(RADIATOR) MSCHAPv2-over-PEAP with Radiator to RSA SECURID
Andreas Dietrich
Andreas.Dietrich at controlware.de
Fri Nov 3 04:40:56 CST 2006
Hi everybody,
at first some information about which kind of configuration I speak:
1st as supplicant: 802.1x standard xp sp2 client,
2nd as authenticator: trapeze mx200 wireless switch,
3rd as eap proxy: radiator,
4th as radius autenticaition server: RSA authentication manager 6.1 with steelbelted radius
Authenticate the win xp client on the RSA with mschapv2 over peap.
Because of the hash problem of RSA (it cannot deal with a hashed password) I try the following:
802.1x credentials are Username: "user:PinTokencode" with empty password.
Radiator splits the username into two different credentials, which are proxied to the RSA.
After Accept from the RSA Radiator should inform Trapeze as the Authenticator, that auth process was a success
################### radius.cfg #########################################
Foreground
LogStdout
LogDir c:/Program Files/Radiator
DbDir c:/Program Files/Radiator
BindAddress 10.0.0.20
Trace 4
<Client DEFAULT>
Secret mysecretwithtrapeze
DupInterval 0
</Client>
<Handler ConvertedFromEAPMSCHAPV2=1>
PreAuthHook file:"c:/Program Files/Radiator/userauth.pl"
<AuthBy RADIUS>
Retries 0
LocalAddress 10.0.0.20
Host 10.0.0.21
Secret sharedsecretwithmyrsa
AuthPort 1645
AcctPort 1646
StripFromRequest ConvertedFromEAPMSCHAPV2, MS-CHAP2-Response, MS-CHAP-Challenge
ReplyHook sub { my $p = ${$_[0]};\
my $rp = ${$_[1]};\
my $op = ${$_[2]};\
my $sp = ${$_[3]};\
my $attrib = $p->get_attr('TRPZ-VLAN-Name');\
$attrib="$attrib";\
$rp->add_attr('TRPZ-VLAN-Name',$attrib);}
</AuthBy>
</Handler>
<Handler TunnelledByPEAP=1>
<AuthBy FILE>
EAPType MSCHAP-V2
EAP_PEAP_MSCHAP_Convert 1
</AuthBy>
</Handler>
<Handler>
<AuthBy FILE>
Filename %D/users
EAPType PEAP
EAPTLS_CAFile C:/Radiator/Radiator-3.15/certificates/demoCA/cacert.pem
EAPTLS_CertificateFile C:/Radiator/Radiator-3.15/certificates/cert-srv.pem
EAPTLS_CertificateType PEM
EAPTLS_PrivateKeyFile C:/Radiator/Radiator-3.15/certificates/cert-srv.pem
EAPTLS_PrivateKeyPassword whatever
EAPTLS_MaxFragmentSize 1024
AutoMPPEKeys
SSLeayTrace 1
EAPTLS_SessionResumptionLimit 10
EAPTLS_PEAPVersion 1
</AuthBy>
</Handler>
################### end ofradius.cfg #########################################
################### userauth.pl #########################################
sub
{
my $p = ${$_[0]};
my $user = $p->get_attr('User-Name');
$user =~ /(.*)\:(.*)/;
my $user =$1;
my $pass =$2;
$user = "$user";
$pass = "$pass";
$p->change_attr('User-Name', $user);
$p->change_attr('User-Password', $pass);
$p->{DecodedPassword} = $pass;
}
################### end of userauth.pl #########################################
First sequences about PEAP communication are in the attached txt file...
################### OUTPUT - LOGFILEl #########################################
*** Sending to 10.0.0.21 port 1645 ....
Code: Access-Request
Identifier: 1
Authentic: >X<189><169><127><246><226><238><131><161><21><145>_Y><167>
Attributes:
User-Name = "adietrich"
User-Password = <159>0<199><199>F:l<193><134><218><19><226><241><139><153>D
Fri Nov 3 11:08:45 2006: DEBUG: AuthBy RADIUS result: IGNORE,
Fri Nov 3 11:08:45 2006: DEBUG: EAP result: 2, EAP-MSCHAPV2 converted to Radius MSCHAPV2 and redespatched to a Handler
Fri Nov 3 11:08:45 2006: DEBUG: AuthBy FILE result: IGNORE, EAP-MSCHAPV2 converted to Radius MSCHAPV2 and redespatched to a Handler
Fri Nov 3 11:08:45 2006: DEBUG: EAP result: 2, EAP PEAP inner authentication redespatched to a Handler
Fri Nov 3 11:08:45 2006: DEBUG: AuthBy FILE result: IGNORE, EAP PEAP inner authentication redespatched to a Handler
Fri Nov 3 11:08:46 2006: DEBUG: Packet dump:
*** Received from 10.0.0.21 port 1645 ....
Code: Access-Accept
Identifier: 1
Authentic: #<180><162>y9v<165><169>j<29><10>"f<159><14>.
Attributes:
Class = "SBR2CL<136><181><238><163><133><130><217><218><131><128><17><128>(<1><128><3><129><152><206><128><2><128><11><129><176><217><141><150><171><209><228><233><177><218><128><18><128><14><129><136><181><238><163><133><130><217><218><131><128><128><128><129><216>"
TRPZ-VLAN-Name = "default"
Fri Nov 3 11:08:46 2006: DEBUG: Received reply in AuthRADIUS for req 1 from 10.0.0.21:1645
Fri Nov 3 11:08:46 2006: DEBUG: Access accepted for adietrich:1234600905
Fri Nov 3 11:08:47 2006: DEBUG: Converted EAP-MSCHAPV2 response Packet dump:
Code: Access-Accept
Identifier: UNDEF
Authentic: >X<189><169><127><246><226><238><131><161><21><145>_Y><167>
Attributes:
Class = "SBR2CL<136><181><238><163><133><130><217><218><131><128><17><128>(<1><128><3><129><152><206><128><2><128><11><129><176><217><141><150><171><209><228><233><177><218><128><18><128><14><129><136><181><238><163><133><130><217><218><131><128><128><128><129><216>"
TRPZ-VLAN-Name = "default"
TRPZ-VLAN-Name = ""
Fri Nov 3 11:08:47 2006: DEBUG: Access challenged for anonymous: Converted MSCHAPV2 authentication success
Fri Nov 3 11:08:47 2006: DEBUG: Returned PEAP tunnelled packet dump:
Code: Access-Challenge
Identifier: UNDEF
Authentic: vh<210>l<201><154><175><138><26>5w<159><230><174><136><221>
Attributes:
Fri Nov 3 11:08:47 2006: DEBUG: Access challenged for adietrich:1234600905: EAP PEAP Inner authentication challenged
Fri Nov 3 11:08:47 2006: DEBUG: Packet dump:
*** Sending to 10.0.0.170 port 20007 ....
Code: Access-Challenge
Identifier: 9
Authentic: S<17><172>8,O<148><17>s%ivtT<11>w
Attributes:
EAP-Message = <1><8><0><6><25><0>
Message-Authenticator = <0><0><0><0><0><0><0><0><0><0><0><0><0><0><0><0>
################### end of OUTPUT - LOGFILEl #########################################
Questions:
Why is TRPZ-VLAN-Name not inside the final Access challenge to 10.0.0.170 ?
And why isn't it an access accept instead of access challenge, send to the trapeze ?
How do I send the Trapeze attribute VLAN-NAME in the OUTER AUTHENTICATION ?
Why does Radiator uses the attribute Name TRPZ-VLAN-NAME instead of default naming VLAN-NAME ?
Any suggestion for solving the main problem ? Bypassing the problem of mschap on client side without additional software on the client or changing the authentification server from RSA to vaso or kobil ?
__________________________________________________
Mit freundlichen Grüßen / Regards
Andreas Dietrich
Controlware GmbH
Competence Center Communication Solutions
Waldstrasse 92, 63128 Dietzenbach
Büro: +49 (0)6074 858 545
Mobil: +49 (0)172 6164633
Andreas.Dietrich at controlware.de
www.controlware.de
State-of-the-art Technology for Worldwide Telecommunications
__________________________________________________
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: output.txt
URL: <http://www.open.com.au/pipermail/radiator/attachments/20061103/f05b3641/attachment.txt>
More information about the radiator
mailing list