Apache2 auth_radius and OTP not working consistently
Jonathan Davis
jonathan at prioritycolo.com
Wed Oct 6 14:48:34 CEST 2021
You can't use Yubikey OTPs twice
> On Oct 6, 2021, at 8:25 AM, Steven Vacaroaia <stef97 at gmail.com> wrote:
>
> Hi,
>
> Thanks for taking the time to provide some guidance
>
> I was talking about the comments here
> https://github.com/FreeRADIUS/mod_auth_radius
>
> In the example I provided I tried to follow OTP workaround provided by you
> in the mod_auth_radius
>
> The password mismatch issue seems to be related to Yubikey module
> complaining about REPLAYED_OTP ( I am using same password/username/key as
> few seconds ago when it worked)
>
> many thanks
> Steven
>
>> On Wed, 6 Oct 2021 at 06:00, <freeradius-users-request at lists.freeradius.org>
>> wrote:
>>
>> Send Freeradius-Users mailing list submissions to
>> freeradius-users at lists.freeradius.org
>>
>> To subscribe or unsubscribe via the World Wide Web, visit
>> http://lists.freeradius.org/mailman/listinfo/freeradius-users
>> or, via email, send a message with subject or body 'help' to
>> freeradius-users-request at lists.freeradius.org
>>
>> You can reach the person managing the list at
>> freeradius-users-owner at lists.freeradius.org
>>
>> When replying, please edit your Subject line so it is more specific
>> than "Re: Contents of Freeradius-Users digest..."
>>
>>
>> Today's Topics:
>>
>> 1. Re: Authenticator -to- RADIUS connection (Alan DeKok)
>> 2. Apache2 auth_radius and OTP not working consistently
>> (Steven Vacaroaia)
>> 3. Re: Apache2 auth_radius and OTP not working consistently
>> (Alan DeKok)
>> 4. Re: Apache2 auth_radius and OTP not working consistently
>> (Alan DeKok)
>>
>>
>> ----------------------------------------------------------------------
>>
>> Message: 1
>> Date: Tue, 5 Oct 2021 13:49:29 -0400
>> From: Alan DeKok <aland at deployingradius.com>
>> To: FreeRadius users mailing list
>> <freeradius-users at lists.freeradius.org>
>> Subject: Re: Authenticator -to- RADIUS connection
>> Message-ID: <3FDAEFEE-1B4C-4F5D-87F1-FD5BC28B82EF at deployingradius.com>
>> Content-Type: text/plain; charset=utf-8
>>
>>> On Oct 5, 2021, at 1:00 PM, Turner, Randy <Randy.Turner at landisgyr.com>
>>> wrote:
>>> We are using a package called “hostapd” to talk to FreeRADIUS – in some
>> of the hostapd documentation they refer to hostapd as an 802.1x
>> “authenticator”
>>
>> Yes. 802.1X != RADIUS. They use different terminology, because they
>> are different protocols, and do different (but related) things.
>>
>> And why not just say from the start that you're using hostap? It's
>> *always* better to be precise. Especially if you're not familiar with the
>> technology.
>>
>>> This was the term I used in my original question which may have readers
>> thinking I meant the actual device that was trying to access the network.
>>
>> I didn't know what you meant. Because as soon as someone uses the wrong
>> terminology, all bets are off.
>>
>>> In FreeRADIUS parlance, I think hostapd is called a NAS – it’s the
>> NAS-to-FreeRADIUS connection I was referring to.
>>
>> This is not "FreeRADIUS parlance". The term "NAS" goes back to at
>> least 1993, and the first RADIUS standards. A little bit of reading on the
>> basic terminology would help.
>>
>> So you're still confused about which things are involved, and what they
>> do. I'm still not sure what you're asking.
>>
>> The "NAS to FreeRADIUS" connection uses RADIUS. You can't use any other
>> protocol there.
>>
>> The "end user to hostap" connection uses 802.1X, which includes EAP.
>> The EAP packets are then placed inside of RADIUS by the NAS, sent to
>> FreeRADIUS.
>>
>> EAP can carry many different kinds of authentication. EAP-TLS,
>> EAP-TTLS, etc.
>>
>> All of this information is available on the net (including Wikipedia) if
>> you go look.
>>
>> What is frustrating here is not just using the wrong terminology, it's
>> also metering out of additional information all through the conversation.
>> It would have been very simple to say "I have a computer using WiFi, I have
>> hostap, and I want to authenticate the user device via FreeRADIUS". That
>> would have given us *useful* information.
>>
>> Instead, it's a vague question using incorrect terms, followed by "Oh
>> yeah, I'm using this, too". This is frustrating.
>>
>> Spend an hour or so reading the Wikipedia pages on RADIUS and EAP. That
>> should clarify a lot of issues. And PLEASE give useful information in
>> messages. That helps enormously.
>>
>> Alan DeKok.
>>
>>
>>
>>
>> ------------------------------
>>
>> Message: 2
>> Date: Tue, 5 Oct 2021 16:55:40 -0400
>> From: Steven Vacaroaia <stef97 at gmail.com>
>> To: freeradius-users at lists.freeradius.org
>> Subject: Apache2 auth_radius and OTP not working consistently
>> Message-ID:
>> <
>> CAJ4cwkN8acKC6p-ZAUHR1N2r_Jvs9SDudd5MkS+juk2_qtcdYQ at mail.gmail.com>
>> Content-Type: text/plain; charset="UTF-8"
>>
>> Hi,
>>
>> I am trying to get freeradius + AD + Yubikey as authentication mechanism
>> for some of our websites
>>
>> It is working on and off which makes it very difficult to troubleshoot
>>
>> I noticed some notes / comments in the module but apparently I am not able
>> to implement them properly although they seem pretty clear
>>
>> It will be greatly appreciated if you can point me to what am I doing wrong
>>
>> Example
>> folder protected
>> /var/www/html/test/user
>> file needed to be used
>> /var/www/html/test/user/index.php
>> I put another file named index.html containing a link to index.php in the
>> above folder
>>
>> I can connect to it after authenticate but , when I am using the link I
>> created to index.php, I am asked again to authenticate which fails with
>> "password mismatched" error
>>
>> I know I must be missing something really simple and I apologize for
>> wasting your time with this but I am a bit desperate to get it working
>>
>> Thanks
>> Steven
>>
>>
>> ------------------------------
>>
>> Message: 3
>> Date: Tue, 5 Oct 2021 16:59:18 -0400
>> From: Alan DeKok <aland at deployingradius.com>
>> To: FreeRadius users mailing list
>> <freeradius-users at lists.freeradius.org>
>> Subject: Re: Apache2 auth_radius and OTP not working consistently
>> Message-ID: <19B2E21E-CFEE-407E-A601-D4868B5E0765 at deployingradius.com>
>> Content-Type: text/plain; charset=us-ascii
>>
>>> On Oct 5, 2021, at 4:55 PM, Steven Vacaroaia <stef97 at gmail.com> wrote:
>>> I am trying to get freeradius + AD + Yubikey as authentication mechanism
>>> for some of our websites
>>>
>>> It is working on and off which makes it very difficult to troubleshoot
>>
>> it's best to test these things with "radclient". That way you test the
>> RADIUS / AD / Yubikey portion separately from the web site.
>>
>> TBH, most web server integration with RADIUS is pretty poor.
>>
>>> I noticed some notes / comments in the module but apparently I am not
>> able
>>> to implement them properly although they seem pretty clear
>>
>> Which module?
>>
>>> It will be greatly appreciated if you can point me to what am I doing
>> wrong
>>>
>>> Example
>>> folder protected
>>> /var/www/html/test/user
>>> file needed to be used
>>> /var/www/html/test/user/index.php
>>> I put another file named index.html containing a link to index.php in the
>>> above folder
>>
>> That has nothing to do with FreeRADIUS. We don't ship a web server, so
>> I have no idea how to fix anything here.
>>
>>> I can connect to it after authenticate but , when I am using the link I
>>> created to index.php, I am asked again to authenticate which fails with
>>> "password mismatched" error
>>>
>>> I know I must be missing something really simple and I apologize for
>>> wasting your time with this but I am a bit desperate to get it working
>>
>> Which were server are you using?
>>
>> Whatever web server it is, you need to consult its documentation for how
>> to configure RADIUS authentication.
>>
>> Once FreeRADIUS gets a packet, we can help you. Until then, it's all
>> web server magic that we know very little about.
>>
>> Alan DeKok.
>>
>>
>>
>>
>> ------------------------------
>>
>> Message: 4
>> Date: Tue, 5 Oct 2021 17:01:05 -0400
>> From: Alan DeKok <aland at deployingradius.com>
>> To: FreeRadius users mailing list
>> <freeradius-users at lists.freeradius.org>
>> Subject: Re: Apache2 auth_radius and OTP not working consistently
>> Message-ID: <19201DA5-F29D-45BF-8A59-A7560E7DDD9E at deployingradius.com>
>> Content-Type: text/plain; charset=us-ascii
>>
>> Sorry... I missed the part about "Apache2", it's been a long day.
>>
>> If you're getting a "password mismatched" error, then run FR in debug
>> mode to see what it returns. Check if the passwords are correct, that the
>> shared secrets are correct, etc.
>>
>> I'd say "run Apache in debug mode", but it's debug mode is essentially
>> useless.
>>
>> Alan DeKok.
>>
>>
>>
>>
>> ------------------------------
>>
>> Subject: Digest Footer
>>
>> -
>> List info/subscribe/unsubscribe? See
>> http://www.freeradius.org/list/users.html
>>
>> ------------------------------
>>
>> End of Freeradius-Users Digest, Vol 198, Issue 14
>> *************************************************
>>
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
More information about the Freeradius-Users
mailing list