply. It helps. We will use this solution.</DIV>
<DIV> </DIV>
<DIV>Tom</DIV>
<DIV><includetail>
<DIV> </DIV>
<DIV> </DIV>
<DIV style="COLOR: #000">
<DIV style="PADDING-BOTTOM: 2px; PADDING-LEFT: 0px; PADDING-RIGHT: 0px; FONT-FAMILY: Arial Narrow; FONT-SIZE: 12px; PADDING-TOP: 2px">------------------ Original ------------------</DIV>
<DIV style="PADDING-BOTTOM: 8px; PADDING-LEFT: 8px; PADDING-RIGHT: 8px; BACKGROUND: #efefef; FONT-SIZE: 12px; PADDING-TOP: 8px">
<DIV id=menu_sender><B>From: </B> "freeradius-users"<freeradius-users-request@lists.freeradius.org>;</DIV>
<DIV><B>Date: </B> Fri, Apr 20, 2012 05:30 PM</DIV>
<DIV><B>To: </B> "freeradius-users"<freeradius-users@lists.freeradius.org>; <WBR></DIV>
<DIV></DIV>
<DIV><B>Subject: </B> Freeradius-Users Digest, Vol 84, Issue 65</DIV></DIV>
<DIV> </DIV>Send Freeradius-Users mailing list submissions to<BR>freeradius-users@lists.freeradius.org<BR><BR>To subscribe or unsubscribe via the World Wide Web, visit<BR>http://lists.freeradius.org/mailman/listinfo/freeradius-users<BR>or, via email, send a message with subject or body 'help' to<BR>freeradius-users-request@lists.freeradius.org<BR><BR>You can reach the person managing the list at<BR>freeradius-users-owner@lists.freeradius.org<BR><BR>When replying, please edit your Subject line so it is more specific<BR>than "Re: Contents of Freeradius-Users digest..."<BR><BR><BR>Today's Topics:<BR><BR> 1. Re:Freeradius Access Requet ID (Matthew Newton)<BR> 2. Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. (Wassim Zaarour)<BR> 3. Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. (Fajar A. Nugraha)<BR> 4. Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. (Alan DeKok)<BR> 5. Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. (alan buxey)<BR> 6. Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. (Wassim Zaarour)<BR> 7. Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. (Wassim Zaarour)<BR> 8. How to grant access to a network regardless of the<BR> username/password? (Henrik Karlsson)<BR><BR><BR>----------------------------------------------------------------------<BR><BR>Message: 1<BR>Date: Fri, 20 Apr 2012 08:52:15 +0100<BR>From: Matthew Newton <mcn4@leicester.ac.uk><BR>To: FreeRadius users mailing list<BR><freeradius-users@lists.freeradius.org><BR>Subject: Re:Freeradius Access Requet ID<BR>Message-ID: <20120420075215.GA7240@rootmail.cc.le.ac.uk><BR>Content-Type: text/plain; charset=utf-8<BR><BR>On Fri, Apr 20, 2012 at 03:42:09PM +0800, ?????? wrote:<BR>> We know the post-authentication query can do something which we know who is pass.<BR>> <BR>> We don't have a method to log the rejected request.<BR><BR>Put something in the Post-Auth-Type REJECT section of post-auth to<BR>log whatever you want.<BR><BR>post-auth {<BR> Post-Auth-Type REJECT {<BR><BR> # here<BR><BR> }<BR>}<BR><BR>Matthew<BR><BR><BR>-- <BR>Matthew Newton, Ph.D. <mcn4@le.ac.uk><BR><BR>Systems Architect (UNIX and Networks), Network Services,<BR>I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom<BR><BR>For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk><BR><BR><BR>------------------------------<BR><BR>Message: 2<BR>Date: Fri, 20 Apr 2012 10:53:32 +0300<BR>From: Wassim Zaarour <wassim.zaarour@navlink.com><BR>To: FreeRadius users mailing list<BR><freeradius-users@lists.freeradius.org><BR>Subject: Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails.<BR>Message-ID: <CBB6EF8C.ED0C%wassim.zaarour@navlink.com><BR>Content-Type: text/plain; CHARSET=US-ASCII<BR><BR>Hi Farja,<BR><BR>I just checked with the ldap admin and he told me passwords are stored<BR>with SHA encryption and not cleartext. ( can't change them to clear text)<BR><BR>Does that means there is no way to make TTLS/PEAP/MSCHAPv2 work with it??<BR><BR>If I use TTLS/PAP from a Mac OS laptop, it works fine, but I'm stuck with<BR>the windows laptops as they have PEAP/MSCHAPv2 only.<BR><BR>Any workaround?<BR><BR>Thanks<BR>Wassim.<BR><BR><BR><BR><BR><BR><BR><BR>On 4/20/12 10:30 AM, "Fajar A. Nugraha" <list@fajar.net> wrote:<BR><BR>>On Fri, Apr 20, 2012 at 2:22 PM, Wassim Zaarour<BR>><wassim.zaarour@navlink.com> wrote:<BR>><BR>>> On 4/20/12 10:15 AM, "Fajar A. Nugraha" <list@fajar.net> wrote:<BR>><BR>>>>Long version:<BR>>>>MSCHAPv2 (which also means PEAP-MSCHAPv2) needs either:<BR>>>>- Cleartext-Password or NT-Hash available (in LDAP, sql, users file<BR>>>>whatever), OR<BR>>>>- an active directory<BR>>>><BR>>>>If you don't have either, then it won't work.<BR>>><BR>>> Hi Farja,<BR>>><BR>>> Passwords are stored as clear text in my LDAP, that should make MSCHAPv2<BR>>> work right?<BR>><BR>>Yes, if FR can find them. This part of the log says it can't:<BR>><BR>>[ldap] performing search in o=navbey.com, dc=navbey,dc=com, with filter<BR>>(uid=pk)<BR>>[ldap] looking for check items in directory...<BR>>[ldap] looking for reply items in directory...<BR>>WARNING: No "known good" password was found in LDAP. Are you sure that<BR>>the user is configured correctly?<BR>><BR>>You might need to play around with the user used to login to LDAP, as<BR>>some systems only give out passwords to admin accounts. Testing manual<BR>>LDAP lookup using command line tool (e.g. ldapsearch) helps. If you<BR>>CAN get your ldap server to return cleartext password with ldapsearch,<BR>>then you should be able to configure FR to get that as well.<BR>><BR>>-- <BR>>Fajar<BR>>-<BR>>List info/subscribe/unsubscribe? See<BR>>http://www.freeradius.org/list/users.html<BR><BR><BR><BR><BR>------------------------------<BR><BR>Message: 3<BR>Date: Fri, 20 Apr 2012 15:01:13 +0700<BR>From: "Fajar A. Nugraha" <list@fajar.net><BR>To: FreeRadius users mailing list<BR><freeradius-users@lists.freeradius.org><BR>Subject: Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails.<BR>Message-ID:<BR><CAG1y0segiKtFkiE2M5xu+7kAwYtjvNc0+0PCxZTT51AuKYjJWw@mail.gmail.com><BR>Content-Type: text/plain; charset=ISO-8859-1<BR><BR>On Fri, Apr 20, 2012 at 2:53 PM, Wassim Zaarour<BR><wassim.zaarour@navlink.com> wrote:<BR>> I just checked with the ldap admin and he told me passwords are stored<BR>> with SHA encryption and not cleartext. ( can't change them to clear text)<BR><BR>Figured as much :)<BR><BR>> Does that means there is no way to make TTLS/PEAP/MSCHAPv2 work with it??<BR><BR>Yes<BR><BR>> If I use TTLS/PAP from a Mac OS laptop, it works fine, but I'm stuck with<BR>> the windows laptops as they have PEAP/MSCHAPv2 only.<BR>><BR>> Any workaround?<BR><BR>No.<BR><BR>Not unless you're willing to install 3rd-party supplicant on every<BR>windows client.<BR><BR>-- <BR>Fajar<BR><BR><BR>------------------------------<BR><BR>Message: 4<BR>Date: Fri, 20 Apr 2012 10:15:03 +0200<BR>From: Alan DeKok <aland@deployingradius.com><BR>To: FreeRadius users mailing list<BR><freeradius-users@lists.freeradius.org><BR>Subject: Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails.<BR>Message-ID: <4F911B07.50509@deployingradius.com><BR>Content-Type: text/plain; charset=ISO-8859-1<BR><BR>Wassim Zaarour wrote:<BR>> Hi Farja,<BR>> <BR>> I just checked with the ldap admin and he told me passwords are stored<BR>> with SHA encryption and not cleartext. ( can't change them to clear text)<BR>> <BR>> Does that means there is no way to make TTLS/PEAP/MSCHAPv2 work with it??<BR>> <BR>> If I use TTLS/PAP from a Mac OS laptop, it works fine, but I'm stuck with<BR>> the windows laptops as they have PEAP/MSCHAPv2 only.<BR>> <BR>> Any workaround?<BR><BR>http://deployingradius.com/documents/protocols/compatibility.html<BR><BR> Alan DeKok.<BR><BR><BR>------------------------------<BR><BR>Message: 5<BR>Date: Fri, 20 Apr 2012 09:18:59 +0100<BR>From: alan buxey <A.L.M.Buxey@lboro.ac.uk><BR>To: FreeRadius users mailing list<BR><freeradius-users@lists.freeradius.org><BR>Subject: Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails.<BR>Message-ID: <20120420081859.GA11042@lboro.ac.uk><BR>Content-Type: text/plain; charset=us-ascii<BR><BR>Hi,<BR><BR>> I just checked with the ldap admin and he told me passwords are stored<BR>> with SHA encryption and not cleartext. ( can't change them to clear text)<BR><BR>is this LDAP or AD? if its AD then you can bind your FreeRADIUS box to the AD<BR>as per docs on deployingradius.com - then it can use ntlm_auth to do PEAP<BR>very happily for windows clients - its what we do for our 20k users for 802.1X<BR><BR>alan<BR><BR><BR>------------------------------<BR><BR>Message: 6<BR>Date: Fri, 20 Apr 2012 11:19:43 +0300<BR>From: Wassim Zaarour <wassim.zaarour@navlink.com><BR>To: FreeRadius users mailing list<BR><freeradius-users@lists.freeradius.org><BR>Subject: Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails.<BR>Message-ID: <CBB6F671.ED1B%wassim.zaarour@navlink.com><BR>Content-Type: text/plain; CHARSET=US-ASCII<BR><BR>Thanks Alan for the link,<BR><BR>I just ran to it few minutes back and its clear :)<BR><BR>Guess I'm gonna have to settle for a third party supplicant since I can't<BR>change in the LDAP password storage config.<BR><BR>Thanks also for the other Alan and Farja.<BR><BR><BR><BR><BR><BR><BR>On 4/20/12 11:15 AM, "Alan DeKok" <aland@deployingradius.com> wrote:<BR><BR>>Wassim Zaarour wrote:<BR>>> Hi Farja,<BR>>> <BR>>> I just checked with the ldap admin and he told me passwords are stored<BR>>> with SHA encryption and not cleartext. ( can't change them to clear<BR>>>text)<BR>>> <BR>>> Does that means there is no way to make TTLS/PEAP/MSCHAPv2 work with<BR>>>it??<BR>>> <BR>>> If I use TTLS/PAP from a Mac OS laptop, it works fine, but I'm stuck<BR>>>with<BR>>> the windows laptops as they have PEAP/MSCHAPv2 only.<BR>>> <BR>>> Any workaround?<BR>><BR>>http://deployingradius.com/documents/protocols/compatibility.html<BR>><BR>> Alan DeKok.<BR>>-<BR>>List info/subscribe/unsubscribe? See<BR>>http://www.freeradius.org/list/users.html<BR><BR><BR><BR><BR>------------------------------<BR><BR>Message: 7<BR>Date: Fri, 20 Apr 2012 11:28:54 +0300<BR>From: Wassim Zaarour <wassim.zaarour@navlink.com><BR>To: FreeRadius users mailing list<BR><freeradius-users@lists.freeradius.org><BR>Subject: Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails.<BR>Message-ID: <CBB6F8CA.ED21%wassim.zaarour@navlink.com><BR>Content-Type: text/plain; CHARSET=US-ASCII<BR><BR>It's Sun Directory Server, hence LDAP not AD.<BR><BR>Thanks anyways :)<BR><BR><BR><BR><BR><BR>On 4/20/12 11:18 AM, "alan buxey" <A.L.M.Buxey@lboro.ac.uk> wrote:<BR><BR>>Hi,<BR>><BR>>> I just checked with the ldap admin and he told me passwords are stored<BR>>> with SHA encryption and not cleartext. ( can't change them to clear<BR>>>text)<BR>><BR>>is this LDAP or AD? if its AD then you can bind your FreeRADIUS box to<BR>>the AD<BR>>as per docs on deployingradius.com - then it can use ntlm_auth to do PEAP<BR>>very happily for windows clients - its what we do for our 20k users for<BR>>802.1X<BR>><BR>>alan<BR>>-<BR>>List info/subscribe/unsubscribe? See<BR>>http://www.freeradius.org/list/users.html<BR><BR><BR><BR><BR>------------------------------<BR><BR>Message: 8<BR>Date: Fri, 20 Apr 2012 11:30:13 +0200<BR>From: Henrik Karlsson <Henrik.Karlsson@Generic.se><BR>To: "freeradius-users@lists.freeradius.org"<BR><freeradius-users@lists.freeradius.org><BR>Subject: How to grant access to a network regardless of the<BR>username/password?<BR>Message-ID:<BR><5D4FE383D0CD43418076B92AA238BA8B0100EBB56656@nova.intra.generic.se><BR>Content-Type: text/plain; charset="us-ascii"<BR><BR>Hi,<BR>I have a dial-in system that use freeRADIUS as radius server. I have figured out how to log username and password from access requests in a SQL database. My next goal is to be able to keep on logging Username and password but accept all users regardless of username/password. The user shall not need to be listed as a user in the RADIUS server. I want to grant access for all users that dial in for access to the network, hut I need to log the username and password that they send to the RADIUS server.<BR><BR>Username and password are stored in a Mysql database and we use PAP.<BR><BR>Is it possible to make this configuration and if it is possible how do I do it.<BR><BR>/Henrik<BR><BR><BR>-------------- next part --------------<BR>An HTML attachment was scrubbed...<BR>URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20120420/c90a307b/attachment.html><BR><BR>------------------------------<BR><BR>-<BR>List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html<BR><BR>End of Freeradius-Users Digest, Vol 84, Issue 65<BR>************************************************<BR></DIV></includetail></DIV>