1rlm_pap(5) FreeRADIUS Module rlm_pap(5)
2
6 rlm_pap - FreeRADIUS Module
7
9 The rlm_pap module authenticates RADIUS Access-Request packets that
10 contain a User-Password attribute. The module should also be listed
11 last in the authorize section, so that it can set the Auth-Type
12 attribute as appropriate.
13 When a RADIUS packet contains a clear-text password in the form of a
15 User-Password attribute, the rlm_pap module may be used for authentica‐
16 tion. The module requires a "known good" password, which it uses to
17 validate the password given in the RADIUS packet. That "known good"
18 password must be supplied by another module (e.g. rlm_files, rlm_ldap,
19 etc.), and is usually taken from a database.
20
22 The only configuration item is:
23 normalise
25 The default is "yes". This means that the module will try to
26 automatically detect passwords that are hex- or base64-encoded
27 and decode them back to their binary representation. However,
28 some clear text passwords may be erroneously converted. Setting
29 this to "no" prevents that conversion.
30
32 The module looks for the Password-With-Header control attribute to find
33 the "known good" password. The attribute value comprises the header
34 followed immediately by the password data. The header is given by the
35 following table.
36 Header Attribute Description
38 ------ --------- -----------
39 {clear} Cleartext-Password Clear-text passwords
40 {cleartext} Cleartext-Password Clear-text passwords
41 {crypt} Crypt-Password Unix-style "crypt"ed passwords
42 {md5} MD5-Password MD5 hashed passwords
43 {base64_md5} MD5-Password MD5 hashed passwords
44 {smd5} SMD5-Password MD5 hashed passwords, with a salt
45 {sha} SHA-Password SHA1 hashed passwords
46 SHA1-Password SHA1 hashed passwords
47 {ssha} SSHA-Password SHA1 hashed passwords, with a salt
48 {sha2} SHA2-Password SHA2 hashed passwords
49 {sha224} SHA2-Password SHA2 hashed passwords
50 {sha256} SHA2-Password SHA2 hashed passwords
51 {sha384} SHA2-Password SHA2 hashed passwords
52 {sha512} SHA2-Password SHA2 hashed passwords
53 {ssha224} SSHA2-224-Password SHA2 hashed passwords, with a salt
54 {ssha256} SSHA2-256-Password SHA2 hashed passwords, with a salt
55 {ssha384} SSHA2-384-Password SHA2 hashed passwords, with a salt
56 {ssha512} SSHA2-512-Password SHA2 hashed passwords, with a salt
57 {nt} NT-Password Windows NT hashed passwords
58 {nthash} NT-Password Windows NT hashed passwords
59 {md4} NT-Password Windows NT hashed passwords
60 {x-nthash} NT-Password Windows NT hashed passwords
61 {ns-mta-md5} NS-MTA-MD5-Password Netscape MTA MD5 hashed passwords
62 {x- orcllmv} LM-Password Windows LANMAN hashed passwords
63 {X- orclntv} NT-Password Windows NT hashed passwords
64 The module tries to be flexible when handling the various password for‐
66 mats. It will automatically handle Base-64 encoded data, hex strings,
67 and binary data, and convert them to a format that the server can use.
68 If there is no Password-With-Header attribute, the module looks for one
70 of the Cleartext-Password, NT-Password, Crypt-Password, etc. attributes
71 as listed in the above table. These attributes should contain the rele‐
72 vant format password directly, without the header prefix.
73 Only one control attribute should be set, otherwise behaviour is unde‐
75 fined as to which one is used for authentication.
76
78 It is important to understand the difference between the User-Password
79 and Cleartext-Password attributes. The Cleartext-Password attribute is
80 the "known good" password for the user. Simply supplying the Cleart‐
81 ext-Password to the server will result in most authentication methods
82 working. The User-Password attribute is the password as typed in by
83 the user on their private machine. The two are not the same, and
84 should be treated very differently. That is, you should generally not
85 use the User-Password attribute anywhere in the RADIUS configuration.
86
88 authorize authenticate
89
91 /etc/raddb/mods-available/pap
92
94 radiusd(8), radiusd.conf(5)
95
97 Alan DeKok <aland@freeradius.org>
98 10 January 2015 rlm_pap(5)