Hello! I have problems with CHAP and Cleartext-Password. I'm running freeradius.net v.2.1 on SUSE 10 server. I've configured following user in /raddb/users at the end of text file: ===================================================================================== # # Last default: shell on the local terminal server. # # # DEFAULT # Service-Type = Administrative-User #=======================my users======================== 0014853077be Cleartext-Password := "0014853077be" #00148518fe47 User-Password == "00148518fe47" #=======================My users======================== # On no match, the user is denied access. "users" 218L, 6786C ===================================================================================== When I'm trying to make mac-auth from the HP switch (running radiusd in debug mode), I recieve following error: [chap] Cleartext-Password is required for authentication Here is part of debug info: ===================================================================================== Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. ................................... Calling-Station-Id = "00-14-85-30-77-be" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" CHAP-Password = 0x1f08e1d048be8f22c9435f00a4a0095cb6 Message-Authenticator = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Found Auth-Type = CHAP +- entering group CHAP {...} [chap] login attempt by "0014853077be" with CHAP password [chap] Cleartext-Password is required for authentication ++[chap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} expand: %{User-Name} -> 0014853077be attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds =====================================================================================
I have no idea why have you removed parts of the debug that would tell more about this. Do you? Looking at this:
Calling-Station-Id = "00-14-85-30-77-be"
wild stab in the dark would be that your password is wrong. It probably should be 00-14-85-30-77-be instead of 0014853077be. Ivan Kalik Kalik Informatika ISP
Sorry, but I thougth it is unnecesary information. The main problem was "unable to find Cleartext-password for user". I searched in the mailinglists archive and finally found the solution, mentioned before - my MAC users definition was at the END of users file. I moved users at the top of the file and now it seems is OK. Before it was a preblem because in the freeRadius documentation I coudn't find this hint. http://lists.freeradius.org/mailman/htdig/freeradius-users/2007-November/msg... The problem is gone. Thanks for understanding! Sincerely, Dagnis Zemturis ----- Original Message ----- From: <tnt@kalik.net> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Friday, September 19, 2008 2:17 PM Subject: Re: CHAP auth and Cleartext-Password
I have no idea why have you removed parts of the debug that would tell more about this. Do you?
Looking at this:
Calling-Station-Id = "00-14-85-30-77-be"
wild stab in the dark would be that your password is wrong. It probably should be 00-14-85-30-77-be instead of 0014853077be.
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Dagnis Zemturis wrote:
I moved users at the top of the file and now it seems is OK. Before it was a preblem because in the freeRadius documentation I coudn't find this hint.
The "man" page for the users file, and the comments at the top of the "users" file describe how it is processed. It clearly says that the file is processed from the top to the bottom. I have no idea how you can't find the documentation in the file that you are editing. Alan DeKok.
participants (3)
-
Alan DeKok -
Dagnis Zemturis -
tnt@kalik.net