On 31 Jan 2014, at 19:33, Mike Diggins <mike.diggins@mcmaster.ca> wrote:
I'm running a FreeRadius server which authenticates to a Microsoft Windows 8 Active Directory via winbind and NTLM_AUTH. The service is used by a Cisco wireless network which uses WPA2 for user authentication (MS PEAP). My software versions are:
Red Hat Enterprise Linux (v. 5 for 64-bit x86_64) freeradius2-2.1.12-4.el5_8 (RedHat) samba3x-winbind-3.5.10-0.110.el5_8 (RedHat)
It came to my attention recently that some users may be gaining unauthorized access. An account was seen to be granted access (according to the FreeRadius log) even though the account does not exist within the AD, nor is it a local FreeRadius account (not that I can see anyway). What I see in my logs is:
Jan 15 12:23:34 xxxxx radiusd[20330]: Login OK: [whoiswho] (from client xxxx port 13 cli xx-xx-xx-xx-xx-xx) Jan 18 08:07:58 xxxxx radiusd[22212]: Login OK: [hi] (from client xxxx port 13 cli xx-xx-xx-xx-xx-xx)
The same accounts also appear on the wireless controller. To the best of my knowledge those accounts do not exist anywhere but somehow they are being authenticated.
Yes, you're not enforcing outer/inner identity consistency. The Access Point and Outer server only know about the User-Name provided in the EAP-Identity-Response, whereas you're authenticating on the identity sent through the EAP-Tunnel. In the inner tunnel server would prevent this from occurring. Without that check a user could set the outer identity to anything, so long as the inner identity was valid. This can be particularly nasty, say, if you're doing dynamic VLAN assignment in the outer server, as a user can spoof the name of an administrative user, and get assigned to a VLAN they shouldn't. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2