Using %{User-Password} in sql query for mschapv2
Hi everybody, I use FreeRADIUS Version 2.1.10 on Debian with OpenVPN and xl2tp/openswan and the rlm_sql module. I want to use the user password in a sql query in dialup.conf. This works fine with ssh and openvpn logins but not with mschapv2. I don't know if the password is really not submitted or just not replaced in the sql query. Is there a simple way to make this work? Thanks in advance
On Sun, Apr 01, 2012 at 03:30:37AM +0200, Oliver wrote:
I use FreeRADIUS Version 2.1.10 on Debian with OpenVPN and xl2tp/openswan and the rlm_sql module. I want to use the user password in a sql query in dialup.conf. This works fine with ssh and openvpn logins but not with mschapv2. I don't know if the password is really not submitted or just not replaced in the sql query.
This question should go to freeradius-users, not -devel. mschapv2 is challenge-response. You don't get the password in the request.
Is there a simple way to make this work?
Depends if you store the password on your system in clear text. If not, then no. http://deployingradius.com/documents/protocols/compatibility.html Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Thanks Matthew, I know this restrictions. My idea was to encrypt the password with the user password, because it's a really bad idea to store plain text passwords in mysql. So far, I can encrypt it with a server side key, but of course if someone hacks the server, this is pretty useless. Is there any way to send the plain password with the challenge request to use in my sql query? Oliver
On Sun, Apr 01, 2012 at 09:25:25PM +0200, Oliver wrote:
Is there any way to send the plain password with the challenge request to use in my sql query?
Did you read a) what I wrote, or b) the link I gave? Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Oliver wrote:
Did you read a) what I wrote, or b) the link I gave?
Yes, both was not very helpful, because a) I already know this an b) it has nothing to do with my question.
If you're not going to listen to the answers on this list, you can be unsubscribed and banned. You did NOT understand Matthew's response. You do NOT know what you're talking about. Matthews response WAS directly relevant to your question. What you are trying to do is impossible. You were told it was impossible. What part of "impossible" is unclear? Alan DeKok.
participants (3)
-
Alan DeKok -
Matthew Newton -
Oliver