Switch authentication with Radius + LDAP

[Gabriel3]

Hello,

I'm trying to use Freeradius to authenticate the administrators who log into our Extreme switches (Summit X460 or X670)
If the login/password of the administrators are stored in cleartext on the Freeradius server (in the "users" file), it works perfectly.
But in real life, the administrators accounts are stored in an OpenLdap server. So the Freeradius server must do an LDAP request to verify the administrator password. On the LDAP server, the passwords are encrypted with NT-hash.
In this configuration (Freeradius + OpenLDap), i can't get the authentication to work properly.
When i do a tcpdump on the Freeradius server, i see that during authentication, the Extreme switch sends the administrator username, and the password encrypted with MD5 hash. I didn't find any reference in XOS documentation saying how the passwords are sent to the radius server, but it seems to be MD5 hash.

So i guess that with my configuration, it will never work because the freeradius server receives a MD5 hashed password and it must compare it with a NT hashed password...

Did someone tried to get authentication working in a configuration close to mine ? In your opinion is there a way to get this working ?

Thanks in advance for your help
Gabriel

[Gabriel3]

Hello,

@David : yes i already have ssh xmod installed on the switch. Administrators log into the switches using SSH. However when the switches passes the password to the radius server, it uses the "User-Password" Radius Attribute, which is based on MD5 hash

@Stephen : thanks for the links, i'm going to read that

Gabriel

[StephenW]

Gabriel thanks for letting everyone know how you got it working!

[Ryan_Mathews]

Nice work Gabriel and thanks for circling back to the Hub Community to tell us how you solved it. Good stuff!

[Gabriel3]

Hello,

Actually, i got it working.
I thought that when an administrator log into a switch that was configured for Radius authentication, the switch sent an MD5-encrypted password to the Radius server, but it's not true.
As described in http://freeradius.org/rfc/rfc2865.html#User-Password, actually the switch makes a MD5 hash of the shared secret + "authenticator" radius attribute, and then it XORes this with the password. And it sends this result to the Radius server.
On the Radius side, the Radius server knows the shared secret, the authenticator attribute (it is sent in the Radius message), so it can make the reverse operation : MD5 hash of (shared secret + authenticator) + XOR with the encrypted password, and therefore it finds the clear-text password of the administrator.
Once the Radius server has the cleartext password, it can encrypt it again in any form (NT hash, MD5 hash, Unix Crypt...) depending on how passwords are encrypted in the database (LDAP or AD server for example)
I couldn't get this to work just because i hade made mistakes in my Freeradius configuration files, it had nothing to do with encryption problems

Thanks again guys for your help
Gabriel