FreeRADIUS3 - ERROR: Failed parsing output from exec, expecting operator

Question

FreeRADIUS 3 for OTP authentication, authentication succeeds, however FreeRADIUS fails to parse the response.

Sending the test command and monitoring the debug output (radiusd -X), there is an error as shown below, where the output is not parsed even though the response from the external program appears to be satisfactory:

# below, totp.py generates a TOTP for johnboy, to aid testing
# using pyotp package to make testing easier...

radtest -t mschap johnboy $(./totp.py) localhost 0 testing123

.
.
.
(4) eap: No EAP-Message, not doing EAP
(4)     [eap] = noop
(4)     [expiration] = noop
(4)     [logintime] = noop
(4) multiotp: Executing: /usr/local/bin/multiotp.php '%{User-Name}' '%{User-Password}' -request-nt-key -src=%{Packet-Src-IP-Address} -chap-challenge=%{CHAP-Challenge} -chap-password=%{CHAP-Password} -ms-chap-challenge=%{MS-CHAP-Challenge} -ms-chap-response=%{MS-CHAP-Response} -ms-chap2-response=%{MS-CHAP2-Response}:
(4) multiotp: EXPAND %{User-Name}
(4) multiotp:    --> johnboy
(4) multiotp: EXPAND %{User-Password}
(4) multiotp:    --> 
(4) multiotp: EXPAND -src=%{Packet-Src-IP-Address}
(4) multiotp:    --> -src=127.0.0.1
(4) multiotp: EXPAND -chap-challenge=%{CHAP-Challenge}
(4) multiotp:    --> -chap-challenge=
(4) multiotp: EXPAND -chap-password=%{CHAP-Password}
(4) multiotp:    --> -chap-password=
(4) multiotp: EXPAND -ms-chap-challenge=%{MS-CHAP-Challenge}
(4) multiotp:    --> -ms-chap-challenge=0xf54c102e95a800d8
(4) multiotp: EXPAND -ms-chap-response=%{MS-CHAP-Response}
(4) multiotp:    --> -ms-chap-response=0x0001000000000000000000000000000000000000000000000000e3004419ce4b084c0b073836fd40f3828fcc7c4223b0dcc5
(4) multiotp: EXPAND -ms-chap2-response=%{MS-CHAP2-Response}
(4) multiotp:    --> -ms-chap2-response=
(4) multiotp: ERROR: Failed parsing output from: /usr/local/bin/multiotp.php '%{User-Name}' '%{User-Password}' -request-nt-key -src=%{Packet-Src-IP-Address} -chap-challenge=%{CHAP-Challenge} -chap-password=%{CHAP-Password} -ms-chap-challenge=%{MS-CHAP-Challenge} -ms-chap-response=%{MS-CHAP-Response} -ms-chap2-response=%{MS-CHAP2-Response}: Expecting opera
tor
(4) multiotp: ERROR: Program returned code (0) and output 'Filter-Id += "<user_group>",NT_KEY: A7C014D1209A4078F1003810BDB08BE6  '
(4)     [multiotp] = fail
(4)   } # authorize = fail
(4) Using Post-Auth-Type Reject
(4) # Executing group from file /etc/raddb/sites-enabled/default
(4)   Post-Auth-Type REJECT {
.
.
.

Answer 1

From the FreeRADIUS mailing list, the response from MultiOTP 'Filter-Id += "<user_group>",NT_KEY: A7C014D1209A4078F1003810BDB08BE6 ' is not valid for FreeRADIUS 3, but may well have worked with FreeRADIUS 2.

I worked around this problem by using a wrapper script to parse the output from [MultiOTP[(https://github.com/multiOTP/multiotp), returning only the part 'Filter-Id += "Erica-Users' for the 'authenticate' section's 'exec' step, and returning only the 'NT_KEY: A7C014D1209A4078F1003810BDB08BE6' part for the 'authorize' step's 'mschap' step within the FreeRADIUS auth process.

It is worth noting the documentation for FreeRADIUS 3 with MultiOTP in the MultiOTP README.md, and repeated on the FreeRADIUS Wiki, are not, at time of writing and it does not suggest file names which are actually used with FreeRADIUS 3.

The configuration steps for MultiOTP itself are accurate.

FreeRADIUS 3 has excellent documentation on-line here, and a polite and helpful mailing list.

For anyone grappling the same problem, here are some code snippets for a FreeRADIUS 3 configuration. I have not shown the virtual server configuration file, which may be more specific to an particular environment.

/usr/local/bin/multiotp_wrapper_mschap.sh:

#!/bin/bash

# Extract Filter-Id

user_name=$1
user_password=$2
packet_src_ip_address=$3
ms_chap_challange=$4
ms_chap_response=$5

/usr/local/bin/multiotp.php ${user_name} ${user_password} -request-nt-key -src=${packet_src_ip_address} -ms-chap-challenge=${ms_chap_challange} -ms-chap-response=${ms_chap_response} | sed -e 's/.*,//'

/usr/local/bin/multiotp_wrapper_exec.sh

#!/bin/bash

# Extract NT_KEY

user_name=$1
user_password=$2
packet_src_ip_address=$3
ms_chap_challange=$4
ms_chap_response=$5

/usr/local/bin/multiotp.php ${user_name} ${user_password} -request-nt-key -src=${packet_src_ip_address} -ms-chap-challenge=${ms_chap_challange} -ms-chap-response=${ms_chap_response} | sed -e 's/,NT_KEY.*$//'

/etc/raddb/mods-enabled/multiotp:

exec multiotp {  
  wait = yes
  input_pairs = request
  output_pairs = reply
  program = "/usr/local/bin/multiotp_wrapper_exec.sh '%{User-Name}' '%{User-Password}' %{Packet-Src-IP-Address} %{MS-CHAP-Challenge} %{MS-CHAP-Response}"
  shell_escape = yes
}

/etc/raddb/mods-enabled/multiotpmschap:

mschap multiotpmschap {
  # ntlm_auth = "/usr/local/bin/multiotp.php '%{User-Name}' '%{User-Password}' -request-nt-key -src=%{Packet-Src-IP-Address} -chap-challenge=%{CHAP-Challenge} -chap-password=%{CHAP-Password} -ms-chap-challenge=%{MS-CHAP-Challenge} -ms-chap-response=%{MS-CHAP-Response} -ms-chap2-response=%{MS-CHAP2-Response}"
  ntlm_auth = "/usr/local/bin/multiotp_wrapper_mschap.sh '%{User-Name}' '%{User-Password}' %{Packet-Src-IP-Address} %{MS-CHAP-Challenge} %{MS-CHAP-Response}"
  pool {
    start = ${thread[pool].start_servers}
    min = ${thread[pool].min_spare_servers}
    max = ${thread[pool].max_servers}
    spare = ${thread[pool].max_spare_servers}
    uses = 0
    retry_delay = 30
    lifetime = 86400
    cleanup_interval = 300
    idle_timeout = 600
  }
}

Answer 2

Just in case others got the "ERROR: Failed parsing output", please check the "display log" option in multiotp.ini, if it is enabled, it may also cause the issue.

refer: https://github.com/multiOTP/multiotp/issues/125