SQL query as fallback to auth script?

Jorge Pereira jpereira at freeradius.org
Fri May 3 14:31:42 CEST 2019


*(2)       ERROR: Program returned code (1) and output 'Reject'*

On Fri, May 3, 2019 at 9:16 AM Wladyslaw Jankowski <wladekj at interia.pl>
wrote:

> Hi list!
>
> This issue was probably already answered but I cannot find it. I have a
> setup where FreeRADIUS can't have access to the database where NT hashes
> are stored. I would like FreeRADIUS to fire up a script and than fallback
> to SQL. This way I could at least temporarily grab the hash to local
> database with the script, script would "Reject", and FreeRADIUS would fall
> back to local SQL where the hash temporarily exists. After all the EAP
> magic - FreeRADIUS would try authorize the user via local database.
>
> This is a VPN (not NAS, WiFi..) setup that for best compatibility with
> most operating systems would use EAP-MSCHAPv2 or EAP-TTLS but in any case -
> server is not receiving plaintext password from the user (like with PAP) so
> I can't pass it to the script.
> I have tried the following configuration, but the only SQL queries fired
> after script "Rejects" the user are INSERTS logging this failure:
> authorize {
>         filter_username
>         preprocess
>         auth_log
>         mschap
>         digest
>         expiration
>         logintime
>         eap
>         pap
>         update control {
>                 Auth-Type := `/bin/python /scripts/radiusauth.py
> '%{User-Name}' 'rejectme'`
>         }
>         if (fail) {
>                 sql
>         }
> }
>
> Please find the log below.
>
> (2) Received Access-Request Id 197 from 127.0.0.1:28318 to 127.0.0.1:1812
> length 144
> (2)   User-Name = "provided-username"
> (2)   NAS-Port-Type = Virtual
> (2)   Service-Type = Framed-User
> (2)   NAS-Port = 35
> (2)   NAS-Port-Id = "IKEv2"
> (2)   NAS-IP-Address = server-public-ip
> (2)   Called-Station-Id = "server-public-ip[4500]"
> (2)   Calling-Station-Id = "client-public-ip[60403]"
> (2)   EAP-Message = 0x0200000a0121349a
> (2)   NAS-Identifier = "vpn-software"
> (2)   Message-Authenticator = 0xa123abc123abc123abc123abc123abc1
> (2) # Executing section authorize from file
> /etc/raddb/sites-enabled/default
> (2)   authorize {
> (2)     policy filter_username {
> (2)       if (&User-Name) {
> (2)       if (&User-Name)  -> TRUE
> (2)       if (&User-Name)  {
> (2)         if (&User-Name =~ / /) {
> (2)         if (&User-Name =~ / /)  -> FALSE
> (2)         if (&User-Name =~ /@[^@]*@/ ) {
> (2)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
> (2)         if (&User-Name =~ /\.\./ ) {
> (2)         if (&User-Name =~ /\.\./ )  -> FALSE
> (2)         if ((&User-Name =~ /@/) && (&User-Name !~
> /@(.+)\.(.+)$/))  {
> (2)         if ((&User-Name =~ /@/) && (&User-Name !~
> /@(.+)\.(.+)$/))   -> FALSE
> (2)         if (&User-Name =~ /\.$/)  {
> (2)         if (&User-Name =~ /\.$/)   -> FALSE
> (2)         if (&User-Name =~ /@\./)  {
> (2)         if (&User-Name =~ /@\./)   -> FALSE
> (2)       } # if (&User-Name)  = notfound
> (2)     } # policy filter_username = notfound
> (2)     [preprocess] = ok
> (2) auth_log: EXPAND
> /var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
> (2) auth_log:    --> /var/log/radacct/127.0.0.1/auth-detail-20190503
> (2) auth_log:
> /var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
> expands to /var/log/radacct/127.0.0.1/auth-detail-20190503
> (2) auth_log: EXPAND %t
> (2) auth_log:    --> Fri May  3 07:11:31 2019
> (2)     [auth_log] = ok
> (2)     [chap] = noop
> (2)     [mschap] = noop
> (2)     [digest] = noop
> (2)     [expiration] = noop
> (2)     [logintime] = noop
> (2) eap: Peer sent EAP Response (code 2) ID 0 length 10
> (2) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the
> rest of authorize
> (2)     [eap] = ok
> (2) pap: WARNING: No "known good" password found for the user.  Not
> setting Auth-Type
> (2) pap: WARNING: Authentication will fail unless a "known good" password
> is available
> (2)     [pap] = noop
> (2)     update control {
> (2)      Executing: /bin/python /scripts/radiusauth.py '%{User-Name}'
> 'rejectme':
> (2)       EXPAND %{User-Name}
> (2)          --> provided-username
> (2)       ERROR: Program returned code (1) and output 'Reject'
> (2)     } # update control = fail
> (2)   } # authorize = fail
> (2) Invalid user (Program returned code (1) and output 'Reject'):
> [provided-username/<via Auth-Type = eap>] (from client localhost port
> 35 cli client-public-ip[60403])
> (2) Using Post-Auth-Type Reject
> (2) # Executing group from file /etc/raddb/sites-enabled/default
> (2)   Post-Auth-Type REJECT {
> (2) sql: EXPAND .query
> (2) sql:    --> .query
> (2) sql: Using query template 'query'
> rlm_sql (sql): Closing connection (6): Hit idle_timeout, was idle for 5679
> seconds
> rlm_sql (sql): You probably need to lower "min"
> rlm_sql (sql): Closing connection (7): Hit idle_timeout, was idle for 5679
> seconds
> rlm_sql (sql): You probably need to lower "min"
> rlm_sql (sql): 0 of 0 connections in use.  You  may need to increase
> "spare"
> rlm_sql (sql): Opening additional connection (8), 1 of 32 pending slots
> used
> rlm_sql (sql): Reserved connection (8)
> (2) sql: EXPAND %{User-Name}
> (2) sql:    --> provided-username
> (2) sql: SQL-User-Name set to 'provided-username'
> (2) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate)
> VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}',
> '%{reply:Packet-Type}', '%S')
> (2) sql:    --> INSERT INTO radpostauth (username, pass, reply,
> authdate) VALUES ( 'provided-username', '', 'Access-Reject', '2019-05-03
> 07:11:31')
> (2) sql: Executing query: INSERT INTO radpostauth (username, pass, reply,
> authdate) VALUES ( 'provided-username', '', 'Access-Reject', '2019-05-03
> 07:11:31')
> (2) sql: SQL query returned: success
> (2) sql: 1 record(s) updated
> rlm_sql (sql): Released connection (8)
> Need 2 more connections to reach min connections (3)
> rlm_sql (sql): Opening additional connection (9), 1 of 31 pending slots
> used
> (2)     [sql] = ok
> (2) attr_filter.access_reject: EXPAND %{User-Name}
> (2) attr_filter.access_reject:    --> provided-username
> (2) attr_filter.access_reject: Matched entry DEFAULT at line 11
> (2)     [attr_filter.access_reject] = updated
> (2) eap: Request was previously rejected, inserting EAP-Failure
> (2) eap: Sending EAP Failure (code 4) ID 0 length 4
> (2)     [eap] = updated
> (2)   } # Post-Auth-Type REJECT = updated
> (2) Login incorrect (Program returned code (1) and output 'Reject'):
> [provided-username/<via Auth-Type = eap>] (from client localhost port
> 35 cli client-public-ip[60403])
> (2) Delaying response for 1.000000 seconds
> Waking up in 0.9 seconds.
> (2) Sending delayed response
> (2) Sent Access-Reject Id 197 from 127.0.0.1:1812 to 127.0.0.1:28318
> length 44
> (2)   EAP-Message = 0x04000004
> (2)   Message-Authenticator = 0x00000000000000000000000000000000
> Waking up in 3.9 seconds.
> (2) Cleaning up request packet ID 197 with timestamp +6729
> Ready to process requests
>
> TIA and apologies again if the question was already answered.
>
>
>
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html


More information about the Freeradius-Users mailing list