Free Radius and non-plain text passwords

[Phillip Ames]

Hi everybody,
I've been poring over the FAQ, archives, config files, and Google for quite
some time and have yet to uncover an answer to my problem (which I would
_think_ is quite common so I have a feeling I'm missing a glaringly obvious
fact). Anyway, to the point:

I have been able to get Free Radius to authenticate from a router using
CHAP. The problem with this is that the passwords are stored in plain text
in the users file on the authentication server. I don't want to use a mySQL
database or LDAP server. I don't mind if the passwords are transmitted in
plaintext (or encrypted with the secret key) over the network, but I'd like
to have them encrypted on the server in whatever file they are stored in.
Therefore, it seems that PAP is the way to go. So, this seems to be my
solution:

1. It seems that the authentication method is chosen by the client(in this
case the router) - please correct me if I am wrong on this assumption.
2. I don't want to use CHAP, so I have to configure my router to use PAP.
3. How do I set up PAP for the Free Radius server?

I understand that PAP authentication is built in to the server via the
rlm_pap module, but where does PAP authentication get its information from?
(as in, where are the user names? Where are the passwords? Does it use the
values from /etc/passwd?)

I'd also rather not add an account to my /etc/passwd file for all the users
who need to authenticate with this system, so I looked at the rlm_passwd
module. It seems like this might be a better route if I use the "authtype =
crypt" config line to make sure the passwords are crypted. Would the
following be the correct way of setting up that type of configuration?

passwd etc_raddb_mypasswdfile {
filename = ${raddbdir}/mypasswdfile
format = "*User-Name::Password"
authtype = crypt
}

The only stumbling block left after that would be figuring out how to crypt
the passwords for those users (I'm open for suggestions of
functions/languages to do this in). From what I understand it wouldn't
matter what salt would be used to crypt those passwords (again, correct me
if I'm wrong) because crypt would return the same password when original was
crypted against the value stored in the password file.

Sorry for the length, I'm just trying to make sure I'm being clear about
what my thought process is so it can be corrected if in error. Thanks in
advance for any help, and if you're going to refer me to the FAQ please at
least point me in a direction (i.e. a section number or keyword).

-Phil


-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

[Phillip Ames]

OK, another 6 hours of digging and putzing have given me what I want
(although not necessarily the way I originally wanted), and I figured I'd
post it here for posterity (and hopefully so it'll be indexed by Google in
case anyone else is looking to do the same).

I couldn't get it to work with rlm_password (for some reason it just didn't
recognize the entries I had in there, perhaps I had the format wrong?) but I
was able to get it working using the Crypt-Password attribute in the regular
users file (I find it strange that there wasn't an example of this in the
comments of the file - perhaps this is something that should be included in
the next version, so the keyword is at least visible to those that bother
reading the examples?). I discovered it in the archives from 6 months ago
(URL:
http://lists.freeradius.org/pipermail/freeradius-users/2003-July/020900.html
). Now my user password file contains entries like this:

bad Auth-Type := System, Crypt-Password ==
"$1$37l.BBR2$bcYRkPw.bkkTAz3gkjsZZ1"

Where "bad" is the user and "$1$37l.BBR2$bcYRkPw.bkkTAz3gkjsZZ1" is the md5
of "password"


On a side note, I was also unable to discover anything different between
Auth-Type := System and Auth-Type := Local. I grep'd the source code
quickly saw just this:

include/radius.h:228:#define PW_AUTHTYPE_SYSTEM 1

Is this a (presently) unused feature? I'll read the RFCs sometime tomorrow
to see if they explain a difference. Hope this helps anyone else out there
looking to do something similar.

-Phil


-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

[Alan DeKok]

Post by Phillip Ames
bad Auth-Type := System, Crypt-Password ==
"$1$37l.BBR2$bcYRkPw.bkkTAz3gkjsZZ1"
Where "bad" is the user and "$1$37l.BBR2$bcYRkPw.bkkTAz3gkjsZZ1" is the
md5 of "password"

That won't entirely do what you expect.

Post by Phillip Ames
On a side note, I was also unable to discover anything different between
Auth-Type := System and Auth-Type := Local.

There's a huge difference. Try using the *default* configuration
files as shipped, and you'll see that the users are authenticated
against /etc/passwd, for Auth-Type = "System". Read the default
"users" file. It explains this.

The reason it isn't doing what you expect is that you're telling it
to do two contradictory things. So it picks one which makes sense,
and authenticates the user. You've told it:

1) Look in/etc/passwd to find a crypt'd password for the user, and
then use that crypt'd password to do the authentication

2) Use the given Crypt-Password to do the authentication.


In this case, the server can do one of two things:

a) use /etc/password, dicsover the user isn't there, complain about
that, and reject the user.

b) ignore the request to use /etc/passwd, because the Crypt-Password
matches.

The server currently does (b). If it did (a), you'd be wondering
why it's complaining that it can't find a password for the user, when
you supplied a Crypt-Password.

All these problems stem from a misunderstanding of what "System"
authentication means. It's explained in the default "users" file,
among other places. Please read them.

Alan DeKok.

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

[Phillip Ames]

Replying to two messages here...

-----Original Message-----
Behalf Of Alan DeKok
Sent: Wednesday, January 07, 2004 11:11 AM
Subject: Re: Free Radius and non-plain text passwords

Post by Phillip Ames
I have been able to get Free Radius to authenticate from a router
using CHAP. The problem with this is that the passwords are stored
in plain text in the users file on the authentication server.

See the FAQ. This isn't much of a problem.

-------------------------
You have 2 choices:

1. You allow CHAP and store all the passwords plaintext.
Advantage: passwords don't go cleartext over the phone line between
the user and the terminal server. Disadvantage: You have to
store the passwords in cleartext on the server.

2. You don't allow CHAP, just PAP. Advantage: you don't store
cleartext passwords on your system. Disadvantage: passwords go
in cleartext over the phone line between the user and the terminal
server.

Now, people say CHAP is more secure. Now you decide which is more likely:

- the phone line between the user and the terminal server gets sniffed
and a cracker (a GOOD one) intercepts just one password
- your radius server is hacked into and a cracker gets ALL passwords
of ALL users.

Right. Still think CHAP is more secure ? I thought so.
-------------------------

Personally, I would find it more likely that the latter scenario occurs and
all the passwords are now in plaintext available to the cracker. This also
seems to be what the last line implies, indicating that it _is_ a problem to
leave a lot of plaintext passwords lying around (or perhaps I'm just not
getting the sarcasm through a text-only rendition of the FAQ). Regardless,
now that I have learned about the Crypt-Password attribute, I am satisfied
with how they are stored on the server user file. Is it possible that the
sample "users" file could be updated to include a sample entry that uses a
Crypt-Password attribute? Grep'ing the entire stock raddb/ directory shows
that it is only mentioned in mssql.conf(line 102) and postgresql.conf(line
126) which is fine for database users but I think it's important enough that
it should be included in the generic "users" file which most people will at
least read when looking for examples.

[rest of message snipped]

On to message 2!

-----Original Message-----
Behalf Of Alan DeKok
Sent: Wednesday, January 07, 2004 11:04 AM
Subject: Re: Free Radius and non-plain text passwords (resolution)

[snip]

Post by Phillip Ames
On a side note, I was also unable to discover anything

different between

Post by Phillip Ames
Auth-Type := System and Auth-Type := Local.

There's a huge difference. Try using the *default* configuration
files as shipped, and you'll see that the users are authenticated
against /etc/passwd, for Auth-Type = "System". Read the default
"users" file. It explains this.

Thank you for pointing that out, I didn't see that previously.



-Phil


-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

[Alan DeKok]

Post by Phillip Ames
Personally, I would find it more likely that the latter scenario
occurs and all the passwords are now in plaintext available to the
cracker.

That's your perogative.

Post by Phillip Ames
Is it possible that the sample "users" file could be updated to
include a sample entry that uses a Crypt-Password attribute?

Supply a patch.

Also note that CHAP, MS-CHAP, etc. won't work with Crypt-Password.

Alan DeKok.

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

[Alan DeKok]

Post by Phillip Ames
I have been able to get Free Radius to authenticate from a router
using CHAP. The problem with this is that the passwords are stored
in plain text in the users file on the authentication server.

See the FAQ. This isn't much of a problem.

Post by Phillip Ames
1. It seems that the authentication method is chosen by the client(in
this case the router) - please correct me if I am wrong on this assumption.

See recent posts to the list. The choice of the user doing PAP or
CHAP is not up to the RADIUS server.

Post by Phillip Ames
3. How do I set up PAP for the Free Radius server?

Huh? You don't have to do anything. It automatically supports PAP.

Post by Phillip Ames
I'd also rather not add an account to my /etc/passwd file for all
the users who need to authenticate with this system, so I looked
at the rlm_passwd module. It seems like this might be a better
route if I use the "authtype = crypt" config line to make sure the
passwords are crypted.

... on the server. Which means you can't do CHAP, EAP-MD5, or a
host of other authentication methods.

Post by Phillip Ames
Would the
following be the correct way of setting up that type of configuration?
passwd etc_raddb_mypasswdfile {
filename =3D ${raddbdir}/mypasswdfile
format =3D "*User-Name::Password"

Possibly. I don't use rlm_passwd, so I'm less familiar with it.

Alan DeKok.

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html