Re: Freeradius-Users Digest, Vol 164, Issue 38

19 Dec 2018

      Thank you  Herwin,

In this Documentation of FreeRadius Passwords, the CHAP and MS-CHAP support
the Cleartext-Password, so can i get the Cleartext-Password in my php
authentication script?

On Wed, Dec 19, 2018 at 4:30 PM <
freeradius-users-request@lists.freeradius.org> wrote:
...
Send Freeradius-Users mailing list submissions to
        freeradius-users@lists.freeradius.org
To subscribe or unsubscribe via the World Wide Web, visit
        http://lists.freeradius.org/mailman/listinfo/freeradius-users
or, via email, send a message with subject or body 'help' to
        freeradius-users-request@lists.freeradius.org
You can reach the person managing the list at
        freeradius-users-owner@lists.freeradius.org
When replying, please edit your Subject line so it is more specific
than "Re: Contents of Freeradius-Users digest..."
Today's Topics:
1. Re: RESTful API (Alan DeKok)
   2. Re: RESTful API (Daniel Kong)
   3. Capacity calculation (Raghu nathan)
   4. Re: Capacity calculation (Nathan Ward)
   5. plain-text password not get with CHAP (Imdad Hasan)
   6. Re: plain-text password not get with CHAP (Herwin Weststrate)
----------------------------------------------------------------------
Message: 1
Date: Tue, 18 Dec 2018 06:56:05 -0500
From: Alan DeKok <aland@deployingradius.com>
To: FreeRadius users mailing list
        <freeradius-users@lists.freeradius.org>
Subject: Re: RESTful API
Message-ID: <B1E0A9A8-99D0-413E-96DB-A766824CF2E9@deployingradius.com>
Content-Type: text/plain;       charset=us-ascii
...
On Dec 17, 2018, at 11:15 PM, Daniel Kong <daniel.kongyh@gmail.com>
wrote:
I know you guys are very busy helping the rest but I hope you can help me
with this. I would like freeradius to authenticate with 3rd party
application via REST API. I do have the configuration like below.
connect_uri = "http://10.18.6.22:8081/apps/"
authenticate {
uri = "${..connect_uri}/user/%{User-Name}/%{User-Password}"
method = "get"
}
OK...
...
Problem is that I do not know what to be included in the request and
response for every authenticate, authorize, post-auth, and accounting.
For
the response, I just include the HTTP status is sufficient for
authentication? How about the response for authorize, post-auth, and
accounting?
You don't need to include anything in the response.  The documentation
describes how the module works and what it does.
FreeRADIUS treats the REST API as just another database.  There's no
"requirement" to put anything into SQL, so there's no requirement to put
anything in REST.
...
If the freeRadius is configured to use RESTful API, does other post-auth,
authorize, and accounting can be use with mysql so that only
authentication
is using rest?
Yes.  You just list "rest" in the authenticate section, and "sql"
elsewhere.
Alan DeKok.
------------------------------
Message: 2
Date: Wed, 19 Dec 2018 12:01:30 +0800
From: Daniel Kong <daniel.kongyh@gmail.com>
To: FreeRadius users mailing list
        <freeradius-users@lists.freeradius.org>
Subject: Re: RESTful API
Message-ID:
        <
CALvNz2haTvGQvUadZHMaWVh3gRmAKK44+FTUeeFp30sczSJ4PQ@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
Thanks for the feedback, Alan. I have more questions to ask regarding the
REST authentication. How does the freeRadius know that when to let the user
to gain access to the resources after invoke REST authentication? Does it
rely on the REST response http status? Eg. if the 3rd party application
returns a http status 200 means that the user is authenticated and able to
use the resource. However if the REST response returns a http status 401
means that he/she is unauthorized. Does the freeRadius interpret it this
way?
In order to use REST authentication only while the others like post-auth,
authorize, and accounting using the sql, I only need to configure the REST
for authentication. So my configuration would look like this? I just
comment off post-auth, authorize, and accounting. Correct me if I am wrong.
rest {
    tls {
        ...
    }
authentication {
    }
#authorize {
    #}
#post-auth {
    #}
#accounting {
    #}
pool {
        ...
    }
}
So after authenticate is successful, freeRadius will do insertion of record
to radpostauth and radacct table by itself?
Our current usage of freeRadius is with mySQL. So we will insert record to
radcheck and radreply table while the rest of the table will be handled by
freeRadius. Now if we are using the REST for authentication, do we still
need to insert record to radcheck and radreply? Do we still rely on the
'Auth-Type' in the radcheck table?
Daniel.
On Tue, Dec 18, 2018 at 7:57 PM Alan DeKok <aland@deployingradius.com>
wrote:
...
...
On Dec 17, 2018, at 11:15 PM, Daniel Kong <daniel.kongyh@gmail.com>
wrote:
I know you guys are very busy helping the rest but I hope you can help
me
...
...
with this. I would like freeradius to authenticate with 3rd party
application via REST API. I do have the configuration like below.
connect_uri = "http://10.18.6.22:8081/apps/"
authenticate {
uri = "${..connect_uri}/user/%{User-Name}/%{User-Password}"
method = "get"
}
OK...
...
Problem is that I do not know what to be included in the request and
response for every authenticate, authorize, post-auth, and accounting.
For
the response, I just include the HTTP status is sufficient for
authentication? How about the response for authorize, post-auth, and
accounting?
You don't need to include anything in the response.  The documentation
describes how the module works and what it does.
FreeRADIUS treats the REST API as just another database.  There's no
"requirement" to put anything into SQL, so there's no requirement to put
anything in REST.
...
If the freeRadius is configured to use RESTful API, does other
post-auth,
authorize, and accounting can be use with mysql so that only
authentication
is using rest?
Yes.  You just list "rest" in the authenticate section, and "sql"
elsewhere.
Alan DeKok.
-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html
------------------------------
Message: 3
Date: Wed, 19 Dec 2018 14:55:14 +0530
From: Raghu nathan <raghu.vdm@gmail.com>
To: freeradius-users@lists.freeradius.org
Subject: Capacity calculation
Message-ID:
        <CAJea6dOy+hHtsOAMpadwatq=
LrmCLPm4yF7sF55BmhT7ZFKgYA@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
Hello Team,
I want to understand how much TPS freeRADIUS will support for below
configuration along with postgresql DB
Consider postgresql is hosted separately without any capacity limitation.
Option1 : 1GB RAM, 1core CPU
Option2 : 2GB RAM, 1core CPU
Option3 : 4GB RAM, 2core CPU
Option4 : 8GB RAM, 2core CPU
Regards,
Raghu
------------------------------
Message: 4
Date: Wed, 19 Dec 2018 23:19:00 +1300
From: Nathan Ward <lists+freeradius@daork.net>
To: FreeRadius users mailing list
        <freeradius-users@lists.freeradius.org>
Subject: Re: Capacity calculation
Message-ID: <7C4335D6-CC72-4143-BD10-757C87DE09BF@daork.net>
Content-Type: text/plain;       charset=utf-8
...
On 19/12/2018, at 10:25 PM, Raghu nathan <raghu.vdm@gmail.com> wrote:
Hello Team,
I want to understand how much TPS freeRADIUS will support for below
configuration along with postgresql DB
Consider postgresql is hosted separately without any capacity limitation.
Option1 : 1GB RAM, 1core CPU
Option2 : 2GB RAM, 1core CPU
Option3 : 4GB RAM, 2core CPU
Option4 : 8GB RAM, 2core CPU
That depends on:
1) Your configuration
2) Your vm contention (sounds like VMs)
3) Your IO, potentially
4) Your database speed - database is by *far* the slowest part of this
5) Packet types - auth? Accounting?
6) What is a “core”?
7) How fast is the RAM?
And many, many, many more factors.
To be clear - please do not answer the above questions - they are
presented as a non-exhaustive list of factors.
You cannot get a reasonable answer on a question like this without testing
it in your environment with your configuration etc.
This is why you’ll rarely find “benchmarks” or similar.
There are a myriad of ways to scale FreeRADIUS in almost any direction,
depending on your workload. If you’ve been tasked with finding out if
FreeRADIUS can handle your load the answer is almost certainly yes - but
you may need to do some work to get it to, just as you would with any
solution.
--
Nathan Ward
------------------------------
Message: 5
Date: Wed, 19 Dec 2018 16:21:55 +0530
From: Imdad Hasan <imdadalikadiwala0@gmail.com>
To: freeradius-users@lists.freeradius.org
Subject: plain-text password not get with CHAP
Message-ID:
        <CAPidyMX9D3EQb=
ixjvo6u-iJCm7Q1v_N9sTBCZKOex5VAeNRAA@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
Respected All,
I using Default *Auth-Type = Accept* and *php external script* for custom
authentication. That is working fine with only pap in PPPoE, But not
working with CHAP, MS-CHAPv2 etc.
I found one reason was the external script not get the plain-text
password.Usually i get password in external php script with
*trim(getenv('USER_PASSWORD'),'"');
*this env variable.
So, any way to get plain-text password in external script when chap is on
in mikrotik?
Warm regards
Imdadali Kadiwala
------------------------------
Message: 6
Date: Wed, 19 Dec 2018 11:57:27 +0100
From: Herwin Weststrate <herwin@quarantainenet.nl>
To: freeradius-users@lists.freeradius.org
Subject: Re: plain-text password not get with CHAP
Message-ID: <c5afe74d-8169-813f-f90c-a3d3b0b2ccb4@quarantainenet.nl>
Content-Type: text/plain; charset=utf-8
On 19-12-18 11:51, Imdad Hasan wrote:
...
Respected All,
I using Default *Auth-Type = Accept* and *php external script* for custom
authentication. That is working fine with only pap in PPPoE, But not
working with CHAP, MS-CHAPv2 etc.
I found one reason was the external script not get the plain-text
password.Usually i get password in external php script with
*trim(getenv('USER_PASSWORD'),'"');
*this env variable.
So, any way to get plain-text password in external script when chap is on
in mikrotik?
No, simply because CHAP and MSCHAP don't send the plaintext password,
but hashes of the password.
If you have access to the plaintext password in PHP, you could add this
to the config list and let the chap/mschap modules take care of it (but
then it would be unlikely you really needed PHP in the first place),
otherwise you're out of luck.
See http://deployingradius.com/documents/protocols/compatibility.html
for a list of possible password hashing compatibilities.
--
Herwin Weststrate
------------------------------
Subject: Digest Footer
-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html
------------------------------
End of Freeradius-Users Digest, Vol 164, Issue 38
*************************************************

Imdad Hasan

tags

participants (1)