Radius + PostgreSQL + MD5 Passwords
Well I've spent the better part of the last 9 hours trying to figure this out, but I can't seem to get it.... What I am trying to do: Central FreeRADIUS server with PostgreSQL database for remote ChilliSpot appliances to auth against. My problem: I'm strongly against storing passwords in clear text so I want the passwords in PostgreSQL to be MD5 or SHA1 hashed. Everything I've read through Google seems to be indicating that for any form of encryption to work between the client and server, that the database has to use clear text passwords. I have successfully got the FreeRADIUS + PostgreSQL combination working with clear text, but I can not make the move to hashed passwords. 1) It what I am trying to do possible? 2) If so, is it possible without any significant drawbacks? 3) Any pointers in the right direction to how to achieve what I am after? Cheers, ~p
Phillip Smith wrote:
My problem: I'm strongly against storing passwords in clear text so I want the passwords in PostgreSQL to be MD5 or SHA1 hashed.
Probably salted.
Everything I've read through Google seems to be indicating that for any form of encryption to work between the client and server, that the database has to use clear text passwords.
No. http://deployingradius.com/documents/protocols/compatibility.html
I have successfully got the FreeRADIUS + PostgreSQL combination working with clear text, but I can not make the move to hashed passwords.
1) It what I am trying to do possible?
Yes.
2) If so, is it possible without any significant drawbacks?
It limits your ability to use different authentication protocols.
3) Any pointers in the right direction to how to achieve what I am after?
See "man rlm_pap". You can use the "auto-header" thing, or just use MD5-Password directly: # "users" file entry: bob MD5-Password := 0x12345... # Alan DeKok.
On 5 February 2010 18:34, Alan DeKok <aland@deployingradius.com> wrote:
3) Any pointers in the right direction to how to achieve what I am after?
See "man rlm_pap". You can use the "auto-header" thing, or just use MD5-Password directly:
# "users" file entry: bob MD5-Password := 0x12345... #
Thanks for your reply Alan :) This is where I'm stuck at the moment: rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'frank' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id' rlm_sql_postgresql: query: SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'frank' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. The data in my SQL database: radius=> SELECT * FROM radcheck; id | username | attribute | op | value ----+----------+--------------+----+---------------------------------- 0 | frank | MD5-Password | := | aaabf0d39951f3e6c3e8a7911df524c2 (1 row) My radiusd.conf file is here: http://www.pastebin.ca/1789575 (Sorry, not sure about the accepted practise for sharing such a large file on this list) I forgot to mention in my first post that this is freeradius-1.1.3-1.5.el5_4 on CentOS 5.4. Do I need 2.1.8 for this MD5 stuff to work? I'd prefer to be able to use the distro's packages, but if I have to compile it to make it work then I don't really have a choice ;-)
Phillip Smith wrote:
I forgot to mention in my first post that this is freeradius-1.1.3-1.5.el5_4 on CentOS 5.4. Do I need 2.1.8 for this MD5 stuff to work?
Yes.
I'd prefer to be able to use the distro's packages, but if I have to compile it to make it work then I don't really have a choice ;-)
See http://freeradius.org/download.html Alan DeKok.
On 8 February 2010 17:58, Alan DeKok <aland@deployingradius.com> wrote:
Phillip Smith wrote:
I forgot to mention in my first post that this is freeradius-1.1.3-1.5.el5_4 on CentOS 5.4. Do I need 2.1.8 for this MD5 stuff to work?
Yes.
Doh! Sorry to bother you with this waste of time then... I'll upgrade. Thanks for being patient with me :)
On 02/08/2010 01:58 AM, Alan DeKok wrote:
Phillip Smith wrote:
I forgot to mention in my first post that this is freeradius-1.1.3-1.5.el5_4 on CentOS 5.4. Do I need 2.1.8 for this MD5 stuff to work?
Yes.
I'd prefer to be able to use the distro's packages, but if I have to compile it to make it work then I don't really have a choice ;-)
Current 2.1.8 builds for RHEL5/CentOS are available here: http://wiki.freeradius.org/Red_Hat_FAQ -- John Dennis <jdennis@redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/
On 9 February 2010 01:54, John Dennis <jdennis@redhat.com> wrote:
On 02/08/2010 01:58 AM, Alan DeKok wrote:
Phillip Smith wrote:
I forgot to mention in my first post that this is freeradius-1.1.3-1.5.el5_4 on CentOS 5.4. Do I need 2.1.8 for this MD5 stuff to work?
Yes.
I'd prefer to be able to use the distro's packages, but if I have to compile it to make it work then I don't really have a choice ;-)
Current 2.1.8 builds for RHEL5/CentOS are available here:
Well would you look at that... With the correct version, everything "just works" like it's supposed to... Can't believe I wasted a whole day because of such a stupid mistake!! Thanks again guys! :D
participants (3)
-
Alan DeKok -
John Dennis -
Phillip Smith