There is no "Calling-Station-Id" attribute in access-requests sent in response to radius challenge from pam_radius-1.3.17-2.el6.x86_64 (CentOS release 6.5)
Hi all, I'm using freeradius for custom 2-factor OTP authentication as below: RADIUS_CLIENT > Access-Request(User/Pass) > FreeRADIUS(check user pass and if ok -> generates state) > Access-Challenge > RADIUS_CLIENT> Access-Request(User/OTP/state) > FreeRADIUS In first Access-Request (before Access-Challenge) RADIUS_CLIENT is sending all required attributes well My problem is on the second Access-Request (after Access-Challenge). There is no "Calling-Station-Id" attribute on this state for some reason... I have checked this on the following radius client: pam_radius-1.3.17-2.el6.x86_64 (CentOS release 6.5) Anyone can suggest some work around for above? Maybe it is configuration issue I'm missing? Thanks a lot, Dmitry!
Le 31 août 2014 à 23:21, Dmitry Saratsky a écrit :
Hi all,
I'm using freeradius for custom 2-factor OTP authentication as below: RADIUS_CLIENT > Access-Request(User/Pass) > FreeRADIUS(check user pass and if ok -> generates state) > Access-Challenge > RADIUS_CLIENT> Access-Request(User/OTP/state) > FreeRADIUS
In first Access-Request (before Access-Challenge) RADIUS_CLIENT is sending all required attributes well My problem is on the second Access-Request (after Access-Challenge). There is no "Calling-Station-Id" attribute on this state for some reason... I have checked this on the following radius client: pam_radius-1.3.17-2.el6.x86_64 (CentOS release 6.5)
Hello Dmitri, According to RFC 2865, an Access-Request packet MUST come with either a Calling-Station-Id or a NAS-Identifier AVP. So, if you don't have one, perhaps could you achieve something with the other one (if present, of course)?
Anyone can suggest some work around for above? Maybe it is configuration issue I'm missing?
Looks more to be a "RADIUS_CLIENT" issue. Could you post an example of a (first Access-Request, second Access-Request) pair sent by that "RADIUS_CLIENT"? Axel
Hi Axel, Thank you for update!
According to RFC 2865, an Access-Request packet MUST come with either a Calling-Station-Id or a NAS-Identifier AVP. So, if you don't have one, perhaps could you achieve something with the other one (if present, of course)?
NAS-Identifier attribute is sent on both access-requests, but is helpless for me, bcz I can't update it dynamically on linux machine... I'm developing the feature, that will reject user authentication for user+nas_ip+calling-station-id if in log it more than X failed login within last Y minutes from the user. Now this feature is working, but it rejects requestes based on user+nas_ip only, bcz calling_station_id is blank ((((
Looks more to be a "RADIUS_CLIENT" issue.
Yeah, I already reported new issue on github to pam_radius developers, but I afraid they will ignore it, just because NAS-Identifier is sent in both requests(((
Could you post an example of a (first Access-Request, second Access-Request) pair sent by that "RADIUS_CLIENT"? Sure, here is the output: 1st Access-Request: rad_recv: Access-Request packet from host 192.168.64.11 port 17193, id=5, length=98 User-Name = "username" User-Password = "some password" NAS-IP-Address = 192.168.64.11 NAS-Identifier = "sshd" NAS-Port = 16168 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "192.168.65.20"
Sending Access-Challenge of id 5 to 192.168.64.11 port 17193 Reply-Message = "OTP code: " State = 0x33643539623066642d333162662d313165342d393939332d353235343030613964313334 2nd Access-Request: rad_recv: Access-Request packet from host 192.168.64.11 port 17193, id=6, length=108 User-Name = "username" User-Password = "736396" NAS-IP-Address = 192.168.64.11 NAS-Identifier = "sshd" NAS-Port = 16168 NAS-Port-Type = Virtual State = 0x33643539623066642d333162662d313165342d393939332d353235343030613964313334 BR, Dmitry. -----Original Message----- From: freeradius-users-bounces+simpot=simpot.com@lists.freeradius.org [mailto:freeradius-users-bounces+simpot=simpot.com@lists.freeradius.org] On Behalf Of Axel Luttgens Sent: 01 Sep 2014 11:52 To: FreeRadius users mailing list Subject: Re: There is no "Calling-Station-Id" attribute in access-requests sent in response to radius challenge from pam_radius-1.3.17-2.el6.x86_64 (CentOS release 6.5) Le 31 août 2014 à 23:21, Dmitry Saratsky a écrit :
Hi all,
I'm using freeradius for custom 2-factor OTP authentication as below: RADIUS_CLIENT > Access-Request(User/Pass) > FreeRADIUS(check user pass and if ok -> generates state) > Access-Challenge > RADIUS_CLIENT> Access-Request(User/OTP/state) > FreeRADIUS
In first Access-Request (before Access-Challenge) RADIUS_CLIENT is sending all required attributes well My problem is on the second Access-Request (after Access-Challenge). There is no "Calling-Station-Id" attribute on this state for some reason... I have checked this on the following radius client: pam_radius-1.3.17-2.el6.x86_64 (CentOS release 6.5)
Hello Dmitri, According to RFC 2865, an Access-Request packet MUST come with either a Calling-Station-Id or a NAS-Identifier AVP. So, if you don't have one, perhaps could you achieve something with the other one (if present, of course)?
Anyone can suggest some work around for above? Maybe it is configuration issue I'm missing?
Looks more to be a "RADIUS_CLIENT" issue. Could you post an example of a (first Access-Request, second Access-Request) pair sent by that "RADIUS_CLIENT"? Axel - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi, as per the config files: # This configuration file is used to remove almost all of the # attributes From an Access-Challenge message. The RFC's say # that an Access-Challenge packet can contain only a few # attributes. We enforce that here. # DEFAULT EAP-Message =* ANY, State =* ANY, Message-Authenticator =* ANY, Reply-Message =* ANY, Proxy-State =* ANY, Session-Timeout =* ANY, Idle-Timeout =* ANY ...so, why do you think ANY of these other things should be in challenge datagrams? alan
Hi Alan, I'm not talking about Access-Challenge message... I'm talking about 2nd Access-Request message which is sent by radius client as result for Access-Challenge and user-input... BR, Dmitry. -----Original Message----- From: freeradius-users-bounces+simpot=simpot.com@lists.freeradius.org [mailto:freeradius-users-bounces+simpot=simpot.com@lists.freeradius.org] On Behalf Of A.L.M.Buxey@lboro.ac.uk Sent: 01 Sep 2014 14:30 To: FreeRadius users mailing list Subject: Re: There is no "Calling-Station-Id" attribute in access-requests sent in response to radius challenge from pam_radius-1.3.17-2.el6.x86_64 (CentOS release 6.5) Hi, as per the config files: # This configuration file is used to remove almost all of the # attributes From an Access-Challenge message. The RFC's say # that an Access-Challenge packet can contain only a few # attributes. We enforce that here. # DEFAULT EAP-Message =* ANY, State =* ANY, Message-Authenticator =* ANY, Reply-Message =* ANY, Proxy-State =* ANY, Session-Timeout =* ANY, Idle-Timeout =* ANY ...so, why do you think ANY of these other things should be in challenge datagrams? alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Le 1 sept. 2014 à 10:51, Axel Luttgens a écrit :
[...] According to RFC 2865, an Access-Request packet MUST come with either a Calling-Station-Id or a NAS-Identifier AVP. [...]
Sorry, big mistake of mine... I should have written: According to RFC 2865, an Access-Request packet MUST come with either a NAS-IP-Address or a NAS-Identifier AVP. I'm probably reading too many docs simultaneously these times, but this doesn't change the fact that that part of my reply was thus fully irrelevant. Axel
Hi Axel, Thanks for update! Both attributes are present in both access-request packets. So it looks like all works according to RFC and I have low chances that "Calling-Station-Id" will be added to 2nd request by developers((( Thanks, Dmitry. -----Original Message----- From: freeradius-users-bounces+simpot=simpot.com@lists.freeradius.org [mailto:freeradius-users-bounces+simpot=simpot.com@lists.freeradius.org] On Behalf Of Axel Luttgens Sent: 01 Sep 2014 14:26 To: FreeRadius users mailing list Subject: Re: There is no "Calling-Station-Id" attribute in access-requests sent in response to radius challenge from pam_radius-1.3.17-2.el6.x86_64 (CentOS release 6.5) Le 1 sept. 2014 à 10:51, Axel Luttgens a écrit :
[...] According to RFC 2865, an Access-Request packet MUST come with either a Calling-Station-Id or a NAS-Identifier AVP. [...]
Sorry, big mistake of mine... I should have written: According to RFC 2865, an Access-Request packet MUST come with either a NAS-IP-Address or a NAS-Identifier AVP. I'm probably reading too many docs simultaneously these times, but this doesn't change the fact that that part of my reply was thus fully irrelevant. Axel - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Dmitry Saratsky wrote:
So it looks like all works according to RFC and I have low chances that "Calling-Station-Id" will be added to 2nd request by developers(((
Why would you say that? You're just assuming the worst. Alan DeKok.
:))))))))))))) I'll keep my fingers crossed)) PS: Actually I do not have wide experience in communication with developers of open-source community... So I assume the worth (based on my experience with developers in other communities). Hope I'm wrong about them)) BR, Dmitry. -----Original Message----- From: freeradius-users-bounces+simpot=simpot.com@lists.freeradius.org [mailto:freeradius-users-bounces+simpot=simpot.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 01 Sep 2014 16:01 To: FreeRadius users mailing list Subject: Re: There is no "Calling-Station-Id" attribute in access-requests sent in response to radius challenge from pam_radius-1.3.17-2.el6.x86_64 (CentOS release 6.5) Dmitry Saratsky wrote:
So it looks like all works according to RFC and I have low chances that "Calling-Station-Id" will be added to 2nd request by developers(((
Why would you say that? You're just assuming the worst. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi, With some help from other members of this mailing list in private message it was suggested a patch. Fix on github: https://github.com/FreeRADIUS/pam_radius/issues/13 BR, Dmitry. -----Original Message----- From: freeradius-users-bounces+simpot=simpot.com@lists.freeradius.org [mailto:freeradius-users-bounces+simpot=simpot.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 01 Sep 2014 16:01 To: FreeRadius users mailing list Subject: Re: There is no "Calling-Station-Id" attribute in access-requests sent in response to radius challenge from pam_radius-1.3.17-2.el6.x86_64 (CentOS release 6.5) Dmitry Saratsky wrote:
So it looks like all works according to RFC and I have low chances that "Calling-Station-Id" will be added to 2nd request by developers(((
Why would you say that? You're just assuming the worst. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (4)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Axel Luttgens -
Dmitry Saratsky