Freeradius with google authenticator gives error - No "known good" password found for the use
Hi, I am new to freeradius and after going through docs and user faq I was not able to solve this issue after multiple checks in my config. freeradius version is 3.0.13 I am using Linux ( from Amazon AWS HVM2 64 bit ) and using the EC2 box My VPC CIDR range (or client machines are ) : 10.0.0.0/16 I used the scripts below to install yum install -y freeradius freeradius-utils google-authenticator sssd httpd sed -i.bak -e 's/user = radiusd/user = root/' -e 's/group = radiusd/group = root/' /etc/raddb/radiusd.conf sed -i.bak -e "s/^#\tpam/\tpam/" /etc/raddb/sites-available/default yum install https:// dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm -y yum install google-authenticator -y Configurations made were as following I have modified /etc/raddb/clients.config to accept ip ranges from my CIDR client vpc_clients { ipaddr = 10.0.0.0/16 secret = testing12345 } Enabled PAM in file/etc/sites-available/default by removing the '#' pam comment Enabled PAM as default authentication type in /etc/raddb/users by removing comment on DEFAULT Group and adding DEFAULT Auth-Type := PAM line DEFAULT Group == "disabled", Auth-Type := Reject Reply-Message = "Your account has been disabled." DEFAULT Auth-Type := PAM Also changed the /etc/pam.d/radiusd for PAM integration auth requisite pam_google_authenticator.so account required pam_permit.so session required pam_permit.so Enabled PAM module ln -s /etc/raddb/mods-available/pam /etc/raddb/mods-enabled/pam The test was ok (Accept-request) when a local user like 'bob' was added to raduser file without PAM. So as next step I added testuser for google-autheticator as below sudo useradd -g radius-users testuser sudo -u testuser google-authenticator I tried the command radtest testuser <PIN from googleauthenticator> 10.0.24.144:1812 10 testing12345 I get following error No "known good" password found for the use. I rechecked the configs and authenticator PAM is enabled but the failure happens earlier. Please let me know how I could move ahead or where I should check next ? Debug Message : 2) Received Access-Request Id 4 from 10.0.24.144:60632 to 10.0.0.209:1812 length 72 (2) NAS-IP-Address = 10.0.24.144 (2) User-Name = "testuser" (2) User-Password = "81625808" (2) Message-Authenticator = 0xa15c37032939718e521cb83a03b31e74 (2) # Executing section authorize from file /etc/raddb/sites-enabled/default (2) authorize { (2) policy filter_username { (2) if (&User-Name) { (2) if (&User-Name) -> TRUE (2) if (&User-Name) { (2) if (&User-Name =~ / /) { (2) if (&User-Name =~ / /) -> FALSE (2) if (&User-Name =~ /@[^@]*@/ ) { (2) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (2) if (&User-Name =~ /\.\./ ) { (2) if (&User-Name =~ /\.\./ ) -> FALSE (2) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (2) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (2) if (&User-Name =~ /\.$/) { (2) if (&User-Name =~ /\.$/) -> FALSE (2) if (&User-Name =~ /@\./) { (2) if (&User-Name =~ /@\./) -> FALSE (2) } # if (&User-Name) = notfound (2) } # policy filter_username = notfound (2) [preprocess] = ok (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) suffix: Checking for suffix after "@" (2) suffix: No '@' in User-Name = "testuser", looking up realm NULL (2) suffix: No such realm "NULL" (2) [suffix] = noop (2) eap: No EAP-Message, not doing EAP (2) [eap] = noop (2) [files] = noop (2) [expiration] = noop (2) [logintime] = noop (2) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (2) pap: WARNING: Authentication will fail unless a "known good" password is available (2) [pap] = noop (2) } # authorize = ok (2) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (2) Failed to authenticate the user (2) Using Post-Auth-Type Reject (2) # Executing group from file /etc/raddb/sites-enabled/default (2) Post-Auth-Type REJECT { (2) attr_filter.access_reject: EXPAND %{User-Name} (2) attr_filter.access_reject: --> testuser (2) attr_filter.access_reject: Matched entry DEFAULT at line 11 (2) [attr_filter.access_reject] = updated (2) [eap] = noop (2) policy remove_reply_message_if_eap { (2) if (&reply:EAP-Message && &reply:Reply-Message) { (2) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (2) else { (2) [noop] = noop (2) } # else = noop (2) } # policy remove_reply_message_if_eap = noop (2) } # Post-Auth-Type REJECT = updated (2) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (2) Sending delayed response (2) Sent Access-Reject Id 4 from 10.0.0.209:1812 to 10.0.24.144:60632 length 20 Waking up in 3.9 seconds. (2) Cleaning up request packet ID 4 with timestamp +84 Ready to process requests (3) Received Access-Request Id 5 from 10.0.24.144:51706 to 10.0.0.209:1812 length 72 (3) NAS-IP-Address = 10.0.24.144 (3) User-Name = "testuser" (3) User-Password = "81625808" (3) Message-Authenticator = 0x315376d568418fcf0cbbd174d5c7826f (3) # Executing section authorize from file /etc/raddb/sites-enabled/default (3) authorize { (3) policy filter_username { (3) if (&User-Name) { (3) if (&User-Name) -> TRUE (3) if (&User-Name) { (3) if (&User-Name =~ / /) { (3) if (&User-Name =~ / /) -> FALSE (3) if (&User-Name =~ /@[^@]*@/ ) { (3) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (3) if (&User-Name =~ /\.\./ ) { (3) if (&User-Name =~ /\.\./ ) -> FALSE (3) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (3) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (3) if (&User-Name =~ /\.$/) { (3) if (&User-Name =~ /\.$/) -> FALSE (3) if (&User-Name =~ /@\./) { (3) if (&User-Name =~ /@\./) -> FALSE (3) } # if (&User-Name) = notfound (3) } # policy filter_username = notfound (3) [preprocess] = ok (3) [chap] = noop (3) [mschap] = noop (3) [digest] = noop (3) suffix: Checking for suffix after "@" (3) suffix: No '@' in User-Name = "testuser", looking up realm NULL (3) suffix: No such realm "NULL" (3) [suffix] = noop (3) eap: No EAP-Message, not doing EAP (3) [eap] = noop (3) [files] = noop (3) [expiration] = noop (3) [logintime] = noop (3) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (3) pap: WARNING: Authentication will fail unless a "known good" password is available (3) [pap] = noop (3) } # authorize = ok (3) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (3) Failed to authenticate the user (3) Using Post-Auth-Type Reject (3) # Executing group from file /etc/raddb/sites-enabled/default (3) Post-Auth-Type REJECT { (3) attr_filter.access_reject: EXPAND %{User-Name} (3) attr_filter.access_reject: --> testuser (3) attr_filter.access_reject: Matched entry DEFAULT at line 11 (3) [attr_filter.access_reject] = updated (3) [eap] = noop (3) policy remove_reply_message_if_eap { (3) if (&reply:EAP-Message && &reply:Reply-Message) { (3) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (3) else { (3) [noop] = noop (3) } # else = noop (3) } # policy remove_reply_message_if_eap = noop (3) } # Post-Auth-Type REJECT = updated (3) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (3) Sending delayed response (3) Sent Access-Reject Id 5 from 10.0.0.209:1812 to 10.0.24.144:51706 length 20 Waking up in 3.9 seconds. (3) Cleaning up request packet ID 5 with timestamp +553 Ready to process requests
On Mar 9, 2020, at 5:40 PM, prasanna <prasanna.tuladhar@gmail.com> wrote:
I am new to freeradius and after going through docs and user faq I was not able to solve this issue after multiple checks in my config.
freeradius version is 3.0.13 I am using Linux ( from Amazon AWS HVM2 64 bit ) and using the EC2 box My VPC CIDR range (or client machines are ) : 10.0.0.0/16
I used the scripts below to install
That information isn't necessary. We only need the debug output. *All* of the documentation makes this clear.
Enabled PAM in file/etc/sites-available/default by removing the '#' pam comment
Enabled PAM as default authentication type in /etc/raddb/users by removing comment on DEFAULT Group and adding DEFAULT Auth-Type := PAM line
DEFAULT Group == "disabled", Auth-Type := Reject Reply-Message = "Your account has been disabled."
DEFAULT Auth-Type := PAM
Ok... *where* in the file was this added? And are you sure that the server is reading that file? It's normally a symlink to mods-config/files/authorize. Maybe you changed the "users" file to a normal file, in which case FreeRADIUS isn't reading it.
... (2) [eap] = noop (2) [files] = noop
So nothing in the "users" file matched. Make sure that you're editing the right file, *and* that FreeRADIUS is reading it. Alan DeKok.
Thanks Alan,
DEFAULT Group == "disabled", Auth-Type := Reject Reply-Message = "Your account has been disabled."
DEFAULT Auth-Type := PAM
Ok... *where* in the file was this added?
This is in line 67-68 of /etc/raddb/users. I only appended DEFAULT Auth-Type := PAM in line 68 . The section "DEFAULT Group == "disabled", Auth-Type := Reject..." was only commented out but was already existing before. I seriously doubt if the file "/etc/raddb/users"is being read by freeradius. I might have converted it to normal file. I do not see symlink when issuing ls-al command
ls -al /etc/raddb/users -rw-r----- 1 root radiusd 7127 Mar 9 20:37 /etc/raddb/users how can I check this or convert into user file ? On Tue, Mar 10, 2020 at 3:21 PM Alan DeKok <aland@deployingradius.com> wrote:
On Mar 9, 2020, at 5:40 PM, prasanna <prasanna.tuladhar@gmail.com> wrote:
I am new to freeradius and after going through docs and user faq I was not able to solve this issue after multiple checks in my config.
freeradius version is 3.0.13 I am using Linux ( from Amazon AWS HVM2 64 bit ) and using the EC2 box My VPC CIDR range (or client machines are ) : 10.0.0.0/16
I used the scripts below to install
That information isn't necessary. We only need the debug output. *All* of the documentation makes this clear.
Enabled PAM in file/etc/sites-available/default by removing the '#' pam comment
Enabled PAM as default authentication type in /etc/raddb/users by removing comment on DEFAULT Group and adding DEFAULT Auth-Type := PAM line
DEFAULT Group == "disabled", Auth-Type := Reject Reply-Message = "Your account has been disabled."
DEFAULT Auth-Type := PAM
Ok... *where* in the file was this added?
And are you sure that the server is reading that file? It's normally a symlink to mods-config/files/authorize. Maybe you changed the "users" file to a normal file, in which case FreeRADIUS isn't reading it.
... (2) [eap] = noop (2) [files] = noop
So nothing in the "users" file matched.
Make sure that you're editing the right file, *and* that FreeRADIUS is reading it.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Thanks for your hint. I solved this and PAM authenticator was working. The soft-link was destroyed since I was using sed editor to append lines. After I recreated symlink everything worked smoothly ln -s /etc/raddb/users ./mods-config/files/authorize On Tue, Mar 10, 2020 at 5:23 PM prasanna <prasanna.tuladhar@gmail.com> wrote:
Thanks Alan,
DEFAULT Group == "disabled", Auth-Type := Reject Reply-Message = "Your account has been disabled."
DEFAULT Auth-Type := PAM
Ok... *where* in the file was this added?
This is in line 67-68 of /etc/raddb/users. I only appended DEFAULT Auth-Type := PAM in line 68 . The section "DEFAULT Group == "disabled", Auth-Type := Reject..." was only commented out but was already existing before. I seriously doubt if the file "/etc/raddb/users"is being read by freeradius. I might have converted it to normal file. I do not see symlink when issuing ls-al command
ls -al /etc/raddb/users -rw-r----- 1 root radiusd 7127 Mar 9 20:37 /etc/raddb/users
how can I check this or convert into user file ?
On Tue, Mar 10, 2020 at 3:21 PM Alan DeKok <aland@deployingradius.com> wrote:
On Mar 9, 2020, at 5:40 PM, prasanna <prasanna.tuladhar@gmail.com> wrote:
I am new to freeradius and after going through docs and user faq I was not able to solve this issue after multiple checks in my config.
freeradius version is 3.0.13 I am using Linux ( from Amazon AWS HVM2 64 bit ) and using the EC2 box My VPC CIDR range (or client machines are ) : 10.0.0.0/16
I used the scripts below to install
That information isn't necessary. We only need the debug output. *All* of the documentation makes this clear.
Enabled PAM in file/etc/sites-available/default by removing the '#' pam comment
Enabled PAM as default authentication type in /etc/raddb/users by removing comment on DEFAULT Group and adding DEFAULT Auth-Type := PAM line
DEFAULT Group == "disabled", Auth-Type := Reject Reply-Message = "Your account has been disabled."
DEFAULT Auth-Type := PAM
Ok... *where* in the file was this added?
And are you sure that the server is reading that file? It's normally a symlink to mods-config/files/authorize. Maybe you changed the "users" file to a normal file, in which case FreeRADIUS isn't reading it.
... (2) [eap] = noop (2) [files] = noop
So nothing in the "users" file matched.
Make sure that you're editing the right file, *and* that FreeRADIUS is reading it.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Alan DeKok -
prasanna