всем здрасти,
тут кто-нибуть юзал вот такую аудентификацию в радиусе?
http://freeradius.org/radiusd/man/rlm_digest.html
работает? на какой версии?
я пробовал 1.1.3, 2.1.8 на разныхверсиях получаю разные ошибки
напрмер с 2.1.8
[digest] Adding Auth-Type = DIGEST
++[digest] returns ok
Found Auth-Type = digest
+- entering group authenticate {...}
[digest] Cleartext-Password or Digest-HA1 is required for authentication.
++[digest] returns invalid
Failed to authenticate the user.
Login incorrect: [test/test] (from client localhost port 0)
Delaying reject of request 0 for 1 seconds
1.1.3
EXPECTED 609ebd20a487dc1e509ae5eecceac3c9
RECEIVED 631d6d73147add2f9e437f59bbc3aeb7
rlm_digest: FAILED authentication
modcall[authenticate]: module «digest» returns reject for request 0
modcall: leaving group authenticate (returns reject) for request 0
запрос клиента
radclient -x localhost auth secret << EOF
User-Name = «test»,
User-Password = «test»,
Digest-Response = «631d6d73147add2f9e437f59bbc3aeb7»,
Digest-Realm = «testrealm»,
Digest-Nonce = «1234abcd»,
Digest-Method = «REGISTER»,
Digest-URI = «sip:5555551212@example.com»,
Digest-Algorithm = «MD5»,
Digest-User-Name = «test»,
Message-Authenticator = «»
EOF
Sending Access-Request of id 81 to 127.0.0.1 port 1812
User-Name = «test»
User-Password = «test»
Digest-Response = «631d6d73147add2f9e437f59bbc3aeb7»
Digest-Realm = «\001\013testrealm»
Digest-Nonce = «\002\n1234abcd»
Digest-Method = «\003\nREGISTER»
Digest-URI = «\004\034sip:5555551212@example.com»
Digest-Algorithm = «\006\005MD5»
Digest-User-Name = «\n\006test»
Message-Authenticator = 0x00000000000000000000000000000000
rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=81, length=20
файлик users... (так же пробовал без пароля)
test Auth-Type := Digest, User-Password = «test»
Reply-Message = «Hello, test with digest»
вот такой конфиг радиуса для 1.1.3
prefix = /usr
exec_prefix = /usr
sysconfdir = /etc
localstatedir = /var
sbindir = /usr/sbin
logdir = ${localstatedir}/log/radius
raddbdir = ${sysconfdir}/raddb
radacctdir = ${logdir}/radacct
confdir = ${raddbdir}
run_dir = ${localstatedir}/run/radiusd
log_file = ${logdir}/radius.log
libdir = /usr/lib
pidfile = ${run_dir}/radiusd.pid
user = radiusd
group = radiusd
max_request_time = 30
delete_blocked_requests = no
cleanup_delay = 5
max_requests = 1024
bind_address = 127.0.0.1
port = 0
hostname_lookups = no
allow_core_dumps = no
regular_expressions = yes
extended_expressions = yes
log_stripped_names = no
log_auth = no
log_auth_badpass = no
log_auth_goodpass = no
usercollide = no
lower_user = no
lower_pass = no
nospace_user = no
nospace_pass = no
checkrad = ${sbindir}/checkrad
security {
max_attributes = 200
reject_delay = 1
status_server = no
}
proxy_requests = yes
$INCLUDE ${confdir}/proxy.conf
$INCLUDE ${confdir}/clients.conf
snmp = no
$INCLUDE ${confdir}/snmp.conf
thread pool {
start_servers = 5
max_servers = 32
min_spare_servers = 3
max_spare_servers = 10
max_requests_per_server = 0
}
modules {
files {
usersfile = ${confdir}/users
acctusersfile = ${confdir}/acct_users
preproxy_usersfile = ${confdir}/preproxy_users
compat = no
}
detail {
detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d
detailperm = 0600
}
acct_unique {
key = «User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port»
}
radutmp {
filename = ${logdir}/radutmp
username = %{User-Name}
case_sensitive = yes
check_with_nas = yes
perm = 0600
callerid = «yes»
}
radutmp sradutmp {
filename = ${logdir}/sradutmp
perm = 0644
callerid = «no»
}
attr_filter {
attrsfile = ${confdir}/attrs
}
always fail {
rcode = fail
}
always reject {
rcode = reject
}
always ok {
rcode = ok
simulcount = 0
mpp = no
}
digest {
}
}
authorize {
digest
files
}
authenticate {
digest
}
accounting {
detail
}