rlm_pap(5) FreeRADIUS Module rlm_pap(5)
NAME
rlm_pap - FreeRADIUS Module
DESCRIPTION
The rlm_pap module authenticates RADIUS Access-Request packets that
contain a User-Password attribute. The module should also be listed
last in the authorize section, so that it can set the Auth-Type attri-
bute as appropriate.
When a RADIUS packet contains a clear-text password in the form of a
User-Password attribute, the rlm_pap module may be used for authentica-
tion. The module requires a "known good" password, which it uses to
validate the password given in the RADIUS packet. That "known good"
password must be supplied by another module (e.g. rlm_files, rlm_ldap,
etc.), and is usually taken from a database.
CONFIGURATION
The only configuration item is:
normalise
The default is "yes". This means that the module will try to
automatically detect passwords that are hex- or base64-encoded
and decode them back to their binary representation. However,
some clear text passwords may be erroneously converted. Setting
this to "no" prevents that conversion.
USAGE
The module looks for the Password-With-Header control attribute to find
the "known good" password. The attribute value comprises the header
followed immediately by the password data. The header is given by the
following table.
Header Attribute Description
------ --------- -----------
{clear} Cleartext-Password Clear-text passwords
{cleartext} Cleartext-Password Clear-text passwords
{crypt} Crypt-Password Unix-style "crypt"ed passwords
{md5} MD5-Password MD5 hashed passwords
{base64_md5} MD5-Password MD5 hashed passwords
{smd5} SMD5-Password MD5 hashed passwords, with a salt
{sha} SHA-Password SHA1 hashed passwords
SHA1-Password SHA1 hashed passwords
{ssha} SSHA-Password SHA1 hashed passwords, with a salt
{sha2} SHA2-Password SHA2 hashed passwords
{sha224} SHA2-Password SHA2 hashed passwords
{sha256} SHA2-Password SHA2 hashed passwords
{sha384} SHA2-Password SHA2 hashed passwords
{sha512} SHA2-Password SHA2 hashed passwords
{ssha224} SSHA2-224-Password SHA2 hashed passwords, with a salt
{ssha256} SSHA2-256-Password SHA2 hashed passwords, with a salt
{ssha384} SSHA2-384-Password SHA2 hashed passwords, with a salt
{ssha512} SSHA2-512-Password SHA2 hashed passwords, with a salt
{nt} NT-Password Windows NT hashed passwords
{nthash} NT-Password Windows NT hashed passwords
{md4} NT-Password Windows NT hashed passwords
{x-nthash} NT-Password Windows NT hashed passwords
{ns-mta-md5} NS-MTA-MD5-Password Netscape MTA MD5 hashed passwords
{x- orcllmv} LM-Password Windows LANMAN hashed passwords
{X- orclntv} NT-Password Windows NT hashed passwords
The module tries to be flexible when handling the various password for-
mats. It will automatically handle Base-64 encoded data, hex strings,
and binary data, and convert them to a format that the server can use.
If there is no Password-With-Header attribute, the module looks for one
of the Cleartext-Password, NT-Password, Crypt-Password, etc. attributes
as listed in the above table. These attributes should contain the rele-
vant format password directly, without the header prefix.
Only one control attribute should be set, otherwise behaviour is unde-
fined as to which one is used for authentication.
NOTES
It is important to understand the difference between the User-Password
and Cleartext-Password attributes. The Cleartext-Password attribute is
the "known good" password for the user. Simply supplying the Cleart-
ext-Password to the server will result in most authentication methods
working. The User-Password attribute is the password as typed in by
the user on their private machine. The two are not the same, and
should be treated very differently. That is, you should generally not
use the User-Password attribute anywhere in the RADIUS configuration.
SECTIONS
authorize authenticate
FILES
/etc/raddb/mods-available/pap
SEE ALSO
radiusd(8), radiusd.conf(5)
AUTHOR
Alan DeKok <aland@freeradius.org>
10 January 2015 rlm_pap(5)