Hello : I'm new to freeradius , still learning the basics , what i'm trying to do is set up an freeradius eap-sim server for a telco that has both access to sim's as well as access to a HLR and HHS . I've been lurking on the list a wile so here goes with a few questions. Hopeful not to stupid .... Are there any "How to's" that show in detail how to set this up ? I've found lots of info on the different forms of EAP but not much on EAP-SIM. The end result of the whole thing is to let a user's phone get authorized and authenticated using the SIM card in the phone. doing so with freeradius . from the modules/Rlm_eap docs: "To configure EAP-SIM authentication, the following attributes must be set in the server. This can be done in the users file, but in many cases will be taken from a database server, via one of the SQL interface. If one has SIM cards that one controls (i.e. whose share secret you know), one should be able to write a module to generate these attributes (the triplets) in the server. If one has access to the SS7 based settlement network, then a module to fetch appropriate triplets could be written. This module would act as an authorization only module. The attributes are: EAP-Sim-Rand1 16 bytes EAP-Sim-SRES1 4 bytes EAP-Sim-KC1 8 bytes EAP-Sim-Rand2 16 bytes EAP-Sim-SRES2 4 bytes EAP-Sim-KC2 8 bytes EAP-Sim-Rand3 16 bytes EAP-Sim-SRES3 4 bytes EAP-Sim-KC3 8 bytes EAP-SIM will send WEP attributes to the resquestor." Some questions , if I know the shared secret , how is that used to generate the attributes ? any guides out there for this ? I also have access to a SS7 network , any examples on how to write a module to fetch the attributes from there ? As I stated before I'm "NEW" at this , I've been working with radius for a few weeks , mainly using it in conjunction with a learning book called FreeRadius Beginners guide. I'm trying to do this project with Open Source Free Software to show the company it's possible . Sure we could just buy a canned solution but I'm a supporter of Open source and I believe it can be done. any help would be appreciated , just some pointers to resources if you know of any , or if you have successfully done this how did you accomplish it ? Thanks for your time Greg
if I know the shared secret , how is that used to generate the attributes ? any guides out there for this ?
Yes. I looked at this a couple of months ago. We now have implementations of COMP128v1, v2 and v3. If your sim cards use those algorithms then you can authenticate wireless users if you have the Ki (in theory). I've not actually tested this yet... You need to set: update control { EAP-Sim-Algo-Version := [1|2|3] EAP-Sim-KI := <the subscriber's Ki> } This is 3.0.x and master branches only. I don't believe there's a released version with the code in.
I also have access to a SS7 network , any examples on how to write a module to fetch the attributes from there ?
You can use rlm_example as a starting point. You'll need to know C. In terms of talking with ss7 servers libss7 might be a good place to start, unless anyone knows of something better maintained. I'd be happy to give you pointers if you run into issues, so long as the final product is contributed back to the project.
As I stated before I'm "NEW" at this , I've been working with radius for a few weeks , mainly using it in conjunction with a learning book called FreeRadius Beginners guide.
Ah. Sorry about the formatting, it wasn't us. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Thank you for the reply , I'm happy to report to you that my company has allowed me to give back any code / product back to the free radius project that you assist me in developing , they see it as a win /win situation . Am I correct in understanding that the eap-sim stuff is more developed in the version 3 code , currently I'm working on 2.1 or 2.2 , Would you recommend that I obtain the version 3 and use that as my starting point ? if so is there a package for ubuntu or will i have to compile from source and build my own ? Thanks Greg Jetter GCI.com ________________________________________ From: freeradius-users-bounces+gjetter=gci.com@lists.freeradius.org [freeradius-users-bounces+gjetter=gci.com@lists.freeradius.org] On Behalf Of Arran Cudbard-Bell [a.cudbardb@freeradius.org] Sent: Tuesday, December 17, 2013 2:21 PM To: FreeRadius users mailing list Subject: Re: Eap - Sim Server
if I know the shared secret , how is that used to generate the attributes ? any guides out there for this ?
Yes. I looked at this a couple of months ago. We now have implementations of COMP128v1, v2 and v3. If your sim cards use those algorithms then you can authenticate wireless users if you have the Ki (in theory). I've not actually tested this yet... You need to set: update control { EAP-Sim-Algo-Version := [1|2|3] EAP-Sim-KI := <the subscriber's Ki> } This is 3.0.x and master branches only. I don't believe there's a released version with the code in.
I also have access to a SS7 network , any examples on how to write a module to fetch the attributes from there ?
You can use rlm_example as a starting point. You'll need to know C. In terms of talking with ss7 servers libss7 might be a good place to start, unless anyone knows of something better maintained. I'd be happy to give you pointers if you run into issues, so long as the final product is contributed back to the project.
As I stated before I'm "NEW" at this , I've been working with radius for a few weeks , mainly using it in conjunction with a learning book called FreeRadius Beginners guide.
Ah. Sorry about the formatting, it wasn't us. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
On 18 Dec 2013, at 19:56, Greg Jetter <gjetter@gci.com> wrote:
Thank you for the reply , I'm happy to report to you that my company has allowed me to give back any code / product back to the free radius project that you assist me in developing , they see it as a win /win situation .
Yes :) You get the code maintained, and we get working code to talk to SS7 servers.
Am I correct in understanding that the eap-sim stuff is more developed in the version 3 code , currently I'm working on 2.1 or 2.2 , Would you recommend that I obtain the version 3 and use that as my starting point ?
Yes, use version 3.x.x. EAP-SIM is available in version 2.x.x but the code to calculate SRES and KC is only available in version 3.x.x and master branch.
if so is there a package for ubuntu or will i have to compile from source and build my own ?
Build from source. If you're developing a new module you probably want to do that anyway as you can't build modules independently of the server if you use the server's build system. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
participants (2)
-
Arran Cudbard-Bell -
Greg Jetter