<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Dec 30, 2014 at 5:00 PM, Alan DeKok <span dir="ltr"><<a href="mailto:aland@deployingradius.com" target="_blank">aland@deployingradius.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class=""><br>
> Full output of freeradius -X after command<br>
><br>
</span><span class="">>Â Â [local] performing search in dc=ourcorp,dc=net, with filter (uid=abx)<br>
> [local] checking if remote access for abx is allowed by dialupAccess<br>
> [local] Added User-Password = 1D*************************************9B in check items<br>
<br>
</span> And… that’s the issue. You’ve configured it to get the User-Password from LDAP.<br></blockquote><div><br><br></div><div>Yes, but how to prevent it? I have nothing about User-Password in freeradius configs:<br><br><br></div><div>=================================================================<br>/etc/freeradius# grep -R User-Password *<br>attrs.pre-proxy:#   User-Password =* ANY,<br>attrs.pre-proxy:   #User-Password =* ANY,<br>eap.conf:      # User-Password, or the NT-Password attributes.<br>eap.conf:      # the User-Password.<br>eap.conf:         # is put into a User-Password attribute,<br>eap.conf:         # the module will look for a User-Password<br>experimental.conf:   # packets containing a User-Password attribute.<br>modules/ntlm_auth:   program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}"<br>modules/smsotp:# The module does not check the User-Password, this should be done with<br>modules/detail:   # Certain attributes such as User-Password may be<br>modules/detail:      # User-Password<br>modules/sql_log:    ('%{User-Name}', '%{User-Password:-Chap-Password}',        \<br>modules/detail.log:      User-Password<br>modules/detail.log:      # User-Password<br>modules/pap:# In this case, the module will look inside of the User-Password<br>modules/ldap:# Access-Request packet contains a clear-text User-Password<br>modules/ldap:   # By default, if the packet contains a User-Password,<br>root@ukv69:/etc/freeradius# <br>===================================================================<br><br></div><div>Everything is commented, exclude ntlm_auth and detail.log, I believe both are not what I have to change.<br><br><br></div><div>ldap.attrmap:<br><br>===================================================================<br></div><div><br>checkItem   $GENERIC$         radiusCheckItem<br>replyItem   $GENERIC$         radiusReplyItem<br><br>checkItem   Auth-Type         radiusAuthType<br>checkItem   Simultaneous-Use      radiusSimultaneousUse<br>checkItem   Called-Station-Id      radiusCalledStationId<br>checkItem   Calling-Station-Id      radiusCallingStationId<br>checkItem   LM-Password         lmPassword<br>checkItem   NT-Password         ntPassword<br>checkItem   LM-Password         sambaLmPassword<br>checkItem   NT-Password         sambaNtPassword<br>checkItem   LM-Password         dBCSPwd<br>checkitem   Password-With-Header      userPassword<br>checkItem   SMB-Account-CTRL-TEXT      acctFlags<br>checkItem   Expiration         radiusExpiration<br>checkItem   NAS-IP-Address         radiusNASIpAddress<br><br>====================================================================<br></div><div><br><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<span class=""><br>
> [local] No default NMAS login sequence<br>
> [local] looking for check items in directory...<br>
>Â Â [local] sambaNtPassword -> NT-Password == 0x31***********************************************************************42<br>
<br>
</span> That means it’s not using the NT-Password.<br>
<span class=""><br>
> Found Auth-Type = PAP<br>
> !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!<br>
> !!!  Replacing User-Password in config items with Cleartext-Password.   !!!<br>
> !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!<br>
> !!! Please update your configuration so that the "known good"Â Â Â Â Â Â Â Â !!!<br>
> !!! clear text password is in Cleartext-Password, and not in User-Password. !!!<br>
> !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!<br>
<br>
</span> It helps to READ these messages and fix the problem. If you had done that, it would have worked.<br></blockquote><div><br></div><div>I've tried, but there is nothing about User-Password in configs, so I can not replace it with Cleartext-Password.<br></div><br><br><br></div></div></div>