April 2012 - Freeradius-Users - lists.freeradius.org

[Home server Radius in "always accept mode with mschap"]
by Thomas Fagart 20 Apr '12

20 Apr '12

Hello, As we've got some bad ISPs or maybe because they use other radius than freeradius :-), we would like, when their home server does not work properly (bad response time or completely down), to continue authenticating wimax users on our proxy. (So that users does not get disconnected after their lease / network entry). So I wanted to build a "welcome" home server (meaning a home server that always say yes whithout checking anything). I've tried a physical one and also a dedicated virtual server that I use either as fallback home server or as secondary home server. I've successfully been able to send "Access Accept" for any Access Request by configuring the following : authorize { preprocess auth_log chap mschap unix files if (!ok) { reject } else { update control { Auth-Type := Accept } } expiration logintime pap } .... But then it's not enough, Mschap Attributes are required so that it really work (below is "normal" authentication when ISPs home server answer). on Dec 5 11:37:39 2011 : Debug: Received Access-Accept packet from host X.Y.Z.W port 1812, id=98, length=184 Mon Dec 5 11:37:39 2011 : Debug: MS-CHAP2-Success = 0x78533d44303235443041393935354646383733384143443137364244433544463336393436373139333937 Mon Dec 5 11:37:39 2011 : Debug: MS-MPPE-Recv-Key = 0xa0d43ffe6f017d74813ad8d12b35797e Mon Dec 5 11:37:39 2011 : Debug: MS-MPPE-Send-Key = 0x5f6a95b54ef1d283134925733845429a Mon Dec 5 11:37:39 2011 : Debug: MS-MPPE-Encryption-Policy = 0x00000001 Mon Dec 5 11:37:39 2011 : Debug: MS-MPPE-Encryption-Types = 0x00000006 Mon Dec 5 11:37:39 2011 : Debug: Proxy-State = 0x323233 Mon Dec 5 11:37:39 2011 : Debug: +- entering group post-proxy {...} As I was not very familiar with MS-CHAP, I've google a little and it seems to me that my goal (ie ms chapv2 welcome server without having user/passwd of users) is not reachable as the home server MUST have users/passwd to generate challenge. Could you confirm that I'm not wrong so that I will stop looking for unfeasible things ? Many thanks Thomas

4 7

Re: Help: PAP with Sha1
by alan buxey 20 Apr '12

20 Apr '12

Hi, > Although the AVP User-Password is shown here in clear text, it was not > transmitted to the server in clear text. FreeRADIUS uses the shared secret > to encrypt and decrypt the value of the User-Password AVP. correct. it was encrypted using the shared-secret , the RFCs give full documentation on how this works. > This is what I am looking for. What is the place where RADIUS does > decrypt operation. just using SHA1 one wont make it FIPS compliant as far as I can see - if it did then there would have been a mas rush for a new RADIUS RFC with such a 'simple' change. if you want to use 'industrial strength' for the transport of credentiuals in then use RADIUS with TLS over TCP (aka RADSEC). alternatively, dont use PAP for the password! make the User-Password be SHA1 or SHA256 instead....the server can quite easily decode those to deal with the authentication....and if anyone does lurk around able to break the shared-secret (which is plausible if you dont have control of the network, client , NAS etc) then they'd be faced with a nice SHA1 or SHA256....so the same result as using SHA for the shared-secret with no messing with code. alan

1 0

Re: Help: PAP with Sha1
by vishal_nitr 20 Apr '12

20 Apr '12

Hi Alan,    thanks for the mail. This is what we read about request authenticationAccess-Request arrives  When the packet arrives at the FreeRADIUS server it is indicated by the following part:rad_recv: Access-Request packet from host 127.0.0.1 port 48698,  id=73, length=57      User-Name = "alice"      User-Password = "passme"      NAS-IP-Address = 127.0.1.1      NAS-Port = 100We see that the incoming request contains four AVPs.Although the AVP User-Password is shown here in clear text, it was not transmitted to the server in clear text. FreeRADIUS uses the shared secret to encrypt and decrypt the value of the User-Password AVP.   This is what I am looking for. What is the place where RADIUS does decrypt operation. Thanks and Regards, Vishal Kotalwar, Bangalore-35. 09900055647. From: alan buxey <A.L.M.Buxey(a)lboro.ac.uk> Sent: Fri, 20 Apr 2012 16:50:14 To: "vishal_nitr(a)rediffmail.com" <vishal_nitr(a)rediffmail.com>, FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Help: PAP with Sha1 Hi, >        I tried changing few things in lib/radius.c to SHA1 but with no >    success. please post full putput form radiusd -X regarding using SHA1 - easy, just ensure that your passwords are stored as SHA1 objects - the docs say how to do this alan

1 0

RE: MSSCHAP auth + LDAP authorizaton (Working. Sort Of)
by Andres Septer 20 Apr '12

20 Apr '12

OK, I achieved my goal to get freeradius authenticate via mschap challenge-response and authorize via LDAP search. I's working, though, I'm not sure, that I'm doing it right. This "solution" works only with one group (my example, VPNusers). I think it is not expandable to the scenario like: "authorize user when it belongs to the group VPNusers autohorize user when it comes form IP of some WiFi access point disregarding any groups" So, I'm looking forward to any suggestions how to make this configuration better and expandable. But this far, when you have only one group and no IF, AND, OR logic is neccessary, following will work: MSCHAP Follow this great tutorial http://deployingradius.com/documents/configuration/active_directory.html If last part gives you an error (like it did to me) check if freeradius user have rights to talk with winbind. ldap module conf ldap { <------>server = "local.track.ee" <------>identity = "CN=ldapbind,OU=SBSUsers,OU=Users,OU=Navirec,DC=local,DC=track,DC=ee" <------>password = "XXXXXXXXXXXXXXX" #Note to Tobias Haschmer - ldapbind user needs to be specifically configured in AD! # follow this instruction http://www.advproxy.net/ldapads.html <------>basedn = "DC=local,DC=track,DC=ee" <------>filter = "(&(SAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})(memberOf=CN=VPNUsers,OU=SBSUsers,OU=Users,OU=Navirec,DC=local,DC=track,DC=ee))" <------>#base_filter = "(objectclass=radiusprofile)" Suggestions: test your queries and ldap stuff on some LDAP client. Like JExplorer (its free) #magic parameters for AD LDAP to work <------> chase_referrals = yes <------> rebind = yes inner-tunnel and default, authorize stanza >ldap { <------> notfound = reject <------> } It's not very flexible configuration, list user Matthew Newton had some ideas, how to make it better. A.

2 1

Re: Help: PAP with Sha1
by vishal_nitr 20 Apr '12

20 Apr '12

Hi Phill,    Thanks for mail. I don't know how you arrived at that string is not SHA, would like to someday.User-Password printed with SHA isUser-Password = "\356Ew\2310\347\326\367h\r1\223,\224\024\352\027\241>5". Thanks and Regards, Vishal Kotalwar, Bangalore-35. 09900055647. From: Phil Mayers <p.mayers(a)imperial.ac.uk> Sent: Fri, 20 Apr 2012 16:36:00 To: freeradius-users(a)lists.freeradius.org Subject: Re: Help: PAP with Sha1 On 20/04/12 11:09, vishal_nitr wrote: > With SHA1 from client: > User-Name = "vishal" > Calling-Station-Id = "00-23-68-0F-1A-E6" > NAS-Port = 0 > NAS-Port-Type = Wireless-802.11 > Framed-MTU = 1400 > Service-Type = Framed-User > NAS-IP-Address = 127.0.0.1 > NAS-Identifier = "ap7131-0F1AE6" > NAS-Port-Id = "0" > User-Password = "\364~\224-\277\370R,\254\264\20517/\246&" This isn't SHA. This is an indication that the shared secret is wrong, thus the password decryption is mangled. Check your shared secrets at both ends. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: Help: PAP with Sha1
by alan buxey 20 Apr '12

20 Apr '12

Hi, > Thanks for the mail Alan. I don't agree with your comment that it is *not* > RADIUS if we choose SHA1 over MD5. RADIUS supports SHA1 hashed > user-password attribute. Following link confirms it. are you talking about changing user passwords (as i first assumed) or are you talking about changing the way RADIUS packets are passed (as Alan mentioned)? if the former, then no code changes are needed on the server...it takes SHA1 fine. it you are talking about doing SHA1 for the shared secret - which then encrypts the payload for passwords access-requests - then thats playing with RADIUS specification... and if you are thinking of doing that then I'd say STOP and use RADSEC instead. alan

1 0

Re: Help: PAP with Sha1
by vishal_nitr 20 Apr '12

20 Apr '12

Thanks for the mail Alan. I don't agree with your comment that it is *not* RADIUS if we choose SHA1 over MD5. RADIUS supports SHA1 hashed user-password attribute. Following link confirms it.http://freeradius.org/radiusd/man/rlm_pap.txt.Please have a look. Thanks and Regards, Vishal Kotalwar,  Bangalore-35. 09900055647. From: Alan DeKok <aland(a)deployingradius.com> Sent: Fri, 20 Apr 2012 17:07:45 To: vishal_nitr(a)rediffmail.com, FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Help: PAP with Sha1 vishal_nitr wrote: >     I am using free-radius-2.1.12. My requirement is to change > algorithms used in my project to FIPS complaint ones.  That is changing the RADIUS protocol.  It won't be compatible with any other RADIUS system on the planet.  Changing the protocol is not a good idea. > I see that radius > uses MD5 for encoding/decoding passwords. I am using PAP authentication. >     In my radius client I changed encoding to SHA1; due to which radius > started rejecting auth requests saying password mismatch from rlm_pap > which is obvious. >     I tried changing few things in lib/radius.c to SHA1 but with no success.  This list isn't the place to ask questions about coding.  It's for questions related to configuring FreeRADIUS.  Coding questions normally belong on the freeradius-devel list. However, because you're *not* using RADIUS, your coding questions don't belong there.  We can't help you change RADIUS.  I suggest debugging the program yourself.  Standard C skills will help here.  Alan DeKok.

1 0

Help: PAP with Sha1
by vishal_nitr 20 Apr '12

20 Apr '12

Hi,    I am using free-radius-2.1.12. My requirement is to change algorithms used in my project to FIPS complaint ones. I see that radius uses MD5 for encoding/decoding passwords. I am using PAP authentication.    In my radius client I changed encoding to SHA1; due to which radius started rejecting auth requests saying password mismatch from rlm_pap which is obvious.     I tried changing few things in lib/radius.c to SHA1 but with no success. I ran radiusd with -X option and I saw following:With MD5 from client:        User-Name = "vishal"        Calling-Station-Id = "00-23-68-0F-1A-E6"        NAS-Port = 0        NAS-Port-Type = Wireless-802.11        Framed-MTU = 1400        Service-Type = Framed-User        NAS-IP-Address = 127.0.0.1        NAS-Identifier = "ap7131-0F1AE6"        NAS-Port-Id = "0"        User-Password = "vishal123" With SHA1 from client:        User-Name = "vishal"        Calling-Station-Id = "00-23-68-0F-1A-E6"        NAS-Port = 0        NAS-Port-Type = Wireless-802.11        Framed-MTU = 1400        Service-Type = Framed-User        NAS-IP-Address = 127.0.0.1        NAS-Identifier = "ap7131-0F1AE6"        NAS-Port-Id = "0"        User-Password = "\364~\224-\277\370R,\254\264\20517/\246&" Please help me change MD5 to Sha1. A quick pointer or exact place to change will help a lot. Thanks and Regards, Vishal Kotalwar, Bangalore-35. 09900055647. Follow Rediff Deal ho jaye! to get exciting offers in your city everyday.

4 4

need info on EAP-SIM,help
by doomyu 20 Apr '12

20 Apr '12

I am using Free Radius for EAP-SIM authentication. But some problems, When I run the example eapsim06,the server error is as follows: [eap] processing type sim eap-sim can not find sim-kc1 eap-sim can not find sim-kc2 eap-sim can not find sim-kc3 can not initiate sim,missing attributes Regards, jack -- View this message in context: http://freeradius.1045715.n5.nabble.com/need-info-on-EAP-SIM-help-tp5653902… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

MSSCHAP auth + LDAP authorizaton
by Andres Septer 20 Apr '12

20 Apr '12

I have working radius - AD authentication via winbind (MSCHAP challnge-response). But I do not want to give all domain users ability to use VPN. I want to use special AD group. I have considered LDAP authorization. I've read this manual http://wiki.freeradius.org/Rlm_ldap and configured correct ldap bind values but now I'm pretty much lost How to tell freeradius, that after successful MSCHAP auth against AD it must browse AD via LDAP and check that te username belongs to specified group? Any suggestions of documentation that will help, would be appriciated. Andres Septer

4 4