Accounting Request Message Authenticator setting to 0x00
Hi, I am a newbie to Radius Protocol. I want to set the Message Authenticator value to 0x00 in my Accounting Request. I have tried bzero but its not working. Please let me know if there is a way to do it? Thanks & Regards, Regards, -Archna
It's impossible to put an Message-Authenticator in an accounting packet. It has to do with the way the Accounting-Request packet is signed. The MA is placed in the Access-Request packet as 16 zeroed bytes. The HMAC-MD5 value is calculated over the entire packet and patched into the MA's zeroed value. Since the authenticator is a random number the MA's value does not matter when back patched in the packet. An accounting packet (Accounting-Request) is signed by performing an MD5 over the entire packet and then stuffing that value into the authenticator's position. So the accounting packet is already securely signed and doesn't need another signature on top of that. It would be impossible to calculate the MA since the authenticator starts out zeroed in an accounting packet. When the accounting packet is signed either a precalculated MA will be incorrect or a post-authenticated MA will invalidate the accounting packet's signature. Archna Mittal wrote:
Hi,
I am a newbie to Radius Protocol. I want to set the Message Authenticator value to 0x00 in my Accounting Request. I have tried bzero but its not working.
Please let me know if there is a way to do it?
Thanks & Regards,
Regards,
-Archna
------------------------------------------------------------------------
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Is it possible to put authenticator filed in Accounting Request message to 0x00? Regards, -Archna -----Original Message----- From: freeradius-users-bounces+archna.mittal=globallogic.com@lists.freeradius.org [mailto:freeradius-users-bounces+archna.mittal=globallogic.com@lists.freerad ius.org] On Behalf Of Michael Lecuyer Sent: Thursday, March 15, 2007 6:47 PM To: FreeRadius users mailing list Subject: Re: Accounting Request Message Authenticator setting to 0x00 It's impossible to put an Message-Authenticator in an accounting packet. It has to do with the way the Accounting-Request packet is signed. The MA is placed in the Access-Request packet as 16 zeroed bytes. The HMAC-MD5 value is calculated over the entire packet and patched into the MA's zeroed value. Since the authenticator is a random number the MA's value does not matter when back patched in the packet. An accounting packet (Accounting-Request) is signed by performing an MD5 over the entire packet and then stuffing that value into the authenticator's position. So the accounting packet is already securely signed and doesn't need another signature on top of that. It would be impossible to calculate the MA since the authenticator starts out zeroed in an accounting packet. When the accounting packet is signed either a precalculated MA will be incorrect or a post-authenticated MA will invalidate the accounting packet's signature. Archna Mittal wrote:
Hi,
I am a newbie to Radius Protocol. I want to set the Message Authenticator value to 0x00 in my Accounting Request. I have tried bzero but its not working.
Please let me know if there is a way to do it?
Thanks & Regards,
Regards,
-Archna
------------------------------------------------------------------------
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Lets say you achieve that with some packet sniffing software. You don't have radius packet any more. You have garbage. What now? Ivan Kalik Kalik Informatika ISP Dana 16/3/2007, "Archna Mittal" <archna.mittal@globallogic.com> piše:
Is it possible to put authenticator filed in Accounting Request message to 0x00?
Regards, -Archna
-----Original Message----- From: freeradius-users-bounces+archna.mittal=globallogic.com@lists.freeradius.org [mailto:freeradius-users-bounces+archna.mittal=globallogic.com@lists.freerad ius.org] On Behalf Of Michael Lecuyer Sent: Thursday, March 15, 2007 6:47 PM To: FreeRadius users mailing list Subject: Re: Accounting Request Message Authenticator setting to 0x00
It's impossible to put an Message-Authenticator in an accounting packet. It has to do with the way the Accounting-Request packet is signed.
The MA is placed in the Access-Request packet as 16 zeroed bytes. The HMAC-MD5 value is calculated over the entire packet and patched into the MA's zeroed value. Since the authenticator is a random number the MA's value does not matter when back patched in the packet.
An accounting packet (Accounting-Request) is signed by performing an MD5 over the entire packet and then stuffing that value into the authenticator's position. So the accounting packet is already securely signed and doesn't need another signature on top of that. It would be impossible to calculate the MA since the authenticator starts out zeroed in an accounting packet. When the accounting packet is signed either a precalculated MA will be incorrect or a post-authenticated MA will invalidate the accounting packet's signature.
Archna Mittal wrote:
Hi,
I am a newbie to Radius Protocol. I want to set the Message Authenticator value to 0x00 in my Accounting Request. I have tried bzero but its not working.
Please let me know if there is a way to do it?
Thanks & Regards,
Regards,
-Archna
------------------------------------------------------------------------
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
If your accounting-request is damaged then the server will reject it since the signature will be altered. The server performs a signature check on the Accounting-Request - basically resigning it and checking that the resulting Accounting-Request authenticators are the same. It's a trust mechanism based on which end is responsible for the consequences of the transaction. When authenticating the client doesn't trust the server and requires that the server sign the response packet. The client will grant privileges and so cannot afford to blindly trust the server. In accounting the server doesn't trust the client and requires a signed packet from the client. In this case the server doesn't want to trust just any old packet for something as important as accounting. tnt@kalik.co.yu wrote:
Lets say you achieve that with some packet sniffing software. You don't have radius packet any more. You have garbage. What now?
Ivan Kalik Kalik Informatika ISP
Dana 16/3/2007, "Archna Mittal" <archna.mittal@globallogic.com> piše:
Is it possible to put authenticator filed in Accounting Request message to 0x00?
Regards, -Archna
-----Original Message----- From: freeradius-users-bounces+archna.mittal=globallogic.com@lists.freeradius.org [mailto:freeradius-users-bounces+archna.mittal=globallogic.com@lists.freerad ius.org] On Behalf Of Michael Lecuyer Sent: Thursday, March 15, 2007 6:47 PM To: FreeRadius users mailing list Subject: Re: Accounting Request Message Authenticator setting to 0x00
It's impossible to put an Message-Authenticator in an accounting packet. It has to do with the way the Accounting-Request packet is signed.
The MA is placed in the Access-Request packet as 16 zeroed bytes. The HMAC-MD5 value is calculated over the entire packet and patched into the MA's zeroed value. Since the authenticator is a random number the MA's value does not matter when back patched in the packet.
An accounting packet (Accounting-Request) is signed by performing an MD5 over the entire packet and then stuffing that value into the authenticator's position. So the accounting packet is already securely signed and doesn't need another signature on top of that. It would be impossible to calculate the MA since the authenticator starts out zeroed in an accounting packet. When the accounting packet is signed either a precalculated MA will be incorrect or a post-authenticated MA will invalidate the accounting packet's signature.
Archna Mittal wrote:
Hi,
I am a newbie to Radius Protocol. I want to set the Message Authenticator value to 0x00 in my Accounting Request. I have tried bzero but its not working.
Please let me know if there is a way to do it?
Thanks & Regards,
Regards,
-Archna
------------------------------------------------------------------------
- List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Archna Mittal wrote:
Is it possible to put authenticator filed in Accounting Request message to 0x00?
If you're using FreeRADIUS, the code works, and does the right thing. If you're developing your own RADIUS software, then this is *not* the appropriate list to ask generic RADIUS questions. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
Thanks a lot for all the replies. Actually my project requirement needs the authenticator field set to all zero's. and moreover there is no secret as such with the radius server i.e. the secret field is Null while calling rad_send. You may assume that my project requires just the message in Radius Packet format without any secret or security signatures. Any pointers? Thanks in Advance, Regards, -Archna -----Original Message----- From: freeradius-users-bounces+archna.mittal=globallogic.com@lists.freeradius.org [mailto:freeradius-users-bounces+archna.mittal=globallogic.com@lists.freerad ius.org] On Behalf Of Alan DeKok Sent: Thursday, March 15, 2007 7:42 PM To: FreeRadius users mailing list Subject: Re: Accounting Request Message Authenticator setting to 0x00 Archna Mittal wrote:
Is it possible to put authenticator filed in Accounting Request message to 0x00?
If you're using FreeRADIUS, the code works, and does the right thing. If you're developing your own RADIUS software, then this is *not* the appropriate list to ask generic RADIUS questions. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hallo all, i have a little problem and hope that somebody can give me a good hint. i already googled and found nothing. i want to pass the username and password to an external program. i already tried the following code but i didnt work: DEFAULT Auth-Type ?= External Exec-Program-Wait = "/etc/raddb/mytestprogram %u %w, Fall-Through = Yes I found the %u placeholder in the doc/variable.txt document but i couldnt found anything about a placeholder for the password. The %w doesnt not work. (only in xtradius-version) Other Question: is %u the same as %{User-Name} ? Thanks in advance best regards peter urban _________________________________________________________________ Sie suchen E-Mails, Dokumente oder Fotos? Die neue MSN Suche Toolbar mit Windows-Desktopsuche liefert in sekundenschnelle Ergebnisse. Jetzt neu! http://desktop.msn.de/ Jetzt gratis downloaden!
Peter Urban wrote:
i want to pass the username and password to an external program. i already tried the following code but i didnt work:
DEFAULT Auth-Type ?= External Exec-Program-Wait = "/etc/raddb/mytestprogram %u %w, Fall-Through = Yes
I found the %u placeholder in the doc/variable.txt document but i couldnt found anything about a placeholder for the password. The %w doesnt not work. (only in xtradius-version)
How about %{User-Password} ? The documentation is relatively clear about referencing any attribute.
Other Question: is %u the same as %{User-Name} ?
Yes. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
No. It's not allowed in Accounting-Request. Ivan Kalik Kalik Informatika ISP Dana 15/3/2007, "Archna Mittal" <archna.mittal@globallogic.com> piše:
Hi,
I am a newbie to Radius Protocol. I want to set the Message Authenticator value to 0x00 in my Accounting Request. I have tried bzero but its not working.
Please let me know if there is a way to do it?
Thanks & Regards,
Regards,
-Archna
participants (5)
-
Alan DeKok -
Archna Mittal -
Michael Lecuyer -
Peter Urban -
tnt＠kalik.co.yu