On Jul 22, 2020, at 4:58 AM, FRANKS, Andy (SHREWSBURY AND TELFORD HOSPITAL NHS TRUST) via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
We use MAC authentication with some stuff, and update the control Cleartext-Password to match the user-name field, as mac auth on the NASes here always use that as the password. Authorisation does all our useful accept/reject stuff, not authentication. Having said that I'd prefer not to "hack" it to bypass auth.
Sure.
My test NAS is an HP/Aruba 2530 with v15.17.0009 firmware
Before the chap auth runs:
Update control { &Cleartext-Password = &User-Name }
Works on v3: From the access request : Wed Jul 22 08:33:57 2020 : Debug: (0) User-Name = "08000f510d1e" Wed Jul 22 08:33:57 2020 : Debug: (0) CHAP-Password = 0x9fdc274c2e3ca36a66a0581a10d44a7dd2 Wed Jul 22 08:33:57 2020 : Debug: (0) Message-Authenticator = 0x978dc5f6ccbcd916950b3d76190039dc .. .. and then the chap auth debug: .. Wed Jul 22 08:46:46 2020 : Debug: (0) chap: Comparing with "known good" &control:Cleartext-Password value "08000f510d1e" Wed Jul 22 08:46:46 2020 : Debug: (0) chap: Using challenge from &request:CHAP-Challenge Wed Jul 22 08:33:57 2020 : Debug: (0) chap: CHAP challenge : e7714b9a5d8463e7947041bdbf399c17 Wed Jul 22 08:33:57 2020 : Debug: (0) chap: Client sent : dc274c2e3ca36a66a0581a10d44a7dd2 Wed Jul 22 08:33:57 2020 : Debug: (0) chap: We calculated : dc274c2e3ca36a66a0581a10d44a7dd2 Wed Jul 22 08:33:57 2020 : Debug: (0) chap: CHAP user "08000f510d1e" authenticated successfully
But on v4, it doesn't like it, and I can't figure out why, says the password is incorrect.
I've checked and double checked the client.conf secret is correct.
The client secret isn't used for CHAP. The message means that the "known good" password doesn't match the one used for CHAP.
Wed Jul 22 07:59:01 2020: (1) User-Name = "08000f510d1e" Wed Jul 22 07:59:01 2020: (1) CHAP-Password = 0xa1526f5b6d5cc40d3d87df334515befc07 Wed Jul 22 07:59:01 2020: (1) Message-Authenticator = 0x5433e862ac2ab58c19866ff8bb05863f .. Wed Jul 22 07:59:01 2020: (1) chap - Using "known good" cleartext password Cleartext-Password = "08000f510d1e" Wed Jul 22 07:59:01 2020: (1) chap - Using challenge from &request:CHAP-Challenge Wed Jul 22 07:59:01 2020: (1) chap - CHAP challenge : bf61a943b98f4d1b9e9885677705a6b8 Wed Jul 22 07:59:01 2020: (1) chap - Client sent : 526f5b6d5cc40d3d87df334515befc07 Wed Jul 22 07:59:01 2020: (1) chap - We calculated : 72ca08cb516acb819b0ff9d7cc5988c4 Wed Jul 22 07:59:01 2020: ERROR : (1) chap - Password comparison failed: password is incorrect
Testing chap with radtest DOES work ok with v4 though, really confusing. Can anyone spot the issue? I've a feeling I've missed something obvious.. :(
You can use the debug output to send test packets with radclient from v3: User-Name = "08000f510d1e" CHAP-Password = 0x9fdc274c2e3ca36a66a0581a10d44a7dd2 CHAP-Challenge = 0xe7714b9a5d8463e7947041bdbf399c17 from v4: User-Name = "08000f510d1e" CHAP-Password = 0xa1526f5b6d5cc40d3d87df334515befc07 CHAP-Challenge = 0xbf61a943b98f4d1b9e9885677705a6b8 Send *both* of those packets to *both* servers. If the servers behave differently, there's a bug. If the servers behave the same, then one of the packets was using the wrong password. Hmm... just tried that here. And yes, v3 passes both packets. v4 doesn't. How the heck is CHAP broken? I haven't touched that code. Maybe Arran... I'll take a look today. And, add some tests so that this doesn't happen again. Alan DeKok.