September 2012 - Freeradius-Users - lists.freeradius.org

Chap Authentication Error
by Daniel Niasoff 16 Sep '12

16 Sep '12

Hi I have had freeradius working for a while without issues serving ppp authentication requests. I am now getting a strange chap issue. A customer is unable to login even though the password is correct This is what I see in the logs Fri Sep 14 17:22:37 2012 : Info: [chap] login attempt by "f3207920(a)surf4sure.net" with CHAP password Fri Sep 14 17:22:37 2012 : Info: [chap] Using clear text password "1234" for user f3207920(a)surf4sure.net authentication. Fri Sep 14 17:22:37 2012 : Info: [chap] Password check failed However if I try to repeat the test using radtest with -t chap it works fine. Fri Sep 14 17:22:32 2012 : Info: [chap] login attempt by "f3207920(a)surf4sure.net" with CHAP password Fri Sep 14 17:22:32 2012 : Info: [chap] Using clear text password "1234" for user f3207920(a)surf4sure.net authentication. Fri Sep 14 17:22:32 2012 : Info: [chap] chap user f3207920(a)surf4sure.net authenticated successfully Now where do I go from here? Thanks Daniel

2 2

Ideas
by Franks Andy (RLZ) IT Systems Engineer 16 Sep '12

16 Sep '12

Hi All, I've been following Thomas Glanzmann's work on sms/email otp with freeradius and can see it could REALLY save our organisation a lot of money (we're using securid tokens exclusively ATM). I'm trying to work out something to suit us and at the same time be helpful to others into making something useful, not that I'm a coder particularly. Can I just ask if anyone has any ideas about implementing a beginning process like this; Authorization : - Check user is in an ldap group "allowed" to do otp; using the files, and ldap modules. I'm thinking pass back the phone number for sms from the ldap module, and place in a custom attribute. Ok on that bit Authentication: - Assuming user has a phone number in ldap and is allowed to do OTP, and if the request is new and, they authenticate, then we want to generate an OTP and store it. I guess the generation *could* be done in exec or perl modules quite easily or using xlat, but not sure how to do it using that. Then the user, otp failed attempts and maybe lock state are stored, preferably in a sql table. If request isn't new, how many tries have they already had? - The ordering is the tricky thing here - we need to authenticate the user before an otp is generated, then challenge against that otp, incrementing the failure count if the auth fails and then rechallenging up to the failure limit and then setting auth-type if we pass the user. I can't do unlang in the authentication phase and presumably the post auth section may not be the place to do all these other checks and sql bits. I can see why it's perhaps easier to do all this in exec or perl modules and just return an exit code, but I'd like to see if it can all be done within FR. Once the challenge fails, we need to prompt again until the retry limit.. - At some point we need to return control variables from the to determine the account lock state and failed attempts if the user fails and then revisits the NAS - from the SQL module, where I'd like to see the session data stored. I guess this is possible but am not 100% on how it's done. These are just ramblings. I'd forgive people for just ignoring this post, but hopefully someone is interested enough to get something like this working - it's a great cheap way of 2 factor authentication and it'd be nice not to have to go and buy software to do this. I know Thomas Glanzmann has already got this going with rlm_perl and the smsotp module methods using a file based db, but I'd like to see ldap authorization and variable passback (phone numbers/ email addresses if using email OTP) filling an sql DB, or maybe rlm_cache (of which I've no knowledge and I think is experimental?) for storage of variables. Also some post auth sql storage of cumulative sessions, failed attempts etc, if possible all using FR natively without perl/exec etc, which wouldn't be too difficult. Am I dreaming or can this be done completely within FR without using perl/exec/..? Cheers Andy

3 7

Re: NEW PIN MODE
by aa ss 15 Sep '12

15 Sep '12

> Read the documentation for the RADIUS clients. Already did and already made lots of tests. I'm using citrix netscaler as a client. Citrix does not support directly securid, but need a radius integrated with RSA. So i configured FreeRadius with SecurID and all work but "new pin mode". I need to find a way to update pins, using also an alternative client that support NEW PIN and NEXT TOKENCODE. After examining lots of documentations, trying lots of configurations, i'm searching for peoples who have experience with similar needs, or someone that give me advices about using alternative clients only to update pins. > Many clients will automatically work with PAP and challenges. But not > all. Consult the client documentation. Yes i know about that, i have tryed many clients, trust me. > And *which* client are you using? Where did you get it from? I don't > really care, as you should be checking the vendor documentation. But > those are questions you should be asking yourself. I! 'm posting here only as a "last solution" and only because i use freeradius as a frontend. I already opened ticket with citrix and rsa, but no solution suitable for my needs. I also already asked to me why i'm here, and if no one could reply to me "ok no problems", i will try again by myself. Thanks Giulius Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

Commit report for master branch
by a.cudbardb＠freeradius.org 15 Sep '12

15 Sep '12

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ======

2 1

Commit report for master branch
by a.cudbardb＠freeradius.org 15 Sep '12

15 Sep '12

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ======

1 0

Commit report for master branch
by a.cudbardb＠freeradius.org 15 Sep '12

15 Sep '12

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ======

1 0

NEW PIN MODE
by aa ss 14 Sep '12

14 Sep '12

Hello all, i have a working freeradius with securID RSA OTP tokens integration (following RSA docs). I need to configure radius clients to reply to Access-Challange new pin or next tokencode proxyed by freeradius. Is there anyone that can help me finding some documentation about ore some people that have experience about this configuration? Many Thanks.

3 2

Commit report for master branch
by a.cudbardb＠freeradius.org 14 Sep '12

14 Sep '12

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ======

1 0

Commit report for master branch
by a.cudbardb＠freeradius.org 14 Sep '12

14 Sep '12

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ======

1 0

Commit report for master branch
by a.cudbardb＠freeradius.org 14 Sep '12

14 Sep '12

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ======

1 0