Beginner question to "known good password"
Hi List! The concept for "known good password" is something that really gives me a hard time to understand. Can anyone tell me what I have to change to make this setup working? I get the following debug-output: (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type The user in the User file is defined like this: testuser SMD5-Password := "6i2WbPPxOt2zLBrM/KzNEnRlc3Q=" , NAS-IP-Address == '10.0.0.29', Auth-Type := Accept ... and I have a NAS defined as a client: client ap29 { ipaddr = 10.0.0.29/32 secret = testing123 } see the full debug-output here: http://pastebin.com/raw/52eZPhQj -- Mit freundlichen Grüßen / Kind regards Julian Scharrenbach - Informatik Betriebswirt (VWA)
On Nov 25, 2016, at 7:58 AM, Julian Scharrenbach <j.scharrenbach@picotronic.de> wrote:
The concept for "known good password" is something that really gives me a hard time to understand.
That is the *good* password, or the *correct* password, as known to the server. The User-Password contains whatever string the user entered. Which may or may not be the same text as the good password. The server compares the User-Password to the "known good" password. If they're the same (or compatible, as with SMD5-Password), the user has entered the correct password, and the user is authenticated. If they're different, the user has entered the wrong password.
Can anyone tell me what I have to change to make this setup working?
Read the debug output.
I get the following debug-output:
(0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type
The user in the User file is defined like this:
testuser SMD5-Password := "6i2WbPPxOt2zLBrM/KzNEnRlc3Q=" , NAS-IP-Address == '10.0.0.29', Auth-Type := Accept
And you're testing with... (0) Received Access-Request Id 134 from 127.0.0.1:49494 to 127.0.0.1:1812 length 76 (0) User-Name = "ndavis" So... The User-Name doesn't match the entry in the "users" file. That's why it doesn't match. It's not the same. Alan DeKok.
Ok, that's a blatantly stupid error - sorry x.x BUT I get the exact same results using the right username with radtest: radtest ndavis testing 127.0.0.1 0 testing123 Sent Access-Request Id 162 from 0.0.0.0:36131 to 127.0.0.1:1812 length 76 User-Name = "ndavis" User-Password = "testing" NAS-IP-Address = 10.0.0.15 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "testing" Received Access-Reject Id 162 from 127.0.0.1:1812 to 0.0.0.0:0 length 20 (0) -: Expected Access-Accept got Access-Reject http://pastebin.com/raw/cbM1Yjad On 25.11.2016 14:04, Alan DeKok wrote:
The User-Name doesn't match the entry in the "users" file. That's why it doesn't match. It's not the same.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Mit freundlichen Grüßen / Kind regards Julian Scharrenbach - Informatik Betriebswirt (VWA) Picotronic GmbH Rudolf-Diesel-Strasse 2a 56070 Koblenz Germany Phone +49(0)261/983497-39 Fax +49(0)261/983497-10 Mail j.scharrenbach@picotronic.de Web www.picotronic.de HANDELSREGISTERGERICHT | CHAMBER OF COMMERCE Amtsgericht Koblenz HRB 20026 GESCHÄFTSFÜHRER | MANAGING DIRECTOR David Heckner SITZ DER GESELLSCHAFT | REGISTERED OFFICE Koblenz/Germany UST-IDNR. | VAT REG. NO. DE814473445 WEEE-REG.-NR. | WEEE-REG-NO. DE852313690 VERTRAULICHKEIT: Dieses e-mail und alle angehängten Dateien sind vertraulich und privilegiert. Sollten Sie nicht als namentlicher Empfänger aufgeführt sein, informieren Sie unverzüglich den Absender und machen Sie den Inhalt nicht für Dritte zugänglich, noch darf dieser gedruckt oder für andere Zwecke verwendet, kopiert oder auf irgend einem Medium gespeichert werden. CONFIDENTIALITY: This e-mail and any attachments are confidential and may be privileged. If you are not a named recipient, please notify the sender immediately and do not disclose the contents to another person, use it for any purpose or store or copy the information in any medium.
On Nov 25, 2016, at 8:32 AM, Julian Scharrenbach <j.scharrenbach@picotronic.de> wrote:
Ok, that's a blatantly stupid error - sorry x.x
BUT I get the exact same results using the right username with radtest:
radtest ndavis testing 127.0.0.1 0 testing123
Uh... the User-Name still doesn't match what's in the "users" file. Please *READ* the debug output, and pay attention to what you're doing. Alan DeKok.
sorry for the confusion. I did change the username in the users file beforehand: ndavis SMD5-Password := "6i2WbPPxOt2zLBrM/KzNEnRlc3Q=" , NAS-IP-Address == '10.0.0.29', Auth-Type := Accept On 25.11.2016 15:05, Alan DeKok wrote:
On Nov 25, 2016, at 8:32 AM, Julian Scharrenbach <j.scharrenbach@picotronic.de> wrote:
Ok, that's a blatantly stupid error - sorry x.x
BUT I get the exact same results using the right username with radtest:
radtest ndavis testing 127.0.0.1 0 testing123
Uh... the User-Name still doesn't match what's in the "users" file.
Please *READ* the debug output, and pay attention to what you're doing.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Mit freundlichen Grüßen / Kind regards Julian Scharrenbach - Informatik Betriebswirt (VWA)
On Nov 25, 2016, at 9:24 AM, julian s <j.scharrenbach@picotronic.de> wrote:
sorry for the confusion. I did change the username in the users file beforehand:
ndavis SMD5-Password := "6i2WbPPxOt2zLBrM/KzNEnRlc3Q=" , NAS-IP-Address == '10.0.0.29', Auth-Type := Accept
You need to start reading the messages you post to the list. It's not rocket science. You sent: Sent Access-Request Id 162 from 0.0.0.0:36131 to 127.0.0.1:1812 length 76 User-Name = "ndavis" User-Password = "testing" NAS-IP-Address = 10.0.0.15 And... why doesn't that match the entry in the "users" file? Alan DeKok.
Last time i looked, 10.0.0.29 does not equal 10.0.0.15 ...and neither does it equal 127.0.0.1. Also, remove the Auth-Type Accept stuff from the check line! alan
sorry for the confusion. I did change the username in the users file beforehand:
ndavis SMD5-Password := "6i2WbPPxOt2zLBrM/KzNEnRlc3Q=" , NAS-IP-Address == '10.0.0.29', Auth-Type := Accept
Did you restart FreeRADIUS? Files are *not* read dynamically. They are loaded once, on startup. Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.
participants (5)
-
Alan Buxey -
Alan DeKok -
julian s -
Julian Scharrenbach
-
Stefan Paetow