multiotp 4.3.2.6 with freeradius 3.0.11 on CentOS 7 with Google Authenticator - can't authenticate remotely
I configured mutiotp 4.3.2.6 with freeradius 3.0.11 on CentOS7 and am using Google Authenticator. I can authenticate tokens locally on the server when I run multiotp from the command line, but when I try to authenticate remotely to the radius server, I run into the following from the radiusd -X log: Failed parsing output from: /home/admin/multiotp/multiotp '%{User-Name}' '%{User-Password}' -request-nt-key -src=%{Packet-Src-IP-Address} -chap-challenge=%{CHAP-Challenge} -chap-password=%{CHAP-Password} -ms-chap-challenge=%{MS-CHAP-Challenge} -ms-chap-response=%{MS-CHAP-Response} -ms-chap2-response=%{MS-CHAP2-Response}: Expecting operator Program returned code (2) and output 'Failed to execute "/home/admin/multiotp/multiotp": Permission denied' (0) [multiotp] = fail (0) } # authorize = fail Prior to this message in the log, the multiotp script properly read my username/password and ip-address. The file permissions for multiotp are rwx for all users, and I opened up the directory path the same way. The one thing I have issues with is the multiotp configuration documentation, which states to edit the policy.conf file. Well, there is no policy.conf file, so not sure where to configure that section of the multiotp configuration instructions. Any suggestions? Thanks! Pete
On 6 Oct 2016, at 17:33, Skrebetz, Pete <Peter.Skrebetz@netscout.com> wrote:
Prior to this message in the log, the multiotp script properly read my username/password and ip-address. The file permissions for multiotp are rwx for all users, and I opened up the directory path the same way. The one thing I have issues with is the multiotp configuration documentation, which states to edit the policy.conf file. Well, there is no policy.conf file, so not sure where to configure that section of the multiotp configuration instructions. Any suggestions?
SElinux. Regards, Adam Bishop gpg: E75B 1F92 6407 DFDF 9F1C BF10 C993 2504 6609 D460 jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.
Adam, I found that SELinux was enabled, so I disabled it, but I'm still running into the same issue. Thanks, Pete -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+peter.skrebetz=netscout.com@lists.freeradius.org] On Behalf Of Adam Bishop Sent: Thursday, October 6, 2016 10:50 AM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: multiotp 4.3.2.6 with freeradius 3.0.11 on CentOS 7 with Google Authenticator - can't authenticate remotely On 6 Oct 2016, at 17:33, Skrebetz, Pete <Peter.Skrebetz@netscout.com> wrote:
Prior to this message in the log, the multiotp script properly read my username/password and ip-address. The file permissions for multiotp are rwx for all users, and I opened up the directory path the same way. The one thing I have issues with is the multiotp configuration documentation, which states to edit the policy.conf file. Well, there is no policy.conf file, so not sure where to configure that section of the multiotp configuration instructions. Any suggestions?
SElinux. Regards, Adam Bishop gpg: E75B 1F92 6407 DFDF 9F1C BF10 C993 2504 6609 D460 jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800. - List info/subscribe/unsubscribe? See https://urldefense.proofpoint.com/v2/url?u=http-3A__www.freeradius.org_list_...
Turns out I had to open up permissions on all the folders leading to the multiotp.php file. Now onto the next issue! Thanks! -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+peter.skrebetz=netscout.com@lists.freeradius.org] On Behalf Of Skrebetz, Pete Sent: Thursday, October 6, 2016 11:23 AM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: RE: multiotp 4.3.2.6 with freeradius 3.0.11 on CentOS 7 with Google Authenticator - can't authenticate remotely Adam, I found that SELinux was enabled, so I disabled it, but I'm still running into the same issue. Thanks, Pete -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+peter.skrebetz=netscout.com@lists.freeradius.org] On Behalf Of Adam Bishop Sent: Thursday, October 6, 2016 10:50 AM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: multiotp 4.3.2.6 with freeradius 3.0.11 on CentOS 7 with Google Authenticator - can't authenticate remotely On 6 Oct 2016, at 17:33, Skrebetz, Pete <Peter.Skrebetz@netscout.com> wrote:
Prior to this message in the log, the multiotp script properly read my username/password and ip-address. The file permissions for multiotp are rwx for all users, and I opened up the directory path the same way. The one thing I have issues with is the multiotp configuration documentation, which states to edit the policy.conf file. Well, there is no policy.conf file, so not sure where to configure that section of the multiotp configuration instructions. Any suggestions?
SElinux. Regards, Adam Bishop gpg: E75B 1F92 6407 DFDF 9F1C BF10 C993 2504 6609 D460 jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800. - List info/subscribe/unsubscribe? See https://urldefense.proofpoint.com/v2/url?u=http-3A__www.freeradius.org_list_... - List info/subscribe/unsubscribe? See https://urldefense.proofpoint.com/v2/url?u=http-3A__www.freeradius.org_list_...
participants (2)
-
Adam Bishop -
Skrebetz, Pete