<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br>On 9 May 2014, at 15:49, Frederic Van Espen <<a href="mailto:frederic.ve@gmail.com">frederic.ve@gmail.com</a>> wrote:<br><br><blockquote type="cite">On Fri, May 9, 2014 at 3:52 PM, Arran Cudbard-Bell<br><<a href="mailto:a.cudbardb@freeradius.org">a.cudbardb@freeradius.org</a>> wrote:<br><blockquote type="cite">I've fixed it in v3.0.x HEAD (which will become 3.0.3 very soon) so that<br>it just works. If you could test it'd be very much appreciated :)<br><br>For your setup with LDAP and crypt, it'd be something like:<br>authorize {<br> yubikey<br> ldap<br>}<br><br>authenticate {<br> Auth-Type yubikey {<br> yubikey<br> pap<br> }<br>}<br></blockquote><br>Alas, does not seem to work with the configuration you suggest :-(<br></blockquote><div><br></div><div>Git pull... I haven't fixed anything, but i've added a format marker,</div><div>so it'll show where in the string it found the non modhex char.</div><div><br></div><div>It'll only show up with -Xx because of the policy we introduced about</div><div>not showing sensitive strings with -X, after a couple of accidental</div><div>postings of passwords to GitHub and the list.</div><div><br></div><div>I tested with your string and it came back fine, so i'm a little confused.</div><div>Here's my output (with -Xx).</div><div><br></div><div>Received Access-Request Id 50 from 127.0.0.1:54741 to 127.0.0.1:1812 length 91<br> Code:<span class="Apple-tab-span" style="white-space:pre"> </span>1<br> Id:<span class="Apple-tab-span" style="white-space:pre"> </span>50<br> Length:<span class="Apple-tab-span" style="white-space:pre"> </span>91<br> Vector:<span class="Apple-tab-span" style="white-space:pre"> </span>d6f8b36def2807b39afba22805bd09f5<br> Data:<span class="Apple-tab-span" style="white-space:pre"> </span>01 05 66 6f 6f <br><span class="Apple-tab-span" style="white-space:pre"> </span>02 42 d9 dc 63 29 40 fb 89 6d 8d 9c 24 bf 8b 63 a4 dd <br><span class="Apple-tab-span" style="white-space:pre"> </span>e0 72 05 bb 58 38 ab 56 7c 40 ec d8 51 8e 98 49 <br><span class="Apple-tab-span" style="white-space:pre"> </span>cd a9 e4 4e 76 1a 53 0c 14 67 29 a2 98 c4 8d ad <br><span class="Apple-tab-span" style="white-space:pre"> </span>1a ce 51 70 e8 bb 44 70 ed ae 8e ff c6 8d 1a 8a <br><span class="Apple-tab-span" style="white-space:pre"> </span>User-Name = 'foo'<br><span class="Apple-tab-span" style="white-space:pre"> </span>User-Password = 'testingpasswordccccccdbkebjkgfkgdrvthntvckrnifbicgrdgrldigl'<br>Fri May 9 18:40:54 2014 : Debug: (0) # Executing section authorize from file /usr/local/freeradius/etc/raddb/sites-enabled/default<br>Fri May 9 18:40:54 2014 : Debug: (0) authorize {<br>Fri May 9 18:40:54 2014 : Debug: (0) modsingle[authorize]: calling yubikey (rlm_yubikey) for request 0<br>Fri May 9 18:40:54 2014 : Debug: (0) yubikey : request:Yubikey-OTP := 'ccccccdbkebjkgfkgdrvthntvckrnifbicgrdgrldigl'<br>Fri May 9 18:40:54 2014 : Debug: (0) yubikey : request:User-Password := 'testingpassword'<br>Fri May 9 18:40:54 2014 : Debug: (0) modsingle[authorize]: returned from yubikey (rlm_yubikey) for request 0<br>Fri May 9 18:40:54 2014 : Debug: (0) [yubikey] = ok<br><br></div><div>and your debug was was:</div><div><br></div><div>Fri May 9 16:41:15 2014 : Debug: (0) yubikey : User-Password (aes-block) value contains non modhex chars</div><div><br></div><div>Meaning it found a char outside of "cbdefghijklnrtuv" in the AES block portion, but were using the same</div><div>string, so I don't see how that works.</div><div><br></div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><div>Relevant configuration files and debug output:</div><div>mods-enabled/yubikey:</div><div>yubikey {</div><div> split = yes</div><div> decrypt = no</div><div> validate = yes</div><div> validation {</div><div> servers {</div><div> }</div><div> client_id = XXXXX</div><div> api_key = 'OBSCURED'</div></blockquote><div><br></div><div>Hmm I'll add the << secret >> stuff to api_key as well.</div><div><br></div><div>-Arran</div><br><div>Arran Cudbard-Bell <<a href="mailto:a.cudbardb@freeradius.org">a.cudbardb@freeradius.org</a>><br>FreeRADIUS Development Team<br><br>FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2<br></div><br></body></html>