Plain text password file
Can somebody explain howto use rlm_passwd and a textfile with this setup: name:password:group and so on the order can be any way around, spaces can also be present. Any pointers will be gladly excepted. A sweet tutorial will result in a free night out in Borås, Sweden /Alex -- When there is no solution, there is no problem.
Alexander Lund wrote:
Can somebody explain howto use rlm_passwd and a textfile with this setup: name:password:group and so on the order can be any way around, spaces can also be present.
Wait: Are you saying that the file you *supply* freeradius may have spaces in it? That won't work, fix the file (it's not hard). Assuming that's not what you mean, and a format of: username:unixCryptPassword:ASingleGroupName ...then this should suffice: modules { passwd user_pass_group { filename = /path/to/file format = "*User-Name:~Crypt-Password:~Group" } pap { encryption_scheme = crypt } } authorize { preprocess user_pass_group } authenticate { Auth-Type PAP { pap } } ...it's so trivial I assume you need more than this. Are you having a specific problem? If you want to use other schemes such as chap, you may need the plaintext password, for example: for username:plaintextPassword:ASingleGroup modules { passwd u_g_p { filename = /path/to/file format = "*User-Name:~User-Password:~Group" } pap { encryption_scheme = clear } chap { } } authorize { preprocess u_g_p chap pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } }
On 19/12/05, Phil Mayers <p.mayers@imperial.ac.uk> wrote:
Alexander Lund wrote:
Can somebody explain howto use rlm_passwd and a textfile with this setup: name:password:group and so on the order can be any way around, spaces can also be present.
Wait: Are you saying that the file you *supply* freeradius may have spaces in it? That won't work, fix the file (it's not hard). Assuming that's not what you mean, and a format of:
username:unixCryptPassword:ASingleGroupName
...then this should suffice:
modules { passwd user_pass_group { filename = /path/to/file format = "*User-Name:~Crypt-Password:~Group" } pap { encryption_scheme = crypt } }
authorize { preprocess user_pass_group } authenticate { Auth-Type PAP { pap } }
...it's so trivial I assume you need more than this. Are you having a specific problem? If you want to use other schemes such as chap, you may need the plaintext password, for example:
for username:plaintextPassword:ASingleGroup
modules { passwd u_g_p { filename = /path/to/file format = "*User-Name:~User-Password:~Group" } pap { encryption_scheme = clear } chap { } } authorize { preprocess u_g_p chap pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } } - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
No, the file I supply could have spaces if you needed it to solve my problem. This is just the thing I need: username:plaintextPassword:ASingleGroup Its perfect, but I´d like to know exactly what Im doing so heres another question, The passwordfile. If Im not thinking completly wrong it shouldn´t have any headers or a fileextension And do I have to use Chap? or can I use PAP with plain text passwords. Thanks for the help. If you come to sweden I will buy you enough beers to make you regret coming here ;) -- When there is no solution, there is no problem.
Alexander Lund wrote:
No, the file I supply could have spaces if you needed it to solve my problem.
Ok that's fine then
This is just the thing I need: username:plaintextPassword:ASingleGroup
Its perfect, but I´d like to know exactly what Im doing so heres another question, The passwordfile. If Im not thinking completly wrong it shouldn´t have any headers or a fileextension
It definitely shouldn't have any headers. The actual name of the file is irrelevant, including extension - FreeRadius doesn't care.
And do I have to use Chap? or can I use PAP with plain text passwords.
No, PAP is easy to do - the first example can be trivially modified to: modules { passwd user_pass_group { filename = /path/to/file format = "*User-Name:~User-Password:~Group" } pap { encryption_scheme = clear } } authorize { preprocess user_pass_group } authenticate { Auth-Type PAP { pap } } ...the only different is you put "User-Password" in the file format, telling it the cleartext password is there, and tell PAP not to bother recrypting (encryption_scheme = clear) One final thing to note - FreeRadius does NOT see changes to the file after it has started up. You will need to HUP the server for the file to be reloaded into memory. Hope that helps.
participants (2)
-
Alexander Lund -
Phil Mayers