September 2018 - Freeradius-Users - lists.freeradius.org

Debian Stretch: No radutmp file though seeing Accounting message at network level
by Olivier 14 Sep '18

14 Sep '18

Hello, I'm currently testing SimultaneousUse setting in WPA2 Enterprise WiFi environment. I'm quite new to Radius (both concepts and implementations). After reading this (very interesting) document [1], I assigned myself a first step: seeing useful data through radwho command, no matter if Freeradius relied on a completely different source on input to implement SimultaneousUse feature. In my testing, I'm having: # radwho Fri Sep 14 12:28:55 2018 : Error: Unable to check file "/var/log/freeradius/radutmp": No such file or directory radwho: Error reading /var/log/freeradius/radutmp: No such file or directory 1. I read in [2] then that /var/log/freeradius/radutmp is created by Freeradius whenever it receives accounting data. Is it correct on Debian Stretch when package's config is mostly left unchanged ? 2. At network level, I see that my WiFi AP are sending Account-Request and receiving back Account-Response. Does it prove Freeradius's Accounting is turned on and running or shall I for instance, read this Response content ? Is there a better way to look at Freeradius "running features" ? [1] https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/doc/configurati… [2] http://lists.freeradius.org/pipermail/freeradius-users/2014-April/071808.ht… Best regards

4 4

Recommanded way to display properties for a given user ?
by Olivier 14 Sep '18

14 Sep '18

Hello, I've just discovered radmin and its capabilty to display clients list and details. Is there a way a way to get the same kind of display but for configured Users (ie entries that can be configured in /etc/freeradius/3.0/users file) as those entries can inherit properties from several sources (Groups, default values, various backends, ...) ? If I'm not mistaken, /var/log/syslog nor /var/log/freeradius/radius.log do not print such detailed data when freeradius daemon is launched with -x option. Best regards

2 3

issue with realm
by Somanath Mishra 14 Sep '18

14 Sep '18

Hi, I am facing issue with configuring realms. My requirement was "need to forward accounting packet to Fortigate". In radacct i am not getting Realm . below you can see my radacct table data. --------------------------------------------------------------------- # radacctid, acctsessionid, acctuniqueid, username, groupname, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctinterval, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress '2', '3C07A8C0-0008A16D', '33dcf4d9b2a4e05be6c38b2b6509ea6c', 'bob', 'students', '', '192.168.0.4', '0', 'Wireless-802.11', '2018-09-13 14:59:36', '2018-09-13 14:59:36', '2018-09-13 15:06:07', NULL, '390', 'RADIUS', 'CONNECT Unknown Radio', 'CONNECT Unknown Radio', '625711', '8754721', '00:0c:29:67:6d:ec', '17:f0:r4:b0:fe:td', 'User-Request', '', '', '192.168.0.60' -------------------------------------------------------------------- so to show realm value in radacct and send accounting packets to fortigate i modified in radiusd.conf and proxy.conf. below you can see change that i made to conf files: radiusd.conf:= modules { realm FortiGate { format = suffix delimiter = "@" } } proxy.conf:= Proxy-To-Realm:="FortiGate" and realm FortiGate { authhost =192.168.0.1:1812 accthost =192.168.0.1:1813 secret =a1rl08 } ----------------------------------------------------------------- I am not getting anything. I know i am doing wrong. Can you suggest me please how to achieve this?

2 1

Using other ldap attribute as wifi password
by Wim Vinckier 14 Sep '18

14 Sep '18

Hi List, I've configured freeIPA and freeRadius so I could use my ldap password as login to the network. Unfortunatly my manager wants me to change the system so it would be possible to use another ldap attribute as wifi password. I already extended the ldap configuration with an wifiCode attribute and when I query the ldap database I get the correct result back. The ipa-tools also return the correct value. Now I want to use this field in freeradius but I get stuck. I replaced the line "control:NT-Password := 'ipaNTHash'" by "control:Cleartext-Password := 'wifiCode'" but without any result. Is there any other thing I have to change to make it working? Kind regards, Wim Vinckier. -- I would love to change the world, but they wont give me the source code.

4 3

Getting a string 'as is' with no escapes from LDAP
by Kostas Zorbadelos 13 Sep '18

13 Sep '18

Hello all, I think a new thread is better for this discussion. In a previous thread (http://lists.freeradius.org/pipermail/freeradius-users/2018-September/09260…) I raised the issue of failing to get a string as is from an LDAP backend. The string represents the clear text password and I would like to take it 'as is' with no escaping of any kind. I got the explanation about the shell rules that are now implemented in freeradius 3 for strings, so as to get a single uniform approach to freeradius 3 and fix the inconsistencies of string handling in freeradius 2. We got to the solution of mapping the LDAP attribute as a binary attribute, say Tmp-Octets-0 and then use the following policy: if (control:Tmp-Octets-0) { update control { Cleartext-Password := "%{string:control:Tmp-Octets-0}" } } The binary attribute would need to be converted to string for the comparison in pap to work. Now, we found a problem for strings beginning with '0x' :) Example 1 (passwd '0xtest123') -------------------------------- kzorba@devradius(0)[09:34 AM]~/radius->/opt/freeradius/bin/radclient -f test_kzorba1.txt -x 79.128.176.142:1812 auth testing123 Sending Access-Request of id 178 to 79.128.176.142 port 1812 User-Name = "kzorba1(a)otenet.gr" NAS-Port-Type = xDSL User-Password = "0xtest123" NAS-Port-Id = "#DSLAM PORT DESCRIPTION HERE#" Calling-Station-Id = "BNG INTERFACE # DSLAM PORT DESCRIPTION" NAS-Port = 12234455 rad_recv: Access-Reject packet from host 79.128.176.142 port 1812, id=178, length=20 (0) Received Access-Request Id 99 from 79.128.176.142:50436 to 79.128.176.142:1812 length 140 (0) User-Name = "kzorba1(a)otenet.gr" (0) NAS-Port-Type = xDSL (0) User-Password = "0xtest123" (0) NAS-Port-Id = "#DSLAM PORT DESCRIPTION HERE#" (0) Calling-Station-Id = "BNG INTERFACE # DSLAM PORT DESCRIPTION" (0) NAS-Port = 12234455 (0) # Executing section authorize from file /opt/freeradius-3.0.17/etc/raddb/sites-enabled/cisco-bng (0) authorize { (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop ... rlm_ldap (ldap_1): Reserved connection (0) ... (0) ldap_1: Performing search in "..." with filter "...", scope "sub" (0) ldap_1: Waiting for search result... (0) ldap_1: User object found at DN "..." (0) ldap_1: Processing user attributes ... (0) ldap_1: WARNING: Failed parsing value "0xtest123" for attribute Tmp-Octets-0: Length of Hex String is not even, got 7 bytes ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ (0) ldap_1: No attributes updated (0) ldap_1: reply:Framed-IP-Address = 62.103.131.9 rlm_ldap (ldap_1): Released connection (0) (0) [ldap_1] = updated ... (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = updated (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /opt/freeradius-3.0.17/etc/raddb/sites-enabled/cisco-bng (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> kzorba1(a)otenet.gr (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) } # Post-Auth-Type REJECT = updated (0) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [kzorba1(a)otenet.gr] (from client myself port 12234455 cli BNG INTERFACE # DSLAM PORT DESC RIPTION) (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Example 2 (passwd '0xtest1234') -------------------------------- kzorba@devradius(0)[09:39 AM]~/radius->/opt/freeradius/bin/radclient -f test_kzorba1.txt -x 79.128.176.142:1812 auth testing123 Sending Access-Request of id 85 to 79.128.176.142 port 1812 User-Name = "kzorba1(a)otenet.gr" NAS-Port-Type = xDSL User-Password = "0xtest1234" NAS-Port-Id = "#DSLAM PORT DESCRIPTION HERE#" Calling-Station-Id = "BNG INTERFACE # DSLAM PORT DESCRIPTION" NAS-Port = 12234455 rad_recv: Access-Reject packet from host 79.128.176.142 port 1812, id=85, length=20 (0) Received Access-Request Id 85 from 79.128.176.142:38359 to 79.128.176.142:1812 length 140 (0) User-Name = "kzorba1(a)otenet.gr" (0) NAS-Port-Type = xDSL (0) User-Password = "0xtest1234" (0) NAS-Port-Id = "#DSLAM PORT DESCRIPTION HERE#" (0) Calling-Station-Id = "BNG INTERFACE # DSLAM PORT DESCRIPTION" (0) NAS-Port = 12234455 (0) # Executing section authorize from file /opt/freeradius-3.0.17/etc/raddb/sites-enabled/cisco-bng (0) authorize { ... (0) ldap_1: WARNING: Failed parsing value "0xtest1234" for attribute Tmp-Octets-0: Invalid hex data (0) ldap_1: No attributes updated ... Is there a way to overcome this? Generally speaking a solution is needed to get a string 'as is' out of an LDAP backend (most probably this will affect other backends too) without escaping/unescaping of any kind. Regards, Kostas -- Kostas Zorbadelos http://gr.linkedin.com/in/kzorba

2 4

Incorrect datetime issue
by Somanath Mishra 13 Sep '18

13 Sep '18

Hi, i am facing issue in radacct insert. So it is showing incorrect dattime. So in debug i found datetime cloumn is missing 'FROM_UNIXTIME' in debug o/p . Below you can see debug msg. --------------------------------------------------------------------- EXPAND INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', (%{%{integer:Event-Timestamp}:-strftime('%%s', 'now')} - %{%{Acct-Session-Time}:-0}), %{%{integer:Event-Timestamp}:-date('now')}, NULL, %{%{Acct-Session-Time}:-NULL}, '%{Acct-Authentic}', '%{Connect-Info}', '', %{%{Acct-Input-Gigawords}:-0} << 32 | %{%{Acct-Input-Octets}:-0}, %{%{Acct-Output-Gigawords}:-0} << 32 | %{%{Acct-Output-Octets}:-0}, '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}') (16) sql: --> INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('3C00A8C0-0002A0D8', '40c3d442406733f6f19fe4fb3da8211c', 'bob', '', '192.168.0.4', '0', 'Wireless-802.11', (1536835611 - 600), 1536835611, NULL, 600, 'RADIUS', 'CONNECT Unknown Radio', '', 0 << 32 | 155655, 0 << 32 | 434058, '00:0c:29:67:6d:ec', '18:f0:e4:b0:fe:fd', '', '', '', '192.168.0.60') ---------------------------------------------------------------------- but in insert stmt query looking ok. below is insert stmt query. query = "\ INSERT INTO ${....acct_table1} \ (${...column_list}) \ VALUES \ ('%{Acct-Session-Id}', \ '%{Acct-Unique-Session-Id}', \ '%{SQL-User-Name}', \ '%{Realm}', \ '%{NAS-IP-Address}', \ '%{%{NAS-Port-ID}:-%{NAS-Port}}', \ '%{NAS-Port-Type}', \ FROM_UNIXTIME(%{integer:Event-Timestamp}), \ FROM_UNIXTIME(%{integer:Event-Timestamp}), \ NULL, \ '0', \ '%{Acct-Authentic}', \ '%{Connect-Info}', \ '', \ '0', \ '0', \ '%{Called-Station-Id}', \ '%{Calling-Station-Id}', \ '', \ '%{Service-Type}', \ '%{Framed-Protocol}', \ '%{Framed-IP-Address}')" # So i am not able to understand where is the issue? Can you help me on that?

2 5

how to manage dynamic list of realms
by Gil Sudai 12 Sep '18

12 Sep '18

Hello I am new to freeRadius. Went over the docs but not fully understand what to do. I am planning following solution: A system where companies (aka realm in radius?) can be added or remove dynamically. And for each company there is a dynamic list of users. For example user@comp-1com, user(a)comp-2.com, etc. Users will authenticate with name and password. I would like tips and pointers for further reading regarding the following questions: - Is it possible to add & remove a company (realm?) dynamically without restarting the radius server? - How to setup the radius to support multiple (dynamic) realms? - I want to put the users in postgresql db. When a user is added to a company my code will add it to the db. To store all users from all realms will be in a single db table (realm would be a column) or in different db tables? - do I need to use virtual servers for that or only realms? - How to configure the virtual server or realms? Again – any tips or pointers for better understanding is welcome Gil

2 4

WPA2-Entreprise: which certificate to avoid changing Validate server certificate for Windows guest ?
by Olivier 12 Sep '18

12 Sep '18

Hello, I'm running a WPA2 Enterprise Wifi network powered by Freeradius 3.0.12 on Debian Stretch. Currently, Windows guests need to follow a rather long and error prone process like the one described in [1]. The core of this process, is, if I'm not mistaken, to change a default value in Protected EAP Properties configuration window. This default value that needs to changed is the "Validate server certificate" one: its default value is checked (see point 9 in referenced doc). My understanding of this default value is that, "by default, Windows will validate Server Certicate using a list of Trusted Root Certificate Authorities and if no Server Certificate is received then connection is refused with a somehow misleading "Incorrect password" error message".. My questions are: 1- In this context, is correct to say the Server Certicate Windwos is refering to, is a file somewhere in /etc/freeradius directory ? If positive, how does it look like ? A .pem file ? A .der file ? 2- Is it correct to hope that "if WiFi guests are somehow given such a Server Certificate file before trying to connect, they won't need to change Protected EAP Properties" ? Best regards [1] https://documentation.meraki.com/MR/Encryption_and_Authentication/Enabling_…

4 11

Freeradius 3.0.15 x OpenLDAP (auth) x MySQL (acct): Limit Simultaneous Use
by Jon Battista 11 Sep '18

11 Sep '18

Hi All, I am currently attempting to set up FreeRadius 3.x to limit simultaneous connection based on a User's LDAP Group. For example, people in the Employee LDAP Group get 2 connections. After extensive research, I have surmised the best way to do so is to use a SQL DB for Accounting, which I currently have all set up. Unless LDAP can be used for Accounting? As it stands, I can query how many active connections a User has (simul_count_query) from the radacct table of my local MySQL radius DB, so now I am trying to figure out how to *set* and *enforce* the Simultaneous-Use attribute. Where I am caught up is the LDAP x SQL interfacing regarding the Simultaneous-Use attribute. How and where does FreeRadius look for this attribute? Does this have to be in LDAP for the Group/User and FreeRadius queries for it or can I define within my FreeRadius configs somewhere? Most examples say to enforce it on a per-user basis by using the Users file, but what about SQL on a large scale? I've been scouring over the documentation with no luck. Again, LDAP is enabled and working. SQL Accounting is enabled and logging activity. Something I did notice was that radacct is NOT getting the groupname column when I run: *simul_count_query* Help will be much appreciated. Thanks, -- -- Jon

3 8

3.0.17 password ending in '\' problem, LDAP backend [bug?]
by Kostas Zorbadelos 11 Sep '18

11 Sep '18

Greetings to all, just finished a project upgrading a big authentication infrastructure from freeradius 2.2.X to 3.0.17. I face a problem with very few users whose passwords end in '\'. They used to work in freeradius 2. Debugging output (stripping the sensitive information): kzorba@system(0)[10:19 AM]~/radius->cat test_kzorba1.txt User-Name = kzorba1(a)otenet.gr NAS-Port-Type = xDSL User-Password = test123\ NAS-Port-Id ="#DSLAM PORT DESCRIPTION HERE#" Calling-Station-Id = "BNG INTERFACE # DSLAM PORT DESCRIPTION" NAS-Port = 12234455 using freeradius 3.0.17 radclient: kzorba@system(0)[10:26 AM]~/radius->/opt/freeradius3-auth/bin/radclient -f test_kzorba1.txt -x localhost:1812 auth XXXXX (0) Error parsing "test_kzorba1.txt": Invalid escape at end of string radclient: Failed parsing input files ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ With radclient 3.0.17 I needed to add an extra \ at the end of the User-Password to send the request. No Cleartext-Password is set. kzorba@system(0)[10:49 AM]~/radius->/opt/freeradius3-auth/bin/radclient -f test_kzorba1.txt -x localhost:1812 auth XXXXX Sent Access-Request Id 141 from 0.0.0.0:44902 to 79.128.178.43:1812 length 140 User-Name = "kzorba1(a)otenet.gr" NAS-Port-Type = xDSL User-Password = "test123\\" NAS-Port-Id = "#DSLAM PORT DESCRIPTION HERE#" Calling-Station-Id = "BNG INTERFACE # DSLAM PORT DESCRIPTION" NAS-Port = 12234455 Using freeradius 2.2.10 radclient: kzorba@system(0)[10:22 AM]~/radius->/opt/freeradius2-auth/bin/radclient -f test_kzorba1.txt -x localhost:1812 auth XXXXX Sending Access-Request of id 184 to 79.128.178.43 port 1812 User-Name = "kzorba1(a)otenet.gr" NAS-Port-Type = xDSL User-Password = "test123\\" NAS-Port-Id = "#DSLAM PORT DESCRIPTION HERE#" Calling-Station-Id = "BNG INTERFACE # DSLAM PORT DESCRIPTION" NAS-Port = 12234455 Independent of which radclient is used, the server has the same behavior demonstrated in the following debug (using radmin in production, excellent feature by the way) (13592044) Fri Sep 7 10:22:40 2018: Debug: Received Access-Request Id 184 from XXXXXXXX:59592 to XXXXXXXXX:1812 length 140 (13592044) Fri Sep 7 10:22:40 2018: Debug: User-Name = "kzorba1(a)otenet.gr" (13592044) Fri Sep 7 10:22:40 2018: Debug: NAS-Port-Type = xDSL (13592044) Fri Sep 7 10:22:40 2018: Debug: User-Password = "test123\\" (13592044) Fri Sep 7 10:22:40 2018: Debug: NAS-Port-Id = "#DSLAM PORT DESCRIPTION HERE#" (13592044) Fri Sep 7 10:22:40 2018: Debug: Calling-Station-Id = "BNG INTERFACE # DSLAM PORT DESCRIPTION" (13592044) Fri Sep 7 10:22:40 2018: Debug: NAS-Port = 12234455 (13592044) Fri Sep 7 10:22:40 2018: Debug: # Executing section authorize from file /opt/freeradius-auth-3.0.17/etc/raddb/sites-enabled/MYSERVER (13592044) Fri Sep 7 10:22:40 2018: Debug: authorize { (13592044) Fri Sep 7 10:22:40 2018: Debug: [preprocess] = ok (13592044) Fri Sep 7 10:22:40 2018: Debug: [chap] = noop (13592044) Fri Sep 7 10:22:40 2018: Debug: [mschap] = noop (13592044) Fri Sep 7 10:22:40 2018: Debug: suffix: Checking for suffix after "@" (13592044) Fri Sep 7 10:22:40 2018: Debug: suffix: Looking up realm "otenet.gr" for User-Name = "kzorba1(a)otenet.gr" (13592044) Fri Sep 7 10:22:40 2018: Debug: suffix: Found realm "otenet.gr" (13592044) Fri Sep 7 10:22:40 2018: Debug: suffix: Adding Stripped-User-Name = "kzorba1" (13592044) Fri Sep 7 10:22:40 2018: Debug: suffix: Adding Realm = "otenet.gr" (13592044) Fri Sep 7 10:22:40 2018: Debug: suffix: Authentication realm is LOCAL (13592044) Fri Sep 7 10:22:40 2018: Debug: [suffix] = ok ... (13592044) Fri Sep 7 10:22:40 2018: Debug: ldap_1: ... (13592044) Fri Sep 7 10:22:40 2018: Debug: ldap_1: Performing search in ..., scope "sub" (13592044) Fri Sep 7 10:22:40 2018: Debug: ldap_1: Waiting for search result... (13592044) Fri Sep 7 10:22:40 2018: Debug: ldap_1: User object found at DN ... (13592044) Fri Sep 7 10:22:40 2018: Debug: ldap_1: Processing user attributes (13592044) Fri Sep 7 10:22:40 2018: WARNING: ldap_1: Failed parsing value "test123\\" for attribute Cleartext-Password: Invalid escape at end of string ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ (13592044) Fri Sep 7 10:22:40 2018: Debug: ldap_1: No attributes updated ... (13592044) Fri Sep 7 10:22:40 2018: WARNING: pap: No "known good" password found for the user. Not setting Auth-Type (13592044) Fri Sep 7 10:22:40 2018: WARNING: pap: Authentication will fail unless a "known good" password is available (13592044) Fri Sep 7 10:22:40 2018: Debug: [pap] = noop (13592044) Fri Sep 7 10:22:40 2018: Debug: } # authorize = updated (13592044) Fri Sep 7 10:22:40 2018: ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject ... (13592044) Fri Sep 7 10:22:45 2018: Debug: Cleaning up request packet ID 184 with timestamp +173038 In the ldap entry of the user, the password is stored with a (single) ending '\'. Here is the relevant config of the ldap module in my case (again sensitive information stripped) ldap ldap_1 { server = "MYSERVER" identity = "LDAP BIND DN" password = PASSWD base_dn = "MY BASE DN" sasl { } # # Mapping of LDAP directory attributes to RADIUS dictionary attributes. # update { ... control:Cleartext-Password := 'myTextPwd' reply:Framed-IP-Address = 'Framed-IP-Address' ... } user { base_dn = "${..base_dn}" filter = "MY SEARCH FILTER" sasl { } # scope = 'sub' } group { } profile { } client { } accounting { } post-auth { } options { chase_referrals = yes rebind = yes res_timeout = 10 srv_timelimit = 4 net_timeout = 2 idle = 60 probes = 3 interval = 3 #ldap_debug = 0x0028 } tls { } pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 retry_delay = 5 lifetime = 0 idle_timeout = 60 } } Is this a bug (looks like to me), feature, or am I missing something? I also saw a relevant policy to sanitize the password in the request, commented out: filter_password { if (&User-Password && \ (&User-Password != "%{string:User-Password}")) { update request { &Tmp-String-0 := "%{string:User-Password}" &User-Password := "%{string:Tmp-String-0}" } } } However the request doesn't have anything to do with it, this seems like an ldap module issue. Could I do something with unlang, or in the ldap module config in this case? Regards, Kostas PS: If '\' is not at the end of the password, everything is OK. -- Kostas Zorbadelos http://gr.linkedin.com/in/kzorba

3 13