FreeRadius and User-Password from Cisco Device
Hello, Here a access-request packet from a Cisco Router (2621) : NAS-IP-Address = "IP_NAS" NAS-Port = 66 NAS-Port-Type = Virtual User-Name = "MyUserLogin" Calling-Station-Id = "IP NAS" User-Password = "ry\My\Pass/Wo\rd\Hash\Not\Plain\Text`" Why is my password not in plain text ? With other cisco devices (Switch 2960 for example), the User-Password is in plain text.. If I receive a hashed password, the authentication doesn't work.. My AAA configuration : aaa new-model aaa authentication login default group radius line aaa authentication login console line aaa authorization exec default group radius none aaa authorization network default group radius aaa accounting exec default start-stop group radius aaa accounting connection default start-stop group radius What can I do ? Thanks for your help ! Nicos.
User-Password = "ry\My\Pass/Wo\rd\Hash\Not\Plain\Text`"
Why is my password not in plain text ? With other cisco devices (Switch 2960 for example), the User-Password is in plain text.. If I receive a hashed password, the authentication doesn't work..
Are you sure it's hashed, and not just garbled? First guess is: check the shared secret on the Cisco device and the server. Stefan -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter@restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473
The shared secret is the same because I use a radius Proxy and this proxy forwards the access-request to my radius server. The problem is the password ! With a password in plain text (Check with H3C 2811 and Cisco 2960 equipmnents). Thanks for your help ! Nicolas. Selon Stefan Winter <stefan.winter@restena.lu>:
User-Password = "ry\My\Pass/Wo\rd\Hash\Not\Plain\Text`"
Why is my password not in plain text ? With other cisco devices (Switch 2960 for example), the User-Password is in plain text.. If I receive a hashed password, the authentication doesn't work..
Are you sure it's hashed, and not just garbled? First guess is: check the shared secret on the Cisco device and the server.
Stefan
-- Stefan WINTER
Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung
6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter@restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473
Hm, this means the NAS actually sent this garbage/hash. In this case, it would be enlightening to see the lines in your IOS config that start with radius-server not the aaa ones. Stefan -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter@restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473
Here, my radius configuration : radius-server host RADIUS_IP auth-port 1812 acct-port 1813 key 7 RADUIUS_KEY radius-server retransmit 1 radius-server timeout 2 Thanks ! Selon Stefan Winter <stefan.winter@restena.lu>:
Hm, this means the NAS actually sent this garbage/hash. In this case, it would be enlightening to see the lines in your IOS config that start with
radius-server
not the aaa ones.
Stefan
-- Stefan WINTER
Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung
6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter@restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473
On Mon 16 Jul 2007, nicolaskarp@free.fr wrote:
The shared secret is the same because I use a radius Proxy and this proxy forwards the access-request to my radius server. The problem is the password ! With a password in plain text (Check with H3C 2811 and Cisco 2960 equipmnents).
Then you have the shared secret wrong between your proxy and your radius server. -- Peter Nixon http://peternixon.net/
:) No because with other devices, the proxy works fine !! I don 't understand why it doesn't work :( Selon Peter Nixon <listuser@peternixon.net>:
On Mon 16 Jul 2007, nicolaskarp@free.fr wrote:
The shared secret is the same because I use a radius Proxy and this proxy forwards the access-request to my radius server. The problem is the password ! With a password in plain text (Check with H3C 2811 and Cisco 2960 equipmnents).
Then you have the shared secret wrong between your proxy and your radius server.
--
Peter Nixon http://peternixon.net/ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Check then secret in clents.conf on the proxy and Cisco device radius key. They are not the same then. Ivan Kalik Kalik Informatika ISP Dana 16/7/2007, "nicolaskarp@free.fr" <nicolaskarp@free.fr> piše:
:) No because with other devices, the proxy works fine !!
I don 't understand why it doesn't work :(
Selon Peter Nixon <listuser@peternixon.net>:
On Mon 16 Jul 2007, nicolaskarp@free.fr wrote:
The shared secret is the same because I use a radius Proxy and this proxy forwards the access-request to my radius server. The problem is the password ! With a password in plain text (Check with H3C 2811 and Cisco 2960 equipmnents).
Then you have the shared secret wrong between your proxy and your radius server.
--
Peter Nixon http://peternixon.net/ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I'm so sorry ! the Problem was the secret between proxy and the Cisco Device. Enven if the secret is different, the access-request is forwarded to the radius server, I didn't know that :( Thank you very much!!! Nicolas. Selon tnt@kalik.co.yu:
Check then secret in clents.conf on the proxy and Cisco device radius key. They are not the same then.
Ivan Kalik Kalik Informatika ISP
Dana 16/7/2007, "nicolaskarp@free.fr" <nicolaskarp@free.fr> pi¹e:
:) No because with other devices, the proxy works fine !!
I don 't understand why it doesn't work :(
Selon Peter Nixon <listuser@peternixon.net>:
On Mon 16 Jul 2007, nicolaskarp@free.fr wrote:
The shared secret is the same because I use a radius Proxy and this
proxy
forwards the access-request to my radius server. The problem is the password ! With a password in plain text (Check with H3C 2811 and Cisco 2960 equipmnents).
Then you have the shared secret wrong between your proxy and your radius server.
--
Peter Nixon http://peternixon.net/ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (4)
-
nicolaskarp＠free.fr -
Peter Nixon -
Stefan Winter -
tnt＠kalik.co.yu