Password attrib problem
hi all, i have a little problem with user-password attrib. i get the usr password as plain-text in my authorize function of rlm_sql module .when get it from request...... but i want to get it from request in accounting function of rlm_Sql module. its encrypted why........ char *pass[25]; pass =request->password->strvalue; printf("password is : %s",pass); on console its shows like #password is : ?0t\364\237 have any one deal with this problem.plz share your experience with me to overcome this issur. thanks in advance. -- Best regards Yawar Hadi Noshahi QAU Islamabad (+92-0300-5504798)
Yawar Hadi wrote:
i have a little problem with user-password attrib. i get the usr password as plain-text in my authorize function of rlm_sql module .when get it from request...... but i want to get it from request in accounting function of rlm_Sql module. its encrypted why........
Because it doesn't exist. "request->password" is probably NULL. Alan DeKok.
thanks ALan, now when i send User-Password attrib in accounting stop request,and get it value like pair=pairfind(request->vps,PW_User_Password); strcpy(pass,pair->strvalue; printf(pass); it show pass= "\322N\341U*" but i am sending it like User-Password="yawar" from NTRADPing client; how to get plain text password in accounting stop request thanks ALan once again On Wed, Sep 10, 2008 at 7:03 PM, Alan DeKok <aland@deployingradius.com>wrote:
Yawar Hadi wrote:
i have a little problem with user-password attrib. i get the usr password as plain-text in my authorize function of rlm_sql module .when get it from request...... but i want to get it from request in accounting function of rlm_Sql module. its encrypted why........
Because it doesn't exist. "request->password" is probably NULL.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Best regards Yawar Hadi Noshahi QAU Islamabad (+92-0300-5504798)
Yawar Hadi wrote:
now when i send User-Password attrib in accounting stop request,and get it value like
User-Passwords don't belong in accounting packets.
pair=pairfind(request->vps,PW_User_Password); strcpy(pass,pair->strvalue; printf(pass);
it show pass= "\322N\341U*"
Why are you looking at the source code when you can run the server in debugging mode? And your C code really needs to check for errors. Without that, there's no guarantee if it's correct or not. Alan DeKok.
dear alan, my code is correct .i know user-password not belongs to accounting packets.but its a requirment to have user-password in accounting packet. and code is correct 100 %. so kindly u just suggest me how i can get plain text password in accounting stop packets. i am using ntradpind to send request is ntradping encrypet it and send it to radius server if so then how i can decrypt it. thanks in advance if you get me out of this.... On Thu, Sep 11, 2008 at 12:19 PM, Alan DeKok <aland@deployingradius.com>wrote:
Yawar Hadi wrote:
now when i send User-Password attrib in accounting stop request,and get it value like
User-Passwords don't belong in accounting packets.
pair=pairfind(request->vps,PW_User_Password); strcpy(pass,pair->strvalue; printf(pass);
it show pass= "\322N\341U*"
Why are you looking at the source code when you can run the server in debugging mode?
And your C code really needs to check for errors. Without that, there's no guarantee if it's correct or not.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Best regards Yawar Hadi Noshahi QAU Islamabad (+92-0300-5504798)
Yawar Hadi wrote:
dear alan, my code is correct
It's not. The pairfind() function MAY return NULL. You are not checking for this. .i know user-password not belongs to
accounting packets.but its a requirment to have user-password in accounting packet.
For who? Your local configuration? Sorry... User-Passwords CANNOT and MUST NOT appear in accounting packets. Putting them in accounting packets is a security problem.
and code is correct 100 %. so kindly u just suggest me how i can get plain text password in accounting stop packets.
Have you bothered running the server in debugging mode as I suggested? If the password is printed there, then it's in the packet, it's decoded correctly, and your code is wrong. If the password isn't printed there, then it's not supposed to be in accounting packets. Alan DeKok.
participants (2)
-
Alan DeKok -
Yawar Hadi