incorrect shared secret entry authenticates successfully for freerradius

2008-03-18 Thread sanjeev.kumarroy
Hi, I am using the following configuration: O/S: rhel4_u5_i386 Freeradius 1.1.7 Client to test: NTRadPing 1.5 Steps undertaken: - Installed a fresh system with rhel4_u5_i386 - Build and compile freeradius 1.1.7 on it. - Update the clients.conf file to add the client entries

Re: incorrect shared secret entry authenticates successfully for freerradius

2008-03-18 Thread Phil Mayers
[EMAIL PROTECTED] wrote: Hi, I am using the following configuration: O/S: rhel4_u5_i386 Freeradius 1.1.7 Client to test: NTRadPing 1.5 Steps undertaken: - Installed a fresh system with rhel4_u5_i386 - Build and compile freeradius 1.1.7 on it. - Update the clients.conf

Re: incorrect shared secret entry authenticates successfully for freerradius

2008-03-18 Thread Alan DeKok
[EMAIL PROTECTED] wrote: - However when the same cases are tried for CHAP we can see the difference. In the first case the authentication is successful; however when we give a junk shared secret the authentication should ideally have been rejected. The key word is ideally. RADIUS isn't

Re: incorrect shared secret entry authenticates successfully for freerradius

2008-03-18 Thread Alan DeKok
Phil Mayers wrote: If your NAS supply Message-Authenticator, you could refuse packets without one: Edit the client section and set require_message_authenticator = yes. The recommendations of RFC 5080 have been implemented in FreeRADIUS. Sometimes years before any other RADIUS server.

Re: incorrect shared secret entry authenticates successfully for freerradius

2008-03-18 Thread Phil Mayers
Alan DeKok wrote: Phil Mayers wrote: If your NAS supply Message-Authenticator, you could refuse packets without one: Edit the client section and set require_message_authenticator = yes. Ah thanks - I didn't know about that The recommendations of RFC 5080 have been implemented in