Jefri bin Dahari wrote:

Hi all,

I try to implement wireless users with PEAP but I face problem. It works if password in LDAP in clear text.

With PEAP, the password *must* either be in clear-text or the NTLM hash. josh.

first, thanks for writting and giving out FR. I have been given $$ to buy commercial radius but I haven't since I love FR, I think it has more featurs then the commercial one we looked at so good job!!! now, Is it possible for same NAS-IP to be in multiple huntgroups? I tried to do this but then it got confusing since the users file can only specify one huntgroup per user (which is okay if I can do multiple huntgroups with same NAS-IP) see what I am trying to do is limit access based on NAS-IP address, is there any other way to do this? one more thing, I wrote a dictionay.raritan file, where do I contribute? __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

I have 100s of users but here is an example. goal: user u1: has access from NAS-IP 192.168.50.5 user u2: has access from NAS-IP 192.168.5 and 6 currently I have huntgroup defination such as, hu1 NAS-IP-Address 192.168.50.5 hu2 NAS-IP-Adderss 192.168.50.6 Then in the users file, (sorry if the syntax is not exactly correct here) u1 Auth-by: Local, huntgroup: hu1 u2 Auth-by: Local, hungrroup: hu2 #then also, u1 Auth-by: Local, huntgroup: hu2 see how I had to make two entries for user u1. I was wonderig if there is better way to do that. --- Alan DeKok <aland@ox.org> wrote:

Agent Smith <news8080@yahoo.com> wrote:

...

first, thanks for writting and giving out FR. I have been given $$ to buy commercial radius but I haven't since I love FR, I think it has more featurs then the commercial one we looked at so good job!!!

Thanks.

...

Is it possible for same NAS-IP to be in multiple huntgroups?

I'm not sure.

...

see what I am trying to do is limit access based on NAS-IP address, is there any other way to do this?

Limit who's access to what?

...

one more thing, I wrote a dictionay.raritan file, where do I contribute?

Mail it to the list.

Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

__________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

I have comment the line and add lines as shown in my ldap.attrmap below. checkItem $GENERIC$ radiusCheckItem replyItem $GENERIC$ radiusReplyItem checkItem Auth-Type radiusAuthType checkItem Simultaneous-Use radiusSimultaneousUse checkItem Called-Station-Id radiusCalledStationId checkItem Calling-Station-Id radiusCallingStationId #checkItem LM-Password lmPassword #checkItem NT-Password ntPassword checkItem SMB-Account-CTRL-TEXT acctFlags checkItem Expiration radiusExpiration checkItem User-Password userPassword checkItem LM-Password sambaLMPassword checkItem NT-Password sambaNTPassword #checkItem NT-Password userPassword Thanks. ----- Original Message ----- From: "Phil Mayers" <p.mayers@imperial.ac.uk> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Friday, February 10, 2006 20:06 Subject: Re: Peap and LDAP

Jefri bin Dahari wrote:

...

I thought this line in LDAP entry gives NT password.

sambaNTPassword: AA182541927C4597271A8CAE2393FA4E sambaLMPassword: 53DCAC0777C3A618AAD3B435B51404EE

It does - however, the default "ldap.attrmap" reads:

checkItem LM-Password lmPassword checkItem NT-Password ntPassword

Your attributes are named differently in LDAP, so you will need to update the 3rd field in that file for those attributes. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html