On 13-10-15 10:32, Martin Rheumer wrote:
Hi All,
We are looking at trying to implement WPA Enterprise with LDAP Auth, FreeRadius using a DLINK DWC-1000 Wifi Controller. I have spent the day trying to determine if the new version 3.0 and the inner tunnel now allows this to work over older versions and mailing list entries saying this will never work and I cant seem to figure a straight answer.
...
[root@ho-radius raddb]# radtest martinr password 127.0.0.1:18120 0 testing123 Sending Access-Request Id 134 from 0.0.0.0:41385 to 127.0.0.1:18120 User-Name = 'martinr' User-Password = 'password' NAS-IP-Address = 10.0.0.40 NAS-Port = 0 Message-Authenticator = 0x00 Received Access-Accept Id 134 from 127.0.0.1:18120 to 127.0.0.1:41385 length 20 [root@ho-radius raddb]# radtest -t mschap martinr password 127.0.0.1:18120 0 testing123 Sending Access-Request Id 145 from 0.0.0.0:37203 to 127.0.0.1:18120 User-Name = 'martinr' NAS-IP-Address = 10.0.0.40 NAS-Port = 0 Message-Authenticator = 0x00 MS-CHAP-Challenge = 0x062507387c1f6b17 MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000adc03505c874be4c4e5e7a7d6549ebd9beb0f752c40fc74f
Received Access-Reject Id 145 from 127.0.0.1:18120 to 127.0.0.1:37203 length 38 MS-CHAP-Error = '\000E=691 R=1' (0) -: Expected Access-Accept got Access-Reject
As you can see here, using PAP authentication work, but MS-CHAP doesn't work.
(0) ldap : Processing user attributes (0) ldap : control:Password-With-Header += '{SSHA}sjcybNoAjvx2+LHSN9Z8zE0JEd0khiue' rlm_ldap (ldap): Released connection (4)
And here it shows why: you fetch a hash of a certain type from the LDAP-server. MS-CHAP also uses hashing, but a different kind, those two are incompatible> That's why "mailing list entries saying this will never work". The first radtest entry uses PAP authentication, which means the password is available in plaintext and can be converted to any kind of hash. There is an overview of the compatibility of hashes/authentication types at http://deployingradius.com/documents/protocols/compatibility.html -- Herwin Weststrate