- Freeradius-Users - lists.freeradius.org

Re: Multiple Root Contexts
by Sayantan Bhowmick 27 Jul '05

27 Jul '05

Hi, You could try using Autz-Type. It is documented in the file Autz-Type in the FreeRADIUS documentation. -Sayantan. >>> Kolbjørn Barmen <Kolbjorn.Barmen(a)uninett.no> 07/22/05 4:37 PM >>> On Wed, 20 Jul 2005, Mearl Danner wrote: > > Might try downloading this and reading. It's very helpful. > > http://www.novell.com/documentation/edir_radius/pdfdoc/radadmin/radadmin.pdf > > If that's 3 separate "o=" at the root of the tree, the this from the above document. Great, this also helps me somewhat. My remaining problem is how to associate a certain radius client to only only use a certain search base. Any tips? :) -- Kolbjørn Barmen UNINETT Driftsenter

1 0

Re: edir + cert problem
by Sayantan Bhowmick 26 Jul '05

26 Jul '05

Hi, Make sure that the server name you specify in the LDAP module section matches with the CN in the certificate used by the eDirectory LDAP server. e.g if your LDAP server is using SSL CERT DNS, write the hostname as the server name. If you are using SSL CERT IP, write the IP address of the server in the LDAP section. Hope this helps. Regards, -Sayantan. >>> g.crothers(a)queens-belfast.ac.uk 07/18/05 4:36 PM >>> freeradius 1.0.4 compiled with -edir support on Solaris 9. After configuring and running freeradius, I issue a query from the command line radtest VALID-USER VALID-USER-PASSOWRD localhost 389 testing123 I seem to be getting an error rlm_ldap: could not set LDAP_OPT_X_TLS_CACERTFILE option to /opt/sfw/etc/raddb/certs/barney.b64 I have checked that I have correctly exported the certificate from the novell server in question....and tried setting the premissions to 777 I have done a search of the online docs but cant find anything appropriate, anyone got any ideas... Here is the debug message from radiusd -X -f bash-2.05# clear You have new mail in /var/mail/root bash-2.05# radiusd -X -f Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded LDAP ldap: server = "nds02.XXX.COM" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=admin" ldap: tls_mode = no ldap: start_tls = yes ldap: tls_cacertfile = "/opt/sfw/etc/raddb/certs/barney.b64" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "demand" ldap: password = "" ldap: basedn = "o=XXX,ou=Staff " ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "nspmPassword" ldap: access_attr = "uid" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: edir_account_policy_check = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP userPassword mapped to RADIUS User-Password rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 104210 Module: Instantiated ldap (ldap) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "yes" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:34968, id=195, length=60 User-Name = "VALID-USER" User-Password = "VALID-USERS-PASSWORD" NAS-IP-Address = 255.255.255.255 NAS-Port = 389 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "gcrother", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 8 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for gcrother radius_xlat: '(uid=VALID-USER)' radius_xlat: 'o=XXX,ou=Staff ' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to nds02.XXX.com:389, authentication 0 rlm_ldap: setting TLS CACert File to /opt/sfw/etc/raddb/certs/barney.b64 rlm_ldap: could not set LDAP_OPT_X_TLS_CACERTFILE option to /opt/sfw/etc/raddb/certs/barney.b64 rlm_ldap: setting TLS Require Cert to demand rlm_ldap: starting TLS rlm_ldap: ldap_start_tls_s() rlm_ldap: could not start TLS Success rlm_ldap: (re)connection attempt failed rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns fail for request 0 modcall: group authorize returns fail for request 0 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 127.0.0.1:34968, id=195, length=60 Discarding duplicate request from client localhost:34968 - ID: 195 --- Walking the entire request list --- Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 195 with timestamp 42db7619 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 127.0.0.1:34968, id=195, length=60 User-Name = "VALID-USER" User-Password = "VALID-USER-PASSWORD" NAS-IP-Address = 255.255.255.255 NAS-Port = 389 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "gcrother", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 8 modcall[authorize]: module "files" returns ok for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for gcrother radius_xlat: '(uid=VALID-USER)' radius_xlat: 'o=XXX,ou=Staff ' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to nds02.XXX.COM:389, authentication 0 rlm_ldap: setting TLS CACert File to /opt/sfw/etc/raddb/certs/barney.b64 rlm_ldap: could not set LDAP_OPT_X_TLS_CACERTFILE option to /opt/sfw/etc/raddb/certs/barney.b64 rlm_ldap: setting TLS Require Cert to demand rlm_ldap: starting TLS rlm_ldap: ldap_start_tls_s() rlm_ldap: could not start TLS Success rlm_ldap: (re)connection attempt failed rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns fail for request 1 modcall: group authorize returns fail for request 1 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 127.0.0.1:34968, id=195, length=60 Discarding duplicate request from client localhost:34968 - ID: 195 --- Walking the entire request list --- Waking up in 3 seconds... ^C tia Garry Crothers -- Regards Garry Crothers - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

4 7

Re: LDAP and FreeRadius Authentication - One user, multiple groups
by Mark Litchfield 26 Jul '05

26 Jul '05

>> I have freeradius and LDAP authenticating nicely. The problem I am >> running into is that when I id a user, it only shows the primary group >> that user is a member of. How can I get FreeRadius to report the other >> groups that the user belongs to? >> >> Mark Litchfield > Sorry I don't understand. Can you explain what you mean by "only shows > the primary group" and "report the other groups". Report to what? > Perhaps some radiusd -X output and an explanation of what you are trying > to do would help. Using the following tree in LDAP: dc: treeroot |_ou: accounts | |_ou: domain1 | | |_uid: joe | | mail: joe@domain1 | | uid: 10001 | | gid: 11000 | |_ou: domain2 | |_uid: joe | mail: joe@domain2 | uid: 10002 | gid: 11001 |_ou: groups |_cn: group1 | uniqueMember: uid=joe,ou=domain1,ou=accounts,dc=treeroot | gid: 11000 |_cn: group2 | uniqueMember: uid=joe,ou=domain2,ou=accounts,dc=treeroot | gid: 11001 |_cn: group3 uniqueMember: uid=joe,ou=domain1,ou=accounts,dc=treeroot uniqueMember: uid=joe,ou=domain2,ou=accounts,dc=treeroot gid: 11002 When I "su" in as joe@domain1 and run "id" from the prompt I get: joe(10001), group1(11000) When I should get joe(10001), group1(11000), group3(11002) The overall desired effect: 1. System will support multiple domains. 2. Duplicate user names cannot exist within the same domain. (i.e. there can be only one username "joe" per domain, but each domain can have a username "joe".) 3. Users can be members of several groups. Cross-domain group membership may be supported. (joe@domain-1 is a member of group1 and joe@domain-2 is a member of group2. Both of them are members of group3) 4. User / group authorization must be available to the filesystem / OS. I am trying to replace the use of /etc/passwd and /etc/group for filesystem permissions, login , etc. Please anyone, tell me if I am insane for attempting this, if this is even possible or if there is an opensource alternative that will do all this and work with postfix and apache for user AAA. I would much rather get this to work in LDAP with FreeRadius. On a side note, same topic... I have been looking for a way to do nested groups in LDAP with FreeRadius. Is this possible and how? BTW, I was unable to grab the radiusd -X output. The machine is not availble to me for a few days. Taking a short break before I snap. Thanks Mark Litchfield

1 0

Freeradius and Windows 2003 Active Directory Authentication
by Tim P 26 Jul '05

26 Jul '05

I am having trouble getting my radius setup to authenticate to windows 2003 active directory. when using the following string " radiusd.conf <module configureation section> ldap { server = "gtds-domcon.gtdsolutions.org" basedn = "dc=gtdsolutions,dc=org" filter = "(sAMAccountName=%u)" password_attribute = "userPassword" identity = "cn=administrator,cn=Users,dc=gtdsolutions,dc=org" password = pantera <authorize section> ldap

1 0

Proxy/Not Proxy based on dialed number?
by Dave Weis 26 Jul '05

26 Jul '05

I have a MAX TNT that will be doing dialin service. Is it possible to selectively proxy based on the DNIS? My user accounts are stored in a postgres database that I have working fine for PPPoA termination already. Thanks for any help dave

1 0

limited accounts
by Jérémy Cluzel 26 Jul '05

26 Jul '05

Hi, I'm trying to setup a system which allow users to login for a specific period (1 month, or 1 week, it depends on the type of the account) since their first connection. I manage to do this by a cron script which removes them from database, but it's (really) crap... Is there any proper way to do this ? counter module ? I think this could better by modifying sql queries in "sql.conf" to calculate remaining time (until the end of this period) and send it as "Max-All-Session" attribute to the NAS, but I don't know if it's possible... Moreover, I wish to use a "max consecutive time" too, which allow me to create user account valid for a limited period (1 month for ex.), with limited session time (3 hours max), and with a maximum "duration time" (10 hours). Is there any specific module to do this ? Finally, if I want to limit access depending on the day of the week, or the hour, what's the best approach ? Sorry for all these questions, I don't expect a complete solution from this forum (it's my work to find one), but simply some advices (or clues) on how it could (would ?) be done. Regards, Jeremy

2 1

EAP-TLS and MYSQL
by Stephane Rossi 26 Jul '05

26 Jul '05

I'm using Freeradius in EAP-TLS and I'm trying to use dialupadmin/mysql. Although the supplicant is not in my database, the NAS receives an Access-Accept. Is this normal ? #file is commented in my radiusd.conf. thanks for your help. Stephane Rossi rlm_sql (sql): User testwifi not found in radgroupcheck rlm_sql (sql): User not found rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns notfound for request 6 modcall: group authorize returns updated for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 6 modcall: group authenticate returns ok for request 6 Login OK: [testwifi/<no User-Password attribute>] (from client Cisco Aironet 1200 port 354 cli 0090.4b77.99a6) Sending Access-Accept of id 162 to 192.168.2.220:21646 MS-MPPE-Recv-Key = 0x910fdf897f8f042be203a7bcb10a1b89969b996f693ec40fd58d6172f55dee26 MS-MPPE-Send-Key = 0x5bbe978c153970cf7fb7f7fb7863caf4c9525fedb850f85d1a02985a585544e0 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "testwifi" Finished request 6

2 1

Different Passwd Files on Different Servers
by Bryan Beronilla 26 Jul '05

26 Jul '05

I'm relatively new to the radius universe and I'd like to ask your help regarding my freeradius concerns. We're trying to configure freeradius to read from different passwd files based on their domains. We have around 20 virtual domains spanning 2 servers. Now my question is two-fold: 1. How will I configure the conf files in order to authenticate different users to different passwd and shadow files based on their domain names? Do I go the configurable failover route? If so, can anyone give me tips or forward me a good link on how to set this up? 2. What is the most elegant way of accessing the passwd files on the second server? Should I set up another radius server on the second box and pass on the request? Or is there a better alternative. Thank you very much for any help you might be able to pass along. Barok Beronilla

3 6

session-time with incorrect calculations
by Barry 26 Jul '05

26 Jul '05

Hi I am running FreeRadius 1.0.4 with Postgres. I have noticed that the sessiontime is sometimes calculated incorrectly in the radacct table. If you compare the acctsessionstart and the acctsessionend with the acctsessiontime it does not match. This is particularly true for connections ended with idle-timeout. When would session times generally be wrong and how can I stop this from happening ? Thanks Barry

4 3

802.1X Port Authentication using unix user/pass
by lists.mailing＠surasoft.com 26 Jul '05

26 Jul '05

Hi, I've looked at the 802.1X Port-Based Authentication HOWTO guide, I have a few questions. The guide authenticates using a "users" file which is a formatted text file. I wish to use the users unix (linux) user name and passwords which I are in /etc/password and the /etc/shadow which has the encrypted string for the password. My Question is: Can I follow the guide and trivially make it do what I want? I have a feeling somehow what I want to achieve requires the password to be sent plain text (not CHAP) ... correct? BUT is the "plain text" encrypted anyway between the access point and the wireless node using OpenSSL or if the password was sent plain text can it be sniffed? To make life easy... I want WPA-EAP authentication working, but I want the authentication be against the Linux username and its password. Is this possible? Guides and tips welcome Cheers Sura

3 3