Freeradius Solution (CHAP with LDAP encrypted password)
Hello, I am trying connect to a radius client, which can authenticate only with CHAP. Users credentials are stored encrypted in LDAP database. Unfortunately CHAP requires only cleartext password. I dont want to store users credentials plain-text. Is there a solution about it? Thank you, George
Use PAP authentication so you get the "cleartext" password in the Radius request that is encrypted using the shared secret. No other way around it if you are getting a hashed password if it's not in the same format as what is stored in your database. On Fri, Feb 9, 2018 at 8:02 AM, Tsirkas Georgios <geortsir3@gmail.com> wrote:
Hello,
I am trying connect to a radius client, which can authenticate only with CHAP. Users credentials are stored encrypted in LDAP database. Unfortunately CHAP requires only cleartext password. I dont want to store users credentials plain-text. Is there a solution about it?
Thank you,
George
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list /users.html
On Feb 8, 2018, at 2:02 PM, Tsirkas Georgios <geortsir3@gmail.com> wrote:
Hello,
I am trying connect to a radius client, which can authenticate only with CHAP. Users credentials are stored encrypted in LDAP database. Unfortunately CHAP requires only cleartext password. I dont want to store users credentials plain-text. Is there a solution about it?
It's impossible. http://deployingradius.com/documents/protocols/compatibility.html Alan DeKok.
As I mentioned in a previous email we are upgrading from FR 2.0.x to 3.0.16 slowly and gradually. We are testing as many EAP methods as we can. All the EAP methods in the 'failed' section below used to pass in v2. We are not very familiar with v3 configuration files. We had a look at [1] but we couldn't figure out how to change the configuration files. We would like to know which EAP methods are supported in v3 and more or less how to test them. Thanks in advance. Successful tests: - EAP-MD5 - EAP-MSCHAPv2 - EAP-TLS - EAP-TTLS/CHAP - EAP-TTLS/MSCHAP - EAP-TTLS/MSCHAPv2 - EAP-TTLS/PAP - EAP-TTLS/EAP-MD5 - EAP-TTLS/EAP-GTC - EAP-TTLS/EAP-MSCHAPv2 - EAP-PEAPv0/MD5 - EAP-PEAPv0/EAP-MSCHAPv2 - EAP-FAST - EAP-PWD Skipped tests: - EAP-TTLS/EAP-OTP Failed tests: - EAP-PEAPv1/MD5 - EAP-PEAPv1/EAP-MSCHAPv2 - EAP-IKEv2 - EAP-GTC - EAP-EKE - EAP-PAX - EAP-SAKE - EAP-GPSK - EAP-PSK - EAP-SIM - EAP-AKA - EAP-AKA' [1] https://wiki.freeradius.org/guide/eap-sim
On Feb 8, 2018, at 6:28 PM, Sergio NNX <sfhacker@hotmail.com> wrote:
As I mentioned in a previous email we are upgrading from FR 2.0.x to 3.0.16 slowly and gradually. We are testing as many EAP methods as we can. All the EAP methods in the 'failed' section below used to pass in v2.
All of those EAP method work with v3. Use the default configuration. Set a username / password. It *will* work. All of these EAP methods are testing via integration tests, pretty much daily in v3.
We are not very familiar with v3 configuration files.
It's not that different from v2. See raddb/README.rst for the differences. * virtual servers are largely the same * modules are now in raddb/mods-enabled * minor tweaks all over the place
We had a look at [1] but we couldn't figure out how to change the configuration files. We would like to know which EAP methods are supported in v3 and more or less how to test them.
We don't lie about supported EAP methods. Use the default configuration. It *will* work. Alan DeKok.
1) how are you trying to test those methods (several of them need relevant clients , provisioned codes etc) 2) WHY do you need to support as many EAP methods? several of these methods are used in totally different environments alan
Thanks for your prompt responses.
2) WHY do you need to support as many EAP methods? several of these methods are used in totally different environments
Different organisations have different requirements or needs. We are just testing the supported methods.
1) how are you trying to test those methods (several of them need relevant clients , provisioned codes etc)
Find an example below. I cannot figure out what I am missing / doing wrong / etc. Any hint will be appreciated. v3.0.16 In v2.x, I had gpsk { }, pax { } & psk { } sections in eap.conf and all of them worked fine. Doing the same in v3.x (default configuration), I get:
EAP-GPSK
Fri Feb 09 02:18:50 2018 : Debug: # Instantiating module "eap" from file \freeradius-server-3.0.16\etc\raddb/mods-enabled/eap Fri Feb 09 02:18:50 2018 : Debug: # Linked to sub-module rlm_eap_md5 Fri Feb 09 02:18:50 2018 : Error: rlm_eap (EAP): Failed linking to structure in GPSK: "rlm_eap_gpsk": The specified procedure could not be found. Fri Feb 09 02:18:50 2018 : Error: \freeradius-server-3.0.16\etc\raddb/mods-enabled/eap[14]: Instantiation failed for module "eap"
EAP-PAX
Fri Feb 09 02:19:55 2018 : Debug: # Instantiating module "eap" from file \freeradius-server-3.0.16\etc\raddb/mods-enabled/eap Fri Feb 09 02:19:55 2018 : Debug: # Linked to sub-module rlm_eap_md5 Fri Feb 09 02:19:55 2018 : Error: rlm_eap (EAP): Failed linking to structure in PAX: "rlm_eap_pax": The specified procedure could not be found. Fri Feb 09 02:19:55 2018 : Error: \freeradius-server-3.0.16\etc\raddb/mods-enabled/eap[14]: Instantiation failed for module "eap"
EAP-PSK
Fri Feb 09 02:21:06 2018 : Debug: # Instantiating module "eap" from file \freeradius-server-3.0.16\etc\raddb/mods-enabled/eap Fri Feb 09 02:21:06 2018 : Debug: # Linked to sub-module rlm_eap_md5 Fri Feb 09 02:21:06 2018 : Error: rlm_eap (EAP): Failed linking to structure in PSK: "rlm_eap_psk": The specified procedure could not be found. Fri Feb 09 02:21:06 2018 : Error: \freeradius-server-3.0.16\etc\raddb/mods-enabled/eap[14]: Instantiation failed for module "eap" and so on ....
Testing EAP-PSK in v3.x
** Server side Fri Feb 09 03:06:59 2018 : Debug: (2) Received Access-Request Id 1 from 127.0.0.1:64742 to 0.0.0.0:1812 length 158 Fri Feb 09 03:06:59 2018 : Debug: (2) User-Name = "pskuser" Fri Feb 09 03:06:59 2018 : Debug: (2) NAS-IP-Address = 127.0.0.1 Fri Feb 09 03:06:59 2018 : Debug: (2) NAS-IPv6-Address = ::1 Fri Feb 09 03:06:59 2018 : Debug: (2) Calling-Station-Id = "02-00-00-00-00-01" Fri Feb 09 03:06:59 2018 : Debug: (2) Framed-MTU = 1400 Fri Feb 09 03:06:59 2018 : Debug: (2) NAS-Port-Type = Wireless-802.11 Fri Feb 09 03:06:59 2018 : Debug: (2) Service-Type = Framed-User Fri Feb 09 03:06:59 2018 : Debug: (2) Connect-Info = "CONNECT 11Mbps 802.11b" Fri Feb 09 03:06:59 2018 : Debug: (2) EAP-Message = 0x02010006032f Fri Feb 09 03:06:59 2018 : Debug: (2) State = 0x641eb62e641fb2a35ddc070c83c8dc7e Fri Feb 09 03:06:59 2018 : Debug: (2) Message-Authenticator = 0xa5ea54dff2857cca06866b70fa6aa141 Fri Feb 09 03:06:59 2018 : Debug: (2) session-state: No cached attributes Fri Feb 09 03:06:59 2018 : Debug: (2) # Executing section authorize from file \freeradius-server-3.0.16\etc\raddb/sites-enabled/default Fri Feb 09 03:06:59 2018 : Debug: (2) authorize { Fri Feb 09 03:06:59 2018 : Debug: (2) policy filter_username { Fri Feb 09 03:06:59 2018 : Debug: (2) if (&User-Name) { Fri Feb 09 03:06:59 2018 : Debug: (2) if (&User-Name) -> TRUE Fri Feb 09 03:06:59 2018 : Debug: (2) if (&User-Name) { Fri Feb 09 03:06:59 2018 : Debug: (2) if (&User-Name =~ / /) { Fri Feb 09 03:06:59 2018 : Debug: No matches Fri Feb 09 03:06:59 2018 : Debug: (2) if (&User-Name =~ / /) -> FALSE Fri Feb 09 03:06:59 2018 : Debug: (2) if (&User-Name =~ /@[^@]*@/ ) { Fri Feb 09 03:06:59 2018 : Debug: No matches Fri Feb 09 03:06:59 2018 : Debug: (2) if (&User-Name =~ /@[^@]*@/ ) -> FALSE Fri Feb 09 03:06:59 2018 : Debug: (2) if (&User-Name =~ /\.\./ ) { Fri Feb 09 03:06:59 2018 : Debug: No matches Fri Feb 09 03:06:59 2018 : Debug: (2) if (&User-Name =~ /\.\./ ) -> FALSE Fri Feb 09 03:06:59 2018 : Debug: (2) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { Fri Feb 09 03:06:59 2018 : Debug: No matches Fri Feb 09 03:06:59 2018 : Debug: (2) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE Fri Feb 09 03:06:59 2018 : Debug: (2) if (&User-Name =~ /\.$/) { Fri Feb 09 03:06:59 2018 : Debug: No matches Fri Feb 09 03:06:59 2018 : Debug: (2) if (&User-Name =~ /\.$/) -> FALSE Fri Feb 09 03:06:59 2018 : Debug: (2) if (&User-Name =~ /@\./) { Fri Feb 09 03:06:59 2018 : Debug: No matches Fri Feb 09 03:06:59 2018 : Debug: (2) if (&User-Name =~ /@\./) -> FALSE Fri Feb 09 03:06:59 2018 : Debug: (2) } # if (&User-Name) = notfound Fri Feb 09 03:06:59 2018 : Debug: (2) } # policy filter_username = notfound Fri Feb 09 03:06:59 2018 : Debug: (2) modsingle[authorize]: calling preprocess (rlm_preprocess) Fri Feb 09 03:06:59 2018 : Debug: (2) modsingle[authorize]: returned from preprocess (rlm_preprocess) Fri Feb 09 03:06:59 2018 : Debug: (2) [preprocess] = ok Fri Feb 09 03:06:59 2018 : Debug: (2) modsingle[authorize]: calling chap (rlm_chap) Fri Feb 09 03:06:59 2018 : Debug: (2) modsingle[authorize]: returned from chap (rlm_chap) Fri Feb 09 03:06:59 2018 : Debug: (2) [chap] = noop Fri Feb 09 03:06:59 2018 : Debug: (2) modsingle[authorize]: calling mschap (rlm_mschap) Fri Feb 09 03:06:59 2018 : Debug: (2) modsingle[authorize]: returned from mschap (rlm_mschap) Fri Feb 09 03:06:59 2018 : Debug: (2) [mschap] = noop Fri Feb 09 03:06:59 2018 : Debug: (2) modsingle[authorize]: calling digest (rlm_digest) Fri Feb 09 03:06:59 2018 : Debug: (2) modsingle[authorize]: returned from digest (rlm_digest) Fri Feb 09 03:06:59 2018 : Debug: (2) [digest] = noop Fri Feb 09 03:06:59 2018 : Debug: (2) modsingle[authorize]: calling suffix (rlm_realm) Fri Feb 09 03:06:59 2018 : Debug: (2) suffix: Checking for suffix after "@" Fri Feb 09 03:06:59 2018 : Debug: (2) suffix: No '@' in User-Name = "pskuser", looking up realm NULL Fri Feb 09 03:06:59 2018 : Debug: (2) suffix: No such realm "NULL" Fri Feb 09 03:06:59 2018 : Debug: (2) modsingle[authorize]: returned from suffix (rlm_realm) Fri Feb 09 03:06:59 2018 : Debug: (2) [suffix] = noop Fri Feb 09 03:06:59 2018 : Debug: (2) modsingle[authorize]: calling eap (rlm_eap) Fri Feb 09 03:06:59 2018 : Debug: (2) eap: Peer sent EAP Response (code 2) ID 1 length 6 Fri Feb 09 03:06:59 2018 : Debug: (2) eap: No EAP Start, assuming it's an on-going EAP conversation Fri Feb 09 03:06:59 2018 : Debug: (2) modsingle[authorize]: returned from eap (rlm_eap) Fri Feb 09 03:06:59 2018 : Debug: (2) [eap] = updated Fri Feb 09 03:06:59 2018 : Debug: (2) modsingle[authorize]: calling files (rlm_files) Fri Feb 09 03:06:59 2018 : Debug: (2) files: users: Matched entry pskuser at line 74 Fri Feb 09 03:06:59 2018 : Debug: (2) files: ::: FROM 0 TO 0 MAX 0 Fri Feb 09 03:06:59 2018 : Debug: (2) files: ::: TO in 0 out 0 Fri Feb 09 03:06:59 2018 : Debug: (2) modsingle[authorize]: returned from files (rlm_files) Fri Feb 09 03:06:59 2018 : Debug: (2) [files] = ok Fri Feb 09 03:06:59 2018 : Debug: (2) modsingle[authorize]: calling expiration (rlm_expiration) Fri Feb 09 03:06:59 2018 : Debug: (2) modsingle[authorize]: returned from expiration (rlm_expiration) Fri Feb 09 03:06:59 2018 : Debug: (2) [expiration] = noop Fri Feb 09 03:06:59 2018 : Debug: (2) modsingle[authorize]: calling logintime (rlm_logintime) Fri Feb 09 03:06:59 2018 : Debug: (2) modsingle[authorize]: returned from logintime (rlm_logintime) Fri Feb 09 03:06:59 2018 : Debug: (2) [logintime] = noop Fri Feb 09 03:06:59 2018 : Debug: (2) modsingle[authorize]: calling pap (rlm_pap) Fri Feb 09 03:06:59 2018 : WARNING: (2) pap: Auth-Type already set. Not setting to PAP Fri Feb 09 03:06:59 2018 : Debug: (2) modsingle[authorize]: returned from pap (rlm_pap) Fri Feb 09 03:06:59 2018 : Debug: (2) [pap] = noop Fri Feb 09 03:06:59 2018 : Debug: (2) } # authorize = updated Fri Feb 09 03:06:59 2018 : Debug: (2) Found Auth-Type = eap Fri Feb 09 03:06:59 2018 : Debug: (2) # Executing group from file \freeradius-server-3.0.16\etc\raddb/sites-enabled/default Fri Feb 09 03:06:59 2018 : Debug: (2) authenticate { Fri Feb 09 03:06:59 2018 : Debug: (2) modsingle[authenticate]: calling eap (rlm_eap) Fri Feb 09 03:06:59 2018 : Debug: (2) eap: Expiring EAP session with state 0x641eb62e641fb2a3 Fri Feb 09 03:06:59 2018 : Debug: (2) eap: Finished EAP session with state 0x641eb62e641fb2a3 Fri Feb 09 03:06:59 2018 : Debug: (2) eap: Previous EAP request found for state 0x641eb62e641fb2a3, released from the list Fri Feb 09 03:06:59 2018 : Debug: (2) eap: Peer sent packet with method EAP NAK (3) Fri Feb 09 03:06:59 2018 : Debug: (2) eap: Peer NAK'd asking for unsupported EAP type PSK (47), skipping... Fri Feb 09 03:06:59 2018 : ERROR: (2) eap: No mutually acceptable types found Fri Feb 09 03:06:59 2018 : Debug: (2) eap: Sending EAP Failure (code 4) ID 1 length 4 Fri Feb 09 03:06:59 2018 : Debug: (2) eap: Failed in EAP select Fri Feb 09 03:06:59 2018 : Debug: (2) modsingle[authenticate]: returned from eap (rlm_eap) Fri Feb 09 03:06:59 2018 : Debug: (2) [eap] = invalid Fri Feb 09 03:06:59 2018 : Debug: (2) } # authenticate = invalid Fri Feb 09 03:06:59 2018 : Debug: (2) Failed to authenticate the user Fri Feb 09 03:06:59 2018 : Debug: (2) Using Post-Auth-Type Reject Fri Feb 09 03:06:59 2018 : Debug: (2) # Executing group from file \freeradius-server-3.0.16\etc\raddb/sites-enabled/default Fri Feb 09 03:06:59 2018 : Debug: (2) REJECT { ... } # empty sub-section is ignored Fri Feb 09 03:06:59 2018 : Debug: (2) Delaying response for 1.000000 seconds Fri Feb 09 03:06:59 2018 : Debug: Waking up in 0.2 seconds. Fri Feb 09 03:06:59 2018 : Debug: Waking up in 0.7 seconds. Fri Feb 09 03:07:00 2018 : Debug: (2) Sending delayed response Fri Feb 09 03:07:00 2018 : Debug: (2) Sent Access-Reject Id 1 from 0.0.0.0:1812 to 127.0.0.1:64742 length 44 Fri Feb 09 03:07:00 2018 : Debug: (2) EAP-Message = 0x04010004 Fri Feb 09 03:07:00 2018 : Debug: (2) Message-Authenticator = 0x00000000000000000000000000000000 Fri Feb 09 03:07:00 2018 : Debug: Waking up in 3.9 seconds. Fri Feb 09 03:07:04 2018 : Debug: (1) Cleaning up request packet ID 0 with timestamp +119 Fri Feb 09 03:07:04 2018 : Debug: (2) Cleaning up request packet ID 1 with timestamp +119 Fri Feb 09 03:07:04 2018 : Info: Ready to process requests ** Client Side RADIUS packet matching with station decapsulated EAP packet (code=1 id=1 len=22) from RADIUS server: EAP-Request-MD5 (4) EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request id=1 method=4 vendor=0 vendorMethod=0 EAP: EAP entering state GET_METHOD EAP: configuration does not allow: vendor 0 method 4 EAP: vendor 0 method 4 not allowed CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=4 -> NAK EAP: Status notification: refuse proposed method (param=MD5) EAP: Building EAP-Nak (requested type 4 vendor=0 method=0 not allowed) EAP: allowed methods - hexdump(len=1): 2f EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp WPA: eapol_test_eapol_send(type=0 len=6) TX EAP -> RADIUS - hexdump(len=6): 02 01 00 06 03 2f Encapsulating EAP message into a RADIUS packet Copied RADIUS State Attribute Sending RADIUS message to authentication server RADIUS message: code=1 (Access-Request) identifier=1 length=158 Attribute 1 (User-Name) length=9 Value: 'pskuser' Attribute 4 (NAS-IP-Address) length=6 Value: 127.0.0.1 Attribute 95 (NAS-IPv6-Address) length=18 Value: ::1 Attribute 31 (Calling-Station-Id) length=19 Value: '02-00-00-00-00-01' Attribute 12 (Framed-MTU) length=6 Value: 1400 Attribute 61 (NAS-Port-Type) length=6 Value: 19 Attribute 6 (Service-Type) length=6 Value: 2 Attribute 77 (Connect-Info) length=24 Value: 'CONNECT 11Mbps 802.11b' Attribute 79 (EAP-Message) length=8 Value: 02010006032f Attribute 24 (State) length=18 Value: 641eb62e641fb2a35ddc070c83c8dc7e Attribute 80 (Message-Authenticator) length=18 Value: a5ea54dff2857cca06866b70fa6aa141 Next RADIUS client retransmit in 3 seconds EAPOL: SUPP_BE entering state RECEIVE Received 44 bytes from RADIUS server Received RADIUS message RADIUS message: code=3 (Access-Reject) identifier=1 length=44 Attribute 79 (EAP-Message) length=6 Value: 04010004 Attribute 80 (Message-Authenticator) length=18 Value: 0c103a09813e4aca0957105d343baa55 STA 02:00:00:00:00:01: Received RADIUS packet matched with a pending request, round trip time 1.06 sec RADIUS packet matching with station decapsulated EAP packet (code=4 id=1 len=4) from RADIUS server: EAP Failure EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Failure EAP: Status notification: completion (param=failure) EAP: EAP entering state FAILURE CTRL-EVENT-EAP-FAILURE EAP authentication failed EAPOL: SUPP_PAE entering state HELD EAPOL: SUPP_BE entering state RECEIVE EAPOL: SUPP_BE entering state FAIL EAPOL: SUPP_BE entering state IDLE eapol_sm_cb: result=0 EAPOL: EAP key not available EAPOL: EAP Session-Id not available WPA: Clear old PMK and PTK MPPE keys OK: 0 mismatch: 1 FAILURE v2.x ** Server side rad_recv: Access-Request packet from host 127.0.0.1 port 61757, id=3, length=195 User-Name = "pskuser" NAS-IP-Address = 127.0.0.1 NAS-IPv6-Address = ::1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0203002b2fc0c39ed028d6cc6382c785994d4eebac630000000196259ddb267c9dace28d1e3551092d58f9 State = 0x276118081fbee0445ece86b1659f960f Message-Authenticator = 0xb088717464f5cabcd43dad71af3c3369 Fri Feb 09 03:28:15 2018 : Info: # Executing section authorize from file /freeradius-2.2.10/etc/raddb/sites-enabled/default Fri Feb 09 03:28:15 2018 : Info: +group authorize { Fri Feb 09 03:28:15 2018 : Info: ++[preprocess] = ok Fri Feb 09 03:28:15 2018 : Info: ++[chap] = noop Fri Feb 09 03:28:15 2018 : Info: ++[mschap] = noop Fri Feb 09 03:28:15 2018 : Info: ++[digest] = noop Fri Feb 09 03:28:15 2018 : Info: [suffix] No '@' in User-Name = "pskuser", looking up realm NULL Fri Feb 09 03:28:15 2018 : Info: [suffix] Found realm "NULL" Fri Feb 09 03:28:15 2018 : Info: [suffix] Adding Stripped-User-Name = "pskuser" Fri Feb 09 03:28:15 2018 : Info: [suffix] Adding Realm = "NULL" Fri Feb 09 03:28:15 2018 : Info: [suffix] Authentication realm is LOCAL. Fri Feb 09 03:28:15 2018 : Info: ++[suffix] = ok Fri Feb 09 03:28:15 2018 : Info: [eap] EAP packet type response id 3 length 43 Fri Feb 09 03:28:15 2018 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Fri Feb 09 03:28:15 2018 : Info: ++[eap] = updated Fri Feb 09 03:28:15 2018 : Info: [files] users: Matched entry pskuser at line 79 Fri Feb 09 03:28:15 2018 : Info: ++[files] = ok Fri Feb 09 03:28:15 2018 : Info: ++[expiration] = noop Fri Feb 09 03:28:15 2018 : Info: ++[logintime] = noop Fri Feb 09 03:28:15 2018 : Info: [pap] WARNING: Auth-Type already set. Not setting to PAP Fri Feb 09 03:28:15 2018 : Info: ++[pap] = noop Fri Feb 09 03:28:15 2018 : Info: +} # group authorize = updated Fri Feb 09 03:28:15 2018 : Info: Found Auth-Type = eap2 Fri Feb 09 03:28:15 2018 : Info: # Executing group from file /freeradius-2.2.10/etc/raddb/sites-enabled/default Fri Feb 09 03:28:15 2018 : Info: +group authenticate { Fri Feb 09 03:28:15 2018 : Info: [eap2] Request found, released from the list CTRL-EVENT-EAP-SUCCESS 00:00:00:00:00:00 Fri Feb 09 03:28:15 2018 : Debug: ==> Success Fri Feb 09 03:28:15 2018 : Info: [eap2] Freeing handler Fri Feb 09 03:28:15 2018 : Info: ++[eap2] = ok Fri Feb 09 03:28:15 2018 : Info: +} # group authenticate = ok Fri Feb 09 03:28:15 2018 : Info: # Executing section post-auth from file /freeradius-2.2.10/etc/raddb/sites-enabled/default Fri Feb 09 03:28:15 2018 : Info: +group post-auth { Fri Feb 09 03:28:15 2018 : Info: ++[exec] = noop Fri Feb 09 03:28:15 2018 : Info: +} # group post-auth = noop Sending Access-Accept of id 3 to 127.0.0.1 port 61757 MS-MPPE-Recv-Key = 0x53b9b245aff86a00ac7dce0bad4dde283654907b63970fb5a7754f13fca79ce5 MS-MPPE-Send-Key = 0xd9bad885cbc42d32b265485e519504a11b1d35e8028a7b15b203d84e0006ef64 EAP-Message = 0x03030004 User-Name = "pskuser" Message-Authenticator = 0x00000000000000000000000000000000 Fri Feb 09 03:28:15 2018 : Info: Finished request 3. Fri Feb 09 03:28:15 2018 : Debug: Going to the next request Fri Feb 09 03:28:15 2018 : Debug: Waking up in 4.7 seconds. Fri Feb 09 03:28:20 2018 : Info: Cleaning up request 0 ID 0 with timestamp +7 Fri Feb 09 03:28:20 2018 : Info: Cleaning up request 1 ID 1 with timestamp +7 Fri Feb 09 03:28:20 2018 : Info: Cleaning up request 2 ID 2 with timestamp +7 Fri Feb 09 03:28:20 2018 : Info: Cleaning up request 3 ID 3 with timestamp +7 Fri Feb 09 03:28:20 2018 : Info: Ready to process requests. ** Client side RADIUS packet matching with station MS-MPPE-Send-Key (sign) - hexdump(len=32): d9 ba d8 85 cb c4 2d 32 b2 65 48 5e 51 95 04 a1 1b 1d 35 e8 02 8a 7b 15 b2 03 d8 4e 00 06 ef 64 MS-MPPE-Recv-Key (crypt) - hexdump(len=32): 53 b9 b2 45 af f8 6a 00 ac 7d ce 0b ad 4d de 28 36 54 90 7b 63 97 0f b5 a7 75 4f 13 fc a7 9c e5 decapsulated EAP packet (code=3 id=3 len=4) from RADIUS server: EAP Success EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Success EAP: Status notification: completion (param=success) EAP: EAP entering state SUCCESS CTRL-EVENT-EAP-SUCCESS EAP authentication completed successfully EAPOL: IEEE 802.1X for plaintext connection; no EAPOL-Key frames required WPA: EAPOL processing complete Cancelling authentication timeout State: DISCONNECTED -> COMPLETED EAPOL: SUPP_PAE entering state AUTHENTICATED EAPOL: SUPP_BE entering state RECEIVE EAPOL: SUPP_BE entering state SUCCESS EAPOL: SUPP_BE entering state IDLE eapol_sm_cb: result=1 EAPOL: Successfully fetched key (len=32) PMK from EAPOL - hexdump(len=32): 53 b9 b2 45 af f8 6a 00 ac 7d ce 0b ad 4d de 28 36 54 90 7b 63 97 0f b5 a7 75 4f 13 fc a7 9c e5 No EAP-Key-Name received from server WPA: Clear old PMK and PTK EAP: deinitialize previously used EAP method (47, PSK) at EAP deinit MPPE keys OK: 1 mismatch: 0 SUCCESS
On Feb 9, 2018, at 6:41 AM, Sergio NNX <sfhacker@hotmail.com> wrote:
Different organisations have different requirements or needs. We are just testing the supported methods.
If all you need are tests, then "missing" EAP methods aren't a problem.
In v2.x, I had gpsk { }, pax { } & psk { } sections in eap.conf and all of them worked fine.
No you didn't, and they didn't work fine. Download version 2.2.10, and read eap.conf. There is no reference to "gpsk", "pax" or "psk". Try to configure them in v2. They won't work. What you did was to configure the "eap2" module in version 2. That module was in "experimental.conf", and was documented with the following warning, among many others: # !!! DO NOT USE IT IN A PRODUCTION ENVIRONMENT !!! If you download v3, you'll see that there is no "eap2" module. It was removed. And, the "eap" module *still* has no reference to "gpsk", "pax" or "ask". The "eap" module in v3 documents all of the supported EAP methods. They all work. Methods which aren't documented there don't work. Because they don't exist. Alan DeKok.
Hello George, I think that you should take a look at this: http://deployingradius.com/documents/protocols/compatibility.html . It is probably the best guide that you can use. Note the CHAP section. Cheers Marko -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+marko.eremija=amres.ac.rs@lists.freeradius.org] On Behalf Of Tsirkas Georgios Sent: Thursday, February 08, 2018 8:03 PM To: freeradius-users@lists.freeradius.org Subject: Freeradius Solution (CHAP with LDAP encrypted password) Hello, I am trying connect to a radius client, which can authenticate only with CHAP. Users credentials are stored encrypted in LDAP database. Unfortunately CHAP requires only cleartext password. I dont want to store users credentials plain-text. Is there a solution about it? Thank you, George - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Ok, i understand! So i have thought create "fake chap python module" that checks encrypted passwords too. Then should return ok, and authenticates users with encrypted passwords... On 02/08/2018 11:45 PM, Marko Eremija wrote:
Hello George,
I think that you should take a look at this: http://deployingradius.com/documents/protocols/compatibility.html . It is probably the best guide that you can use. Note the CHAP section.
Cheers Marko
-----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+marko.eremija=amres.ac.rs@lists.freeradius.org] On Behalf Of Tsirkas Georgios Sent: Thursday, February 08, 2018 8:03 PM To: freeradius-users@lists.freeradius.org Subject: Freeradius Solution (CHAP with LDAP encrypted password)
Hello,
I am trying connect to a radius client, which can authenticate only with CHAP. Users credentials are stored encrypted in LDAP database. Unfortunately CHAP requires only cleartext password. I dont want to store users credentials plain-text. Is there a solution about it?
Thank you,
George
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Sigh, read the compatibility page... CHAP requires that the server knows the plaintext password to work. No amount of effort, scripts, magic code will change that. Alister On 09/02/2018, 11:13, "Freeradius-Users on behalf of Tsirkas Georgios" <freeradius-users-bounces+alister.winfield=sky.uk@lists.freeradius.org on behalf of geortsir3@gmail.com> wrote: Ok, i understand! So i have thought create "fake chap python module" that checks encrypted passwords too. Then should return ok, and authenticates users with encrypted passwords... On 02/08/2018 11:45 PM, Marko Eremija wrote: > Hello George, > > I think that you should take a look at this: > http://deployingradius.com/documents/protocols/compatibility.html . It is > probably the best guide that you can use. Note the CHAP section. > > Cheers > Marko > > -----Original Message----- > From: Freeradius-Users > [mailto:freeradius-users-bounces+marko.eremija=amres.ac.rs@lists.freeradius.org] > On Behalf Of Tsirkas Georgios > Sent: Thursday, February 08, 2018 8:03 PM > To: freeradius-users@lists.freeradius.org > Subject: Freeradius Solution (CHAP with LDAP encrypted password) > > Hello, > > I am trying connect to a radius client, which can authenticate only with CHAP. > Users credentials are stored encrypted in LDAP database. > Unfortunately CHAP requires only cleartext password. I dont want to store > users credentials plain-text. Is there a solution about it? > > Thank you, > > George > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Information in this email including any attachments may be privileged, confidential and is intended exclusively for the addressee. The views expressed may not be official policy, but the personal views of the originator. If you have received it in error, please notify the sender by return e-mail and delete it from your system. You should not reproduce, distribute, store, retransmit, use or disclose its contents to anyone. Please note we reserve the right to monitor all e-mail communication through our internal and external networks. SKY and the SKY marks are trademarks of Sky plc and Sky International AG and are used under licence. Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Registration No. 2067075) and Sky Subscribers Services Limited (Registration No. 2340150) are direct or indirect subsidiaries of Sky plc (Registration No. 2247735). All of the companies mentioned in this paragraph are incorporated in England and Wales and share the same registered office at Grant Way, Isleworth, Middlesex TW7 5QD.
Yes CHAP requires that the server knows plaintext password to work. Then server lookup password from database(ldap,mysql,reddis etc.) To do chap challenge, database passwords must be plain-text. It's better, winbox and webfig, support PAP authentication On 02/12/2018 05:58 PM, Winfield, Alister wrote:
d the compatibility page...
CHAP requires that the server knows the plaintext password to work
participants (7)
-
Alan Buxey -
Alan DeKok -
Marko Eremija -
Peter Lambrechtsen -
Sergio NNX -
Tsirkas Georgios -
Winfield, Alister