Pfsense FreeRadius3 multiotp

shoolin.s

Hi All,

New to the community here.. excited to be a part of it! So I got multiotp up and working with free radius, as per the topic above. However whenever I try to authenticate using free radius I get error code 98 "98 ERROR: Authentication failed (wrong token length) " but however when I just do the auth directly

./multiotp user <authcode><pin> it works just fine and authenticates.

Any idea what could be going wrong. Any help would be greatly appreciated.

ps this is all being done to get radius gauth working with ikev2 ipsec.

Alitai

I've only just seen it.

I have edited the post again in the other thread.

-Did you put the line for "freeradius.inc" in the right place (Restart)?
-The string "5dc0424b2e7922f3472a0f8429a80b12" is not allowed to contain certain characters.

Have you "ntlm_auth" in 1 line?:
freeradius.inc -> /usr/local/pkg/ add (After "with_ntdomain_hack = yes") -> ntlm_auth = "/usr/local/bin/multiotp/multiotp.php %{User-Name} %{User-Password} -request-nt-key -src=%{Packet-Src-IP-Address} -chap-challenge=%{CHAP-Challenge} -chap-password=%{CHAP-Password} -ms-chap-challenge=%{MS-CHAP-Challenge} -ms-chap-response=%{MS-CHAP-Response} -ms-chap2-response=%{MS-CHAP2-Response}"

Greetings

shoolin.s

Hi @Alitai thanks for your response, yes so in freeradius.inc it is all in one line, this the is how it is setup as of now:

mschap {
#       use_mppe = no
#       require_encryption = yes
#       require_strong = yes
        with_ntdomain_hack = yes
        ntlm_auth = "/usr/local/bin/multiotp/multiotp.php %{User-Name} %{User-Password} -request-nt-key -src=%{Packet-Src-IP-Address} -chap-challenge=%{CHAP-Challenge} -chap-password=%{CHAP-Password} -ms-chap-challenge=%{MS-CHAP-Challenge} -ms-chap-response=%{MS-CHAP-Response} -ms-chap
2-response=%{MS-CHAP2-Response}"
#       ntlm_auth_timeout = 10
#       winbind_username = "%{mschap:User-Name}"
#       winbind_domain = "%{mschap:NT-Domain}"
#       winbind_retry_with_normalised_username = no
        pool {
                start = \${thread[pool].start_servers}
                min = \${thread[pool].min_spare_servers}
                max = \${thread[pool].max_servers}
                spare = \${thread[pool].max_spare_servers}
                uses = 0
                retry_delay = 30
                lifetime = 86400
                cleanup_interval = 300
                idle_timeout = 600
        }
        passchange {
#               ntlm_auth = "/usr/bin/ntlm_auth --helper-protocol=ntlm-change-password-1"
#               ntlm_auth_username = "username: %{mschap:User-Name}"
#               ntlm_auth_domain = "nt-domain: %{mschap:NT-Domain}"
#               local_cpw = "%{exec:/path/to/script %{mschap:User-Name} %{MS-CHAP-New-Cleartext-Password}}"
#               local_cpw = "%{sql:UPDATE radcheck set value='%{MS-CHAP-New-NT-Password}' where username='%{SQL-User-Name}' and attribute='NT-Password'}"
        }

#       use_open_directory = yes
#       allow_retry = yes
#       retry_msg = "Re-enter (or reset) the password"
}

still getting error code 98. could it be something to do with the config in the mods-enabled - multiotpmschap, as it was just the copy of original mschap and has quite a few options disabled?? This is how that is setup for me:

mschap multiotpmschap {
#       use_mppe = no
#       require_encryption = yes
#       require_strong = yes
        with_ntdomain_hack = yes
        ntlm_auth = "/usr/local/bin/multiotp/multiotp.php %{User-Name} %{User-Password} -request-nt-key -src=%{Packet-Src-IP-Address} -chap-challenge=%{CHAP-Challenge} -chap-password=%{CHAP-Password} -ms-chap-challenge=%{MS-CHAP-Challenge} -ms-chap-response=%{MS-CHAP-Response} -ms-chap
2-response=%{MS-CHAP2-Response}"
        ntlm_auth_timeout = 10
#       winbind_username = "%{mschap:User-Name}"
#       winbind_domain = "%{mschap:NT-Domain}"
#       winbind_retry_with_normalised_username = no
        pool {
                start = ${thread[pool].start_servers}
                min = ${thread[pool].min_spare_servers}
                max = ${thread[pool].max_servers}
                spare = ${thread[pool].max_spare_servers}
                uses = 0
                retry_delay = 30
                lifetime = 86400
                cleanup_interval = 300
                idle_timeout = 600
        }
        passchange {
#               ntlm_auth = "/usr/bin/ntlm_auth --helper-protocol=ntlm-change-password-1"
#               ntlm_auth_username = "username: %{mschap:User-Name}"
#               ntlm_auth_domain = "nt-domain: %{mschap:NT-Domain}"
#               local_cpw = "%{exec:/path/to/script %{mschap:User-Name} %{MS-CHAP-New-Cleartext-Password}}"
#               local_cpw = "%{sql:UPDATE radcheck set value='%{MS-CHAP-New-NT-Password}' where username='%{SQL-User-Name}' and attribute='NT-Password'}"
        }

#       use_open_directory = yes
#       allow_retry = yes
#       retry_msg = "Re-enter (or reset) the password"
}

Thanks for all your help!

Regards

Alitai

You don't need "mschap multiotpmschap".

Step 1:
multiotp.php first line is wrong (#!/usr/bin/php -> #!/usr/local/bin/php).
multiotp.php -> /usr/local/bin/multiotp/

Step 2:
chmod +x /usr/local/bin/multiotp/multiotp.php
Maybe change the Timezone:
./multiotp.php -config timezone=Europe/Zurich (Which is Standard)
./multiotp.php -create usernamehere tOTP 5dc0424b2e7922f3472a0f8429a80b12 1234 (this is a example)
You can create the string (5dc0424b2e7922f3472a0f8429a80b12) on your Pfsense
and you can just add the string (5dc0424b2e7922f3472a0f8429a80b12) in your app.

Step 3:
freeradius.inc -> /usr/local/pkg/ add (After "with_ntdomain_hack = yes") -> ntlm_auth = "/usr/local/bin/multiotp/multiotp.php %{User-Name} %{User-Password} -request-nt-key -src=%{Packet-Src-IP-Address} -chap-challenge=%{CHAP-Challenge} -chap-password=%{CHAP-Password} -ms-chap-challenge=%{MS-CHAP-Challenge} -ms-chap-response=%{MS-CHAP-Response} -ms-chap2-response=%{MS-CHAP2-Response}"

Step 4:
Restart

Step 5:
Try to connect again

Edit:
Error 98 = Authentication failed (wrong token length) -> 1234 + 6 digit Code form the app