topic RE: Switch authentication with Radius + LDAP in ExtremeWireless (General)

Switch authentication with Radius + LDAP

Gabriel3 — Wed, 25 Nov 2015 17:25:00 GMT

Hello,

I'm trying to use Freeradius to authenticate the administrators who log into our Extreme switches (Summit X460 or X670)
If the login/password of the administrators are stored in cleartext on the Freeradius server (in the "users" file), it works perfectly.
But in real life, the administrators accounts are stored in an OpenLdap server. So the Freeradius server must do an LDAP request to verify the administrator password. On the LDAP server, the passwords are encrypted with NT-hash.
In this configuration (Freeradius + OpenLDap), i can't get the authentication to work properly.
When i do a tcpdump on the Freeradius server, i see that during authentication, the Extreme switch sends the administrator username, and the password encrypted with MD5 hash. I didn't find any reference in XOS documentation saying how the passwords are sent to the radius server, but it seems to be MD5 hash.

So i guess that with my configuration, it will never work because the freeradius server receives a MD5 hashed password and it must compare it with a NT hashed password...

Did someone tried to get authentication working in a configuration close to mine ? In your opinion is there a way to get this working ?

Thanks in advance for your help
Gabriel

RE: Switch authentication with Radius + LDAP

davidj_cogliane — Wed, 25 Nov 2015 18:10:00 GMT

I am not a radius expert but I am fairly sure you need the SSH.xmod to use any inscription other than MD5. I would expect that if you install the xmod it will open up some additional configuration options.

RE: Switch authentication with Radius + LDAP

StephenW — Wed, 25 Nov 2015 21:05:00 GMT

Gabriel,

The encryption from the switch(radius client) to the RADIUS server does not have the be the same as the LDAP bind to the LDAP server. These function separately to my knowledge. I have not setup Freeradius with Openldap yet but i did find some guides online if you would like to try them out. My apologies if you have already seen these links.

http://www.inspiredtechies.com/setup-freeradius-openldap-mysql-server/

http://ubuntuforums.org/showthread.php?t=1976883

Stephen

RE: Switch authentication with Radius + LDAP

Gabriel3 — Thu, 26 Nov 2015 16:36:00 GMT

Hello,

@David : yes i already have ssh xmod installed on the switch. Administrators log into the switches using SSH. However when the switches passes the password to the radius server, it uses the "User-Password" Radius Attribute, which is based on MD5 hash

@Stephen : thanks for the links, i'm going to read that

Gabriel

RE: Switch authentication with Radius + LDAP

StephenW — Thu, 26 Nov 2015 16:36:00 GMT

Let us know if you get it working. Or get stuck. We can help.

RE: Switch authentication with Radius + LDAP

Gabriel3 — Thu, 26 Nov 2015 16:36:00 GMT

Hello,

Actually, i got it working.
I thought that when an administrator log into a switch that was configured for Radius authentication, the switch sent an MD5-encrypted password to the Radius server, but it's not true.
As described in http://freeradius.org/rfc/rfc2865.html#User-Password, actually the switch makes a MD5 hash of the shared secret + "authenticator" radius attribute, and then it XORes this with the password. And it sends this result to the Radius server.
On the Radius side, the Radius server knows the shared secret, the authenticator attribute (it is sent in the Radius message), so it can make the reverse operation : MD5 hash of (shared secret + authenticator) + XOR with the encrypted password, and therefore it finds the clear-text password of the administrator.
Once the Radius server has the cleartext password, it can encrypt it again in any form (NT hash, MD5 hash, Unix Crypt...) depending on how passwords are encrypted in the database (LDAP or AD server for example)
I couldn't get this to work just because i hade made mistakes in my Freeradius configuration files, it had nothing to do with encryption problems

Thanks again guys for your help
Gabriel

RE: Switch authentication with Radius + LDAP

Ryan_Mathews — Thu, 26 Nov 2015 16:36:00 GMT

Nice work Gabriel and thanks for circling back to the Hub Community to tell us how you solved it. Good stuff!

RE: Switch authentication with Radius + LDAP

StephenW — Thu, 26 Nov 2015 16:36:00 GMT

Gabriel thanks for letting everyone know how you got it working!