Re: FreeRadius + MySql + Crypt-Password unable to authenticate
Marcel Kraan wrote:
I'am marcel kraan from Holland and i have a problem with Crypt-passwords in the mysql table. FreeRadius is working really great with "Cleartext-Password" but it does not authenticate with "Crypt-password"
You can't use Crypt-Password and MS-CHAP. http://deployingradius.com/documents/protocols/compatibility.html Alan DeKok.
Yes i want to use "PAP" (?) but where do i change that? into my Wifi router ? or in the Freeradius config? On 29 jul. 2013, at 13:52, Alan DeKok <aland@deployingradius.com> wrote:
Marcel Kraan wrote:
I'am marcel kraan from Holland and i have a problem with Crypt-passwords in the mysql table. FreeRadius is working really great with "Cleartext-Password" but it does not authenticate with "Crypt-password"
You can't use Crypt-Password and MS-CHAP.
http://deployingradius.com/documents/protocols/compatibility.html
Alan DeKok.
Marcel Kraan wrote:
Yes i want to use "PAP" (?) but where do i change that? into my Wifi router ? or in the Freeradius config?
No. You're doing 802.1X to the WiFi router. You *cannot* use PAP. You cannot pick an authentication protocol and demand that everyone use it. The AP, client PC, etc. have already made choices which you cannot control. You have to live within that framework. Alan DeKok.
I very clear understands.. thanks for the help On 29 jul. 2013, at 14:07, Alan DeKok <aland@deployingradius.com> wrote:
Marcel Kraan wrote:
Yes i want to use "PAP" (?) but where do i change that? into my Wifi router ? or in the Freeradius config?
No.
You're doing 802.1X to the WiFi router. You *cannot* use PAP.
You cannot pick an authentication protocol and demand that everyone use it. The AP, client PC, etc. have already made choices which you cannot control. You have to live within that framework.
Alan DeKok.
By default PAP, CHAP.. are enabled in FR. You may need to change the authentication settings in your client. i.e Wifi Router to send PAP enabled access-request. On Mon, Jul 29, 2013 at 5:25 PM, Marcel Kraan <marcel@kraan.net> wrote:
Yes i want to use "PAP" (?) but where do i change that? into my Wifi router ? or in the Freeradius config?
On 29 jul. 2013, at 13:52, Alan DeKok <aland@deployingradius.com> wrote:
Marcel Kraan wrote:
I'am marcel kraan from Holland and i have a problem with Crypt-passwords in the mysql table. FreeRadius is working really great with "Cleartext-Password" but it does not authenticate with "Crypt-password"
You can't use Crypt-Password and MS-CHAP.
http://deployingradius.com/documents/protocols/compatibility.html
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- br, Navodit Bhardwaj Hughes Systique Corporation
Thanks… i think my wifi router does not have that option… On 29 jul. 2013, at 14:15, Navodit Bhardwaj <navodit.bhardwaj@gmail.com> wrote:
By default PAP, CHAP.. are enabled in FR. You may need to change the authentication settings in your client. i.e Wifi Router to send PAP enabled access-request.
On Mon, Jul 29, 2013 at 5:25 PM, Marcel Kraan <marcel@kraan.net> wrote: Yes i want to use "PAP" (?) but where do i change that? into my Wifi router ? or in the Freeradius config?
On 29 jul. 2013, at 13:52, Alan DeKok <aland@deployingradius.com> wrote:
Marcel Kraan wrote:
I'am marcel kraan from Holland and i have a problem with Crypt-passwords in the mysql table. FreeRadius is working really great with "Cleartext-Password" but it does not authenticate with "Crypt-password"
You can't use Crypt-Password and MS-CHAP.
http://deployingradius.com/documents/protocols/compatibility.html
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- br, Navodit Bhardwaj Hughes Systique Corporation - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Mon, Jul 29, 2013 at 7:39 PM, Marcel Kraan <marcel@kraan.net> wrote:
Thanks… i think my wifi router does not have that option…
On 29 jul. 2013, at 14:15, Navodit Bhardwaj <navodit.bhardwaj@gmail.com> wrote:
By default PAP, CHAP.. are enabled in FR. You may need to change the authentication settings in your client. i.e Wifi Router to send PAP enabled access-request.
On Mon, Jul 29, 2013 at 5:25 PM, Marcel Kraan <marcel@kraan.net> wrote:
Yes i want to use "PAP" (?) but where do i change that? into my Wifi router ? or in the Freeradius config?
As Phil said, you need to change it in the client. If you have windows 8 clients, IIRC it has built-in support for PEAP-GTC and TTLS-PAP (which is also supported by linux, android, macs). In both cases the client passes cleartext password inside encrypted tunnel, so crypt passwords on FR side should work fine. If you have older windows clients, and don't have third-party PEAP-GTC/TTLS-PAP-capable supplicant, then you're stuck with EAP-MSCHAP, so you need to store password as clear text or nt-hash. -- Fajar
Thanks. I have a genius en202 outdoor wifi router and i don't think i can change it to use PAP. So i'am only able to use ClearText-Password? If i'am wrong i will be very happy -- Marcel Kraan +31654378837
On 29 jul. 2013, at 15:04, "Fajar A. Nugraha" <list@fajar.net> wrote:
On Mon, Jul 29, 2013 at 7:39 PM, Marcel Kraan <marcel@kraan.net> wrote: Thanks… i think my wifi router does not have that option…
On 29 jul. 2013, at 14:15, Navodit Bhardwaj <navodit.bhardwaj@gmail.com> wrote:
By default PAP, CHAP.. are enabled in FR. You may need to change the authentication settings in your client. i.e Wifi Router to send PAP enabled access-request.
On Mon, Jul 29, 2013 at 5:25 PM, Marcel Kraan <marcel@kraan.net> wrote: Yes i want to use "PAP" (?) but where do i change that? into my Wifi router ? or in the Freeradius config?
As Phil said, you need to change it in the client.
If you have windows 8 clients, IIRC it has built-in support for PEAP-GTC and TTLS-PAP (which is also supported by linux, android, macs). In both cases the client passes cleartext password inside encrypted tunnel, so crypt passwords on FR side should work fine.
If you have older windows clients, and don't have third-party PEAP-GTC/TTLS-PAP-capable supplicant, then you're stuck with EAP-MSCHAP, so you need to store password as clear text or nt-hash.
-- Fajar - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (5)
-
Alan DeKok -
Fajar A. Nugraha -
Marcel Kraan -
Navodit Bhardwaj -
Phil Mayers