黃巾賊的私人日記: radius

RADIUS protocol http://www.untruth.org/~josh/security/radius/radius-auth.html

802.1X in linux http://tldp.org/HOWTO/html_single/8021X-HOWTO/

PPP EAP TLS Authentication Protocol: http://www.ietf.org/rfc/rfc2716.txt

RADIUS (Remote Authentication Dial In User Service)
Support For Extensible Authentication Protocol (EAP)

http://www.ietf.org/rfc/rfc3579.txt

----------------------------------------------------------------------------------

Authenticating Peer     Authenticator
   -------------------     -------------
                           <- PPP LCP Request-EAP
                           auth
   PPP LCP ACK-EAP
   auth ->
                           <- PPP EAP-Request/
                           Identity
   PPP EAP-Response/
   Identity (MyID) ->
                           <- PPP EAP-Request/
                           EAP-Type=EAP-TLS
                           (TLS Start)
   PPP EAP-Response/
   EAP-Type=EAP-TLS
   (TLS client_hello)->
                           <- PPP EAP-Request/
                           EAP-Type=EAP-TLS
                           (TLS server_hello,
                            TLS certificate,
                    [TLS server_key_exchange,]
                    [TLS certificate_request,]
                        TLS server_hello_done)
   PPP EAP-Response/
   EAP-Type=EAP-TLS
   (TLS certificate,
    TLS client_key_exchange,
   [TLS certificate_verify,]
    TLS change_cipher_spec,
    TLS finished) ->
                           <- PPP EAP-Request/
                           EAP-Type=EAP-TLS
                           (TLS change_cipher_spec,
                            TLS finished)
   PPP EAP-Response/
   EAP-Type=EAP-TLS ->
                           <- PPP EAP-Success
   PPP Authentication
   Phase complete,
   NCP Phase starts

----------------

FreeRadius + EAP with 802.1X wireless WPA.

[peter@localhost certs]$ pwd
/pub/rootfs/etc/raddb/certs
[peter@localhost certs]$ ls
01.pem      ca.key      index.txt       random      server.cnf  server.p12
bootstrap*  ca.pem      index.txt.attr  README      server.crt  server.pem
ca.cnf      client.cnf  index.txt.old   serial      server.csr  xpextensions
ca.der      dh          Makefile        serial.old  server.key

1. install ca.pem and server.pem to windows.(rename as *.cer in windows).
   for more info of x509, see README for HOWTO EAP...
2. load ca.pem and server.pem. into windows.
3. start freeradius by #radius -X

freeradius是由radius 支援各種module(包含eap)

[peter@localhost main]$ ls ../modules/
lib/ rlm_copy_packet/ rlm_exec/ rlm_logintime/ rlm_protocol_filter/ rlm_sql_log/
Makefile rlm_counter/ rlm_expiration/ rlm_mschap/ rlm_python/ rlm_unix/
rlm_acctlog/ rlm_cram/ rlm_expr/ rlm_opendirectory/ rlm_radutmp/ rlm_wimax/
rlm_acct_unique/ rlm_dbm/ rlm_fastusers/ rlm_otp/ rlm_realm/ rules.mak
rlm_always/ rlm_detail/ rlm_files/ rlm_pam/ rlm_sim_files/ stable
rlm_attr_filter/ rlm_digest/ rlm_ippool/ rlm_pap/ rlm_smb/
rlm_attr_rewrite/ rlm_dynamic_clients/ rlm_jradius/ rlm_passwd/ rlm_sql/
rlm_caching/ rlm_eap/ rlm_krb5/ rlm_perl/ rlm_sqlcounter/
rlm_chap/ rlm_eap2/ rlm_ldap/ rlm_policy/ rlm_sqlhpwippool/
rlm_checkval/ rlm_example/ rlm_linelog/ rlm_preprocess/ rlm_sqlippool/

其中我要try的是eap+tls，也就是wifi的wpa enterprise
而eap也只是個protocol的frame，tls就是包在eap。

trace code:
freeradus是以module來plugin各種module。(eap也是個module)
例如: freeradius-server-2.1.1/src/modules/rlm_example/rlm_example.c

   218 module_t rlm_example = {
   219 RLM_MODULE_INIT,
   220 "example",
   221 RLM_TYPE_THREAD_SAFE, /* type */
   222 example_instantiate, /* instantiation */
   223 example_detach, /* detach */
   224 {
   225 example_authenticate, /* authentication */
   226 example_authorize, /* authorization */
   227 example_preacct, /* preaccounting */
   228 example_accounting, /* accounting */
   229 example_checksimul, /* checksimul */
   230 NULL, /* pre-proxy */
   231 NULL, /* post-proxy */
   232 NULL /* post-auth */
   233 },
   234 };

整個架構是以一個status machine來design，所以trace起來還滿吃力的…

modules/rlm_eap/eap.c #EAP module from RADIUS.
modules/rlm_eap/rlm_eap.c #

EAP module from RADIUS, loadable module.

modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c #TLS module plug by EAP module.
modules/rlm_eap/libeap/eap_tls.c #library TLS for TLS, TTLS, PEAP ...

討厭的是，TLS module for EAP也只是frame，它完全只是由openssl來implementation。
所以radius的eap+tls要由openssl的support.

先了解openssl的架構，openssl library是由ssl protocol和cipher組成
而SSL_xxx是protocol的部分，它包含了BIO_xxx，BIO_xxx是用來hook protocol的I/O stream。
BIO_read/BIO_write是我tracecode的重點。

我在

modules/rlm_eap/libeap/tls.c找到了

BIO_read在

int tls_handshake_recv(tls_session_t *ssn)和

   int tls_handshake_send(tls_session_t *ssn)

BIO_write 在int tls_handshake_recv(tls_session_t *ssn)和
  [

modules/rlm_eap/libeap/eap_tls.c ] eaptls_status_t eaptls_process(EAP_HANDLER *handler)

再來要看這些functions是如何cowork的

In order to implement RADIUS to my project. I take some practices it on X86 linux.

Here are some simplest setting for PAP, client only pass Username/Password to RADIUS server.

For server side, I only want test basic username/password.
Here are 3 files involved.
"client.conf","users" and "modules/pap"
[peter@localhost raddb]$ vim clients.conf
# Allowed values are:
# dotted quad (1.2.3.4)
# hostname (radius.example.com)
#ipaddr = 127.0.0.1
ipaddr = 172.21.33.112

secret = testing123

#vim modules/pap
pap {
auto_header = yes
}

#vi users
peter Cleartext-Password := "4321"

-----------------------
For client test.
----------------------
[peter@localhost raddb]$ vim /share/rootfs/etc/radiusclient/radiusclient.conf
authserver 172.21.46.133

#vim /share/rootfs/etc/radiusclient/servers
172.21.46.133 testing123

conclusion:
The shared secrets ("testing123" in this case) MUST match with client/server.
The User-Passowrd was sent by s MD5(password, secrets). so the clear-password was never sent to network.

TIP:
#server daemon in my environment.
LD_LIBRARY_PATH=/usr/lib:/lib/:/lib/tls/:$LD_LIBRARY_PATH ./radiusd -s -X
#client test utility
echo "User-Name = test" | /usr/local/bin/radclient localhost:1812 auth s3cr3t
echo "User-Name=test,Password=mypass,Framed-Protocol=PPP " | /usr/local/bin/radclient localhost:1812 auth s3cr3t

--------------------
A debug mode of radiusd -s -X
-------------
Listening on authentication address * port 1812
Listening on accounting address * port 1813
Listening on proxy address * port 1814
Ready to process requests.
rad_recv: Access-Request packet from host 172.21.33.112 port 1054, id=60, length=63
User-Name = "peter"
User-Password = "4321"
Service-Type = Authenticate-Only
NAS-Port = 0
NAS-IP-Address = 172.21.33.112
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "peter", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] No EAP-Message, not doing EAP
++[eap] returns noop
++[unix] returns notfound
[files] users: Matched entry peter at line 93
++[files] returns ok
++[expiration] returns noop
++[logintime] returns noop
++[pap] returns updated
Found Auth-Type = PAP
+- entering group PAP {...}
[pap] login attempt with password "4321"
[pap] Using clear text password "4321"
[pap] User authenticated successfully
++[pap] returns ok
+- entering group post-auth {...}
++[exec] returns noop
Sending Access-Accept of id 60 to 172.21.33.112 port 1054
Finished request 0.
Going to the next request
Waking up in 4.9 seconds.
Cleaning up request 0 ID 60 with timestamp +9
Ready to process requests.

黃巾賊的私人日記

2010年3月3日星期三

802.1X raidus + EAP(TLS)

2008年12月9日星期二

free-radius server/client config

網頁

關於我自己

2010年3月3日 星期三

802.1X raidus + EAP(TLS)

2008年12月9日 星期二

free-radius server/client config

2010年3月3日星期三

2008年12月9日星期二