Need som help getting my external script to work Here is my External module exec MOTP { wait = yes program = "/etc/raddb/otpverify.sh %{User-Name} %{User-Password} %{reply:Secret} %{reply:Pin} %{reply:Offset}" input_pairs = request output_pairs = reply }
From radcheck
(211, 'test', 'Pin', ':=', '0201'), (212, 'test', 'Secret', ':=', '43ab97e05b3a11cb'), (213, 'test', 'Offset', ':=', '0'), (214, 'test', 'Auth-Type', ':=', 'External'); Output from debug. rad_recv: Access-Request packet from host 172.16.24.4 port 38043, id=190, length=74 User-Name = "test" User-Password = "ce3e3e3ebdbf" NAS-IP-Address = 172.16.24.4 NAS-Port = 1 Message-Authenticator = 0x3492fb805715bd7da5ec0371282f71b5 Mon Oct 8 23:52:57 2012 : Info: # Executing section authorize from file /etc/raddb/sites-enabled/default Mon Oct 8 23:52:57 2012 : Info: +- entering group authorize {...} Mon Oct 8 23:52:57 2012 : Info: ++[preprocess] returns ok Mon Oct 8 23:52:57 2012 : Info: ++[chap] returns noop Mon Oct 8 23:52:57 2012 : Info: ++[mschap] returns noop Mon Oct 8 23:52:57 2012 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Mon Oct 8 23:52:57 2012 : Info: [suffix] No such realm "NULL" Mon Oct 8 23:52:57 2012 : Info: ++[suffix] returns noop Mon Oct 8 23:52:57 2012 : Info: [eap] No EAP-Message, not doing EAP Mon Oct 8 23:52:57 2012 : Info: ++[eap] returns noop Mon Oct 8 23:52:57 2012 : Info: ++[unix] returns notfound Mon Oct 8 23:52:57 2012 : Info: ++[files] returns noop Mon Oct 8 23:52:57 2012 : Info: [sql] expand: %{User-Name} -> test Mon Oct 8 23:52:57 2012 : Info: [sql] sql_set_user escaped user --> 'test' Mon Oct 8 23:52:57 2012 : Debug: rlm_sql (sql): Reserving sql socket id: 4 Mon Oct 8 23:52:57 2012 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id Mon Oct 8 23:52:57 2012 : Debug: rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id Mon Oct 8 23:52:57 2012 : Info: [sql] User found in radcheck table Mon Oct 8 23:52:57 2012 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test' ORDER BY id Mon Oct 8 23:52:57 2012 : Debug: rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test' ORDER BY id Mon Oct 8 23:52:57 2012 : Info: [sql] expand: SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM usergroup WHERE username = 'test' ORDER BY priority Mon Oct 8 23:52:57 2012 : Debug: rlm_sql_mysql: query: SELECT groupname FROM usergroup WHERE username = 'test' ORDER BY priority Mon Oct 8 23:52:57 2012 : Info: [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'test' ORDER BY id Mon Oct 8 23:52:57 2012 : Debug: rlm_sql_mysql: query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'test' ORDER BY id Mon Oct 8 23:52:57 2012 : Info: [sql] User found in group test Mon Oct 8 23:52:57 2012 : Info: [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'test' ORDER BY id Mon Oct 8 23:52:57 2012 : Debug: rlm_sql_mysql: query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'test' ORDER BY id Mon Oct 8 23:52:57 2012 : Debug: rlm_sql (sql): Released sql socket id: 4 Mon Oct 8 23:52:57 2012 : Info: ++[sql] returns ok Mon Oct 8 23:52:57 2012 : Info: ++[expiration] returns noop Mon Oct 8 23:52:57 2012 : Info: ++[logintime] returns noop Mon Oct 8 23:52:57 2012 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Mon Oct 8 23:52:57 2012 : Info: ++[pap] returns noop Mon Oct 8 23:52:57 2012 : Info: Found Auth-Type = External Mon Oct 8 23:52:57 2012 : Info: # Executing group from file /etc/raddb/sites-enabled/default Mon Oct 8 23:52:57 2012 : Info: +- entering group External {...} Mon Oct 8 23:52:57 2012 : Info: [MOTP] expand: %{User-Name} -> test Mon Oct 8 23:52:57 2012 : Info: [MOTP] expand: %{User-Password} -> ce3e3e3ebdbf Mon Oct 8 23:52:57 2012 : Info: [MOTP] expand: %{reply:Secret} -> Mon Oct 8 23:52:57 2012 : Info: [MOTP] expand: %{reply:Pin} -> Mon Oct 8 23:52:57 2012 : Info: [MOTP] expand: %{reply:Offset} -> Mon Oct 8 23:52:57 2012 : Debug: Exec-Program output: FAIL Mon Oct 8 23:52:57 2012 : Debug: Exec-Program-Wait: plaintext: FAIL Mon Oct 8 23:52:57 2012 : Debug: Exec-Program: returned: 13 Mon Oct 8 23:52:57 2012 : Info: ++[MOTP] returns fail Mon Oct 8 23:52:57 2012 : Info: Failed to authenticate the user. Mon Oct 8 23:52:57 2012 : Info: Using Post-Auth-Type Reject Mon Oct 8 23:52:57 2012 : Info: # Executing group from file /etc/raddb/sites-enabled/default Mon Oct 8 23:52:57 2012 : Info: +- entering group REJECT {...} Mon Oct 8 23:52:57 2012 : Info: [attr_filter.access_reject] expand: %{User-Name} -> test Mon Oct 8 23:52:57 2012 : Debug: attr_filter: Matched entry DEFAULT at line 11 Mon Oct 8 23:52:57 2012 : Info: ++[attr_filter.access_reject] returns updated Mon Oct 8 23:52:57 2012 : Info: Delaying reject of request 0 for 1 seconds Mon Oct 8 23:52:57 2012 : Debug: Going to the next request Mon Oct 8 23:52:57 2012 : Debug: Waking up in 0.9 seconds. Mon Oct 8 23:52:58 2012 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 190 to 172.16.24.4 port 38043 Mon Oct 8 23:52:58 2012 : Debug: Waking up in 4.9 seconds. As you can see it dosent seem to get the reply vars Mon Oct 8 23:52:57 2012 : Info: [MOTP] expand: %{User-Name} -> test Mon Oct 8 23:52:57 2012 : Info: [MOTP] expand: %{User-Password} -> ce3e3e3ebdbf Mon Oct 8 23:52:57 2012 : Info: [MOTP] expand: %{reply:Secret} -> Mon Oct 8 23:52:57 2012 : Info: [MOTP] expand: %{reply:Pin} -> Mon Oct 8 23:52:57 2012 : Info: [MOTP] expand: %{reply:Offset} -> In /usr/share/freeradius/dictionary I have $INCLUDE dictionary.motp And from my Dictionary.motp # ATTRIBUTE Secret 960 string ATTRIBUTE Pin 961 string ATTRIBUTE Offset 962 string All my configuration is based on http://nicoblog.goralski.fr/tag/Radius Med venlig hilsen | Best regards Thomas Raabo Senior Network Engineer CCIE #33466 _____________________________________________ tr@zitcom.dk | Direkte: +45 69 10 60 18 | Tlf.: +45 70 23 55 66