Porting eduroam from 2 to 3

[Olivier]

Thank you Alan,

Alan DeKok <aland at deployingradius.com> writes:

> On Sep 27, 2017, at 4:52 AM, Olivier <Olivier.Nicole at cs.ait.ac.th> wrote:
>> So far, the authorize is OK, but the Auth-Type is set to inner-eap and
>> it will not try another LDAP bind in the authentication section:
>
>   Because LDAP bind doesn't work with MS-CHAP.

Yes, I know that.

>> (8) ldap_wifi: EXPAND (&(csimAccountPermission=firewall)(uid=%{%{Stripped-User-Name}:-%{User-Name}}))
>> (8) ldap_wifi:    --> (&(csimAccountPermission=firewall)(uid=on))
>> (8) ldap_wifi: Performing search in "ou=People,ou=csim,dc=cs,dc=ait,dc=ac,dc=th" with filter "(&(csimAccountPermission=firewall)(uid=on))", scope "one"
>> (8) ldap_wifi: Waiting for search result...
>> (8) ldap_wifi: User object found at DN "uid=on,ou=People,ou=csim,dc=cs,dc=ait,dc=ac,dc=th"
>> (8) ldap_wifi: Processing user attributes
>> (8) ldap_wifi: control:Password-With-Header += '{MD5}something=='
>
>   Read this page:
>
> http://deployingradius.com/documents/protocols/compatibility.html
>
>> (8) inner-eap: Peer sent packet with method EAP MSCHAPv2 (26)
>> (8) inner-eap: Calling submodule eap_mschapv2 to process data
>> (8) eap_mschapv2: # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-eduroam
>> (8) eap_mschapv2:   authenticate {
>> (8) mschap: WARNING: No Cleartext-Password configured.  Cannot create NT-Password
>> (8) mschap: WARNING: No Cleartext-Password configured.  Cannot create LM-Password
>> (8) mschap: Creating challenge hash with username: on at cs.ait.ac.th
>> (8) mschap: Client is using MS-CHAPv2
>
>   MD5 hashed passwords won't work with MSCHAP.
>
>> In version2, I used to have:
>
>   And v2 also didn't work with MD5 hashed passwords and PEAP.

I have a version 2 working, where the WiFi sends the password to
FreeRadius and FreeRadius uses that password to bind to LDAP.

I have been pretty happy with letting LDAP do the authentication so far.

>   You need to:
>
> a) put clear-text (or nt-hash) passwords into the DB
>
>   or
>
> b) use an EAP method which is compatible with MD5 passwords, such as EAP-TTLS with PAP.

I have been trying to do that, following the tutorial on
http://wiki.freeradius.org/guide/eduroam but I don't understand what
need to be changed to that effect.

Thanks,

Olivier

>   Pick one.
>
>   Alan DeKok.
>
>
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

--