module fails parsing output, expecting operator
I am seeking help with an error parsing the output from an external exec program with FreeRADIUS 3 (a similar configuration, albeit some file movements for the updated config, worked without a problem with FreeRADIUS 2). The external exec program (/usr/local/bin/multiotp.php) seem to return a valid response (which is the same as for the working configuration for version 2), however FreeRADIUS 3 reports a parsing error at this point. I've been using successfully using FreeRADIUS 2 for a while with MultiOTP to provide an authentication component where the password is a TOTP token and the username is synchronised with an Active Directory and am attempting to upgrade to FreeRADIUS 3. My debug log is as follows: . . . (1) auth_log: --> Mon Jan 27 09:08:08 2020 (1) [auth_log] = ok (1) [chap] = noop (1) mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' (1) [mschap] = ok (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "johnboy", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: No EAP-Message, not doing EAP (1) [eap] = noop (1) [expiration] = noop (1) [logintime] = noop (1) multiotp: Executing: /usr/local/bin/multiotp.php '%{User-Name}' '%{User-Password}' -request-nt-key -src=%{Packet-Src-IP-Address} -chap-challenge=%{CHAP-Challenge} -chap-password=%{CHAP-Password} -ms-chap-challenge=%{MS-CHAP-Challenge} -ms-chap-response=%{MS-CHAP-Response} -ms-chap2-response=%{MS-CHAP2-Response}: (1) multiotp: EXPAND %{User-Name} (1) multiotp: --> johnboy (1) multiotp: EXPAND %{User-Password} (1) multiotp: --> (1) multiotp: EXPAND -src=%{Packet-Src-IP-Address} (1) multiotp: --> -src=127.0.0.1 (1) multiotp: EXPAND -chap-challenge=%{CHAP-Challenge} (1) multiotp: --> -chap-challenge= (1) multiotp: EXPAND -chap-password=%{CHAP-Password} (1) multiotp: --> -chap-password= (1) multiotp: EXPAND -ms-chap-challenge=%{MS-CHAP-Challenge} (1) multiotp: --> -ms-chap-challenge=0x5c1ed153a00f704f [8/1872] (1) multiotp: EXPAND -ms-chap-response=%{MS-CHAP-Response} (1) multiotp: --> -ms-chap-response=0x0001000000000000000000000000000000000000000000000000e6a71cf3f91b0c6218c456823e92d63ff58359976f0c272a (1) multiotp: EXPAND -ms-chap2-response=%{MS-CHAP2-Response} (1) multiotp: --> -ms-chap2-response= (1) multiotp: ERROR: Failed parsing output from: /usr/local/bin/multiotp.php '%{User-Name}' '%{User-Password}' -request-nt-key -src=%{Packet-Src-IP-Address} -chap-challenge=%{CHAP-Challenge} -chap-password=%{CHAP-Password} -ms-chap-challenge=%{MS-CHAP-Challenge} -ms-chap-response=%{MS-CHAP-Response} -ms-chap2-response=%{MS-CHAP2-Response}: Expecting opera tor (1) multiotp: ERROR: Program returned code (0) and output 'Filter-Id += "Erica-Users",NT_KEY: EBEEE229885004ACEA55894DFDC1272D ' (1) [multiotp] = fail (1) } # authorize = fail (1) Using Post-Auth-Type Reject (1) # Executing group from file /etc/raddb/sites-enabled/default (1) Post-Auth-Type REJECT { . . . (Note the wiki page https://wiki.freeradius.org/guide/multiOTP-HOWTO discusses version 3 but seems to reference version 2 file names, so is only useful as a guideline). Thanks! Richard Green UNSW Sydney
On Mon, 2020-01-27 at 09:38 +0000, Richard Green wrote:
I am seeking help with an error parsing the output from an external exec program with FreeRADIUS 3 (a similar configuration, albeit some file movements for the updated config, worked without a problem with FreeRADIUS 2). The external exec program (/usr/local/bin/multiotp.php) seem to return a valid response
It's returning Filter-Id += "Erica-Users",NT_KEY: EBEEE229885004ACEA55894DFDC1272D that's not a valid response, at least not from the ',' onwards.
(which is the same as for the working configuration for version 2), however FreeRADIUS 3 reports a parsing error at this point.
It wasn't a valid response in v2, either. I suspect the code may have been a bit more lax in what it was willing to accept. The external script needs to be fixed to return valid output pairs. However, it looks like it's also being used to run ntlm_auth. Therefore I'd hazard a guess that it needs to be passed an argument to return either the output pairs (Filter-Id += "Erica-Users") or the NT key (NT_KEY: EBEEE22...) depending on whether it's called from 'exec' or from 'mschap', as they expect to see different formats. -- Matthew
Hi Matthew You are correct with regards to the use of the script /usr/local/bin/multiotp.php being used in both the authenticate and authorize sections, and that script returning a value which, when parsed by FreeRADIUS 3, resulted in an an error. To work around this issue, I was able to write wrapper scripts to parse the output of /usr/local/bin/multiotp.php, so they only return one output pair. Thank you for your help :) -Richard ________________________________ From: Freeradius-Users <freeradius-users-bounces+richard.green=unsw.edu.au@lists.freeradius.org> on behalf of Matthew Newton <mcn@freeradius.org> Sent: Monday, 27 January 2020 9:54 PM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: module fails parsing output, expecting operator On Mon, 2020-01-27 at 09:38 +0000, Richard Green wrote:
I am seeking help with an error parsing the output from an external exec program with FreeRADIUS 3 (a similar configuration, albeit some file movements for the updated config, worked without a problem with FreeRADIUS 2). The external exec program (/usr/local/bin/multiotp.php) seem to return a valid response
It's returning Filter-Id += "Erica-Users",NT_KEY: EBEEE229885004ACEA55894DFDC1272D that's not a valid response, at least not from the ',' onwards.
(which is the same as for the working configuration for version 2), however FreeRADIUS 3 reports a parsing error at this point.
It wasn't a valid response in v2, either. I suspect the code may have been a bit more lax in what it was willing to accept. The external script needs to be fixed to return valid output pairs. However, it looks like it's also being used to run ntlm_auth. Therefore I'd hazard a guess that it needs to be passed an argument to return either the output pairs (Filter-Id += "Erica-Users") or the NT key (NT_KEY: EBEEE22...) depending on whether it's called from 'exec' or from 'mschap', as they expect to see different formats. -- Matthew - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Matthew Newton -
Richard Green