CHAP Authentication with rlm_perl module
So, if i want to make the framed-ip with dynamic value than how can i do that.? And i seen one vendor that use the freeradius and that use own module in perl for CHAP authentication. For MSCHAP and EAP its using built in system's (FreeRADIUS) module. Is that possible?
On May 15, 2020, at 12:11 PM, Imdad Hasan <imdadalikadiwala0@gmail.com> wrote:
So, if i want to make the framed-ip with dynamic value than how can i do that.?
The server has IP pools you can use. They are well documented. If you have a *specific* question, please ask.
And i seen one vendor that use the freeradius and that use own module in perl for CHAP authentication. For MSCHAP and EAP its using built in system's (FreeRADIUS) module.
Is that possible?
You're welcome to read the RFCs and implement CHAP yourself. Why you would waste time doing that, I don't know. Alan DeKok.
Ok so, my specific question is i can't send some other attributes value with my logic (means dynamic) when CHAP rejects the user due to wrong password?? Thanks Alan On Fri, May 15, 2020 at 9:41 PM Imdad Hasan <imdadalikadiwala0@gmail.com> wrote:
So, if i want to make the framed-ip with dynamic value than how can i do that.?
And i seen one vendor that use the freeradius and that use own module in perl for CHAP authentication. For MSCHAP and EAP its using built in system's (FreeRADIUS) module.
Is that possible?
On May 15, 2020, at 2:10 PM, Imdad Hasan <imdadalikadiwala0@gmail.com> wrote:
Ok so, my specific question is i can't send some other attributes value with my logic (means dynamic) when CHAP rejects the user due to wrong password??
I gave you an example of how to do something when CHAP returns reject. This "something" can be running the Perl module. Please stop expecting us to spoon-feed you every little detail. That's just not going to happen. Now go spend some time *trying* things. Alan DeKok.
Sorry Alan really i tried that and after i tells you.. but its ok i will try.. sorry if you think this is stupid questions than Again Sorry from bottom of my heart. Thanks Alan On Fri, May 15, 2020 at 11:40 PM Imdad Hasan <imdadalikadiwala0@gmail.com> wrote:
Ok so, my specific question is i can't send some other attributes value with my logic (means dynamic) when CHAP rejects the user due to wrong password??
Thanks Alan
On Fri, May 15, 2020 at 9:41 PM Imdad Hasan <imdadalikadiwala0@gmail.com> wrote:
So, if i want to make the framed-ip with dynamic value than how can i do that.?
And i seen one vendor that use the freeradius and that use own module in perl for CHAP authentication. For MSCHAP and EAP its using built in system's (FreeRADIUS) module.
Is that possible?
On May 15, 2020, at 2:56 PM, Imdad Hasan <imdadalikadiwala0@gmail.com> wrote:
Sorry Alan
really i tried that and after i tells you.. but its ok i will try.. sorry if you think this is stupid questions than
Again Sorry from bottom of my heart.
Please just *try* something. And ask *specific* questions as I suggested. If your questions make it clear that you didn't try anything, then there's no reason for us to help you. We just can't administer your systems for you. You need to understand how they work. Which means spending time reading the documentation, and *trying* things. And read this about asking good questions: http://wiki.freeradius.org/list-help Alan DeKok.
Thanks, I tried, its working fine for CHAP. I set the perl call on reject. and in perl i write a logic for the rejected users. But the same logic is not working for MS-CHAP. At client side (Windows PC) pppoe dialer shows error like "It was not possible to verify identity of server". And in FR its shows terminate-cause = User-Request. means once start the accounting and stop. no issue in authentication. On Sat, May 16, 2020 at 12:26 AM Imdad Hasan <imdadalikadiwala0@gmail.com> wrote:
Sorry Alan
really i tried that and after i tells you.. but its ok i will try.. sorry if you think this is stupid questions than
Again Sorry from bottom of my heart.
Thanks Alan
On Fri, May 15, 2020 at 11:40 PM Imdad Hasan <imdadalikadiwala0@gmail.com> wrote:
Ok so, my specific question is i can't send some other attributes value with my logic (means dynamic) when CHAP rejects the user due to wrong password??
Thanks Alan
On Fri, May 15, 2020 at 9:41 PM Imdad Hasan <imdadalikadiwala0@gmail.com> wrote:
So, if i want to make the framed-ip with dynamic value than how can i do that.?
And i seen one vendor that use the freeradius and that use own module in perl for CHAP authentication. For MSCHAP and EAP its using built in system's (FreeRADIUS) module.
Is that possible?
On May 16, 2020, at 1:33 PM, Imdad Hasan <imdadalikadiwala0@gmail.com> wrote:
I tried, its working fine for CHAP. I set the perl call on reject. and in perl i write a logic for the rejected users.
Good to hear.
But the same logic is not working for MS-CHAP. At client side (Windows PC) pppoe dialer shows error like "It was not possible to verify identity of server".
Yes. It's impossible to do the same thing with MS-CHAP. Part of MS-CHAP is that the client proves to the server that it knows the password just like CHAP. However, MS-CHAP also has the server prove to the client that it knows the password. Since the server doesn't know the password, it can't issue this proof, and the client tears down the connection. Alan DeKok.
participants (2)
-
Alan DeKok -
Imdad Hasan