Problem with mschap, ntlm_auth and a conditional syntax
Hello, I use ntlm_auth in mschapv2 (freeradius 20070409) by the following line in radiusd.conf: ntlm_auth = "/usr/local/eduroam/progs/ntlm/ntlm_auth.pl --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" A corresponding part of debug from radiusd -X is: rlm_mschap: Told to do MS-CHAPv2 for uzyszkodnik@latin.pcz.pl with NT-Password radius_xlat: '--username=uzyszkodnik' radius_xlat: Running registered xlat function of module mschap for string 'Challenge:-00' rlm_mschap: Unknown expansion string "Challenge:-00" radius_xlat: '--challenge=' radius_xlat: Running registered xlat function of module mschap for string 'NT-Response:-00' rlm_mschap: Unknown expansion string "NT-Response:-00" radius_xlat: '--nt-response=' Exec-Program output: Specify all required command line parameters! Exec-Program-Wait: plaintext: Specify all required command line parameters! Exec-Program: returned: 1 When I remove conditional syntax: ntlm_auth = "/usr/local/eduroam/progs/ntlm/ntlm_auth.pl --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response}" an athentication operates correctly: rlm_mschap: Told to do MS-CHAPv2 for uzyszkodnik@latin.pcz.pl with NT-Password radius_xlat: '--username=uzyszkodnik' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: ca radius_xlat: '--challenge=1d6796d06b4bab53' radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '--nt-response=69bbd30b6a06d6be5cc2fb88c658c1582da5a8a91ebcbee8' Exec-Program output: NT_KEY: 9d1f2ebc255b18c110a446e5de42389e NT_KEY: 9D1F2EBC255B18C110A446E5DE42389E Exec-Program-Wait: plaintext: NT_KEY: 9d1f2ebc255b18c110a446e5de42389e NT_KEY: 9D1F2EBC255B18C110A446E5DE42389E Exec-Program: returned: 0 I tested freeradius 1.1.4 with conditional syntax: ntlm_auth = "/usr/local/eduroam/progs/ntlm/ntlm_auth.pl --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" It's OK: rlm_mschap: Told to do MS-CHAPv2 for uzyszkodnik@latin.pcz.pl with NT-Password radius_xlat: '--username=uzyszkodnik' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: af radius_xlat: '--challenge=eebe17185aaa4366' radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '--nt-response=f668c0b7b4e32deeb49529c2f3295699561589836d73f474' Exec-Program output: NT_KEY: 9d1f2ebc255b18c110a446e5de42389e NT_KEY: 9D1F2EBC255B18C110A446E5DE42389E Exec-Program-Wait: plaintext: NT_KEY: 9d1f2ebc255b18c110a446e5de42389e NT_KEY: 9D1F2EBC255B18C110A446E5DE42389E Exec-Program: returned: 0 Lukasz Lacinski
Below is my previous e-mail, but with output from freeradius in format easier to read. I use ntlm_auth in mschapv2 (freeradius 20070409) by the following line in radiusd.conf: ntlm_auth = "/usr/local/eduroam/progs/ntlm/ntlm_auth.pl --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" A corresponding part of debug from radiusd -X is: rlm_mschap: Told to do MS-CHAPv2 for uzyszkodnik@latin.pcz.pl with NT-Password radius_xlat: '--username=uzyszkodnik' radius_xlat: Running registered xlat function of module mschap for string 'Challenge:-00' rlm_mschap: Unknown expansion string "Challenge:-00" radius_xlat: '--challenge=' radius_xlat: Running registered xlat function of module mschap for string 'NT-Response:-00' rlm_mschap: Unknown expansion string "NT-Response:-00" radius_xlat: '--nt-response=' Exec-Program output: Specify all required command line parameters! Exec-Program-Wait: plaintext: Specify all required command line parameters! Exec-Program: returned: 1 When I remove conditional syntax: ntlm_auth = "/usr/local/eduroam/progs/ntlm/ntlm_auth.pl --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response}" an athentication operates correctly: rlm_mschap: Told to do MS-CHAPv2 for uzyszkodnik@latin.pcz.pl with NT-Password radius_xlat: '--username=uzyszkodnik' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: ca radius_xlat: '--challenge=1d6796d06b4bab53' radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '--nt-response=69bbd30b6a06d6be5cc2fb88c658c1582da5a8a91ebcbee8' Exec-Program output: NT_KEY: 9d1f2ebc255b18c110a446e5de42389e NT_KEY: 9D1F2EBC255B18C110A446E5DE42389E Exec-Program-Wait: plaintext: NT_KEY: 9d1f2ebc255b18c110a446e5de42389e NT_KEY: 9D1F2EBC255B18C110A446E5DE42389E Exec-Program: returned: 0 I tested freeradius 1.1.4 with conditional syntax: ntlm_auth = "/usr/local/eduroam/progs/ntlm/ntlm_auth.pl --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" and here parameters with conditional syntax are interpreted correctly: rlm_mschap: Told to do MS-CHAPv2 for uzyszkodnik@latin.pcz.pl with NT-Password radius_xlat: '--username=uzyszkodnik' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: af radius_xlat: '--challenge=eebe17185aaa4366' radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '--nt-response=f668c0b7b4e32deeb49529c2f3295699561589836d73f474' Exec-Program output: NT_KEY: 9d1f2ebc255b18c110a446e5de42389e NT_KEY: 9D1F2EBC255B18C110A446E5DE42389E Exec-Program-Wait: plaintext: NT_KEY: 9d1f2ebc255b18c110a446e5de42389e NT_KEY: 9D1F2EBC255B18C110A446E5DE42389E Exec-Program: returned: 0 Lukasz Lacinski
Lukasz Lacinski wrote:
Below is my previous e-mail, but with output from freeradius in format easier to read.
I use ntlm_auth in mschapv2 (freeradius 20070409) by the following line in radiusd.conf: ntlm_auth = "/usr/local/eduroam/progs/ntlm/ntlm_auth.pl --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"
I've committed a fix to CVS head. Please re-test. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
Alan DeKok wrote:
I've committed a fix to CVS head. Please re-test.
OK. I'm going to test it as soon as possible. It means when SIGSEGV will not be so fast ;-) Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.0.0.2 port 1645, id=160, length=166 User-Name = "uzyszkodnik@latin.pcz.pl" Framed-MTU = 1400 Called-Station-Id = "0014.1bb6.da30" Calling-Station-Id = "0002.b306.4cf1" Service-Type = Login-User Message-Authenticator = 0x1b86f1e76d4be2fa3bb2c0c5daf968d6 EAP-Message = 0x0202001d01757a79737a6b6f646e696b406c6174696e2e70637a2e706c NAS-Port-Type = Wireless-802.11 NAS-Port = 863 NAS-Port-Id = "863" NAS-IP-Address = 10.0.0.2 NAS-Identifier = "ap" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 Program received signal SIGSEGV, Segmentation fault. 0xb7c13c26 in ?? () (gdb) where #0 0xb7c13c26 in ?? () #1 0x801228a0 in ?? () #2 0x00000000 in ?? () (gdb) Lukasz Lacinski
Lukasz Lacinski wrote:
Alan DeKok wrote:
I've committed a fix to CVS head. Please re-test.
OK. I'm going to test it as soon as possible. It means when SIGSEGV will not be so fast ;-)
Some of the data structures in the server have changed, which means you need to be sure that the server is using the *new* structures. i.e. remove all 2.0-pre0 modules && binaries before installing a new one. In order to get debugging symbols, see doc/bugs. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
participants (3)
-
Alan DeKok -
latin＠icis.pcz.pl -
Lukasz Lacinski