diff options
Diffstat (limited to 'config')
| -rw-r--r-- | config/freeradius2/freeradius.inc | 205 |
1 files changed, 197 insertions, 8 deletions
diff --git a/config/freeradius2/freeradius.inc b/config/freeradius2/freeradius.inc index 83c8d4cd..51029711 100644 --- a/config/freeradius2/freeradius.inc +++ b/config/freeradius2/freeradius.inc @@ -378,6 +378,7 @@ EOD; freeradius_modulesmschap_resync(); freeradius_modulesrealm_resync(); freeradius_plainmacauth_resync(); + freeradius_motp_resync(); // This is to fix the mysqlclient.so which gets lost after reboot exec("ldconfig -m /usr/local/lib/mysql"); @@ -397,8 +398,14 @@ if (is_array($arrusers) && !empty($arrusers)) { foreach ($arrusers as $users) { // Variables for users file defined parameters + $varusersusername = $users['varusersusername']; $varuserspassword = $users['varuserspassword']; + + $varusersmotpinitsecret = $users['varusersmotpinitsecret']; + $varusersmotppin = $users['varusersmotppin']; + $varusersmotpoffset = ($users['varusersmotpoffset']?$users['varusersmotpoffset']:'0'); + $varuserssimultaneousconnect = ($users['varuserssimultaneousconnect']?$users['varuserssimultaneousconnect']:''); $varuserswisprredirectionurl = $users['varuserswisprredirectionurl']; $varusersframedipaddress = $users['varusersframedipaddress']; @@ -456,14 +463,22 @@ if (is_array($arrusers) && !empty($arrusers)) { $varuserscheckitem = ''; $varusersreplyitem = ''; - // If someone does not want to use username/password but entry "DEFAULT" instead then we can disable this - if (($users['varusersusername'] == '') && ($users['varuserspassword'] == '')) { - $varuserscheckitem = ''; - } - else { - // Add the user attributes to each user. - $varuserscheckitem = '"' . $varusersusername . '"' . " Cleartext-Password := " . '"' . $varuserspassword .'"'; - } + // check if mobile otp is disabled + if ($users['varusersmotpenable'] == '') { + // If someone does not want to use username/password but entry "DEFAULT" instead then we can disable this + if (($users['varusersusername'] == '') && ($users['varuserspassword'] == '')) { + $varuserscheckitem = ''; + } + else { + // Add the user attributes to each user. + $varuserscheckitem = '"' . $varusersusername . '"' . " Cleartext-Password := " . '"' . $varuserspassword .'"'; + } + } // end of check if otp is enabled + + // if otp is enabled we need to set Auth-Type to accept because password will be checked when the otp script gets executed in reply-item list + else { + $varuserscheckitem = '"' . $varusersusername . '"' . " Auth-Type = Accept"; + } // Add additional CHECK-ITEMS here. Different formatting in "users" file needed. if ($varuserssimultaneousconnect != '') { @@ -488,6 +503,14 @@ if (is_array($arrusers) && !empty($arrusers)) { $varuserscheckitem .= ", $varusersadditionaloptionscheckitems"; } + // this is the part for mobile otp + if ($users['varusersmotpenable'] == 'on') { + $varusersreplyitem .= 'Exec-Program-Wait = "/usr/local/bin/bash /usr/local/bin/otpverify.sh %{User-Name} %{User-Password} ' . "$varusersmotpinitsecret " . "$varusersmotppin " . "$varusersmotpoffset" . '"'; + } + else { + $varusersreplyitem .= ''; + } + // Add additional REPLY-ITEMS here. Different formatting in "users" file needed. if ($varusersframedipaddress != '') { if ($varusersreplyitem != '') { $varusersreplyitem .=","; } @@ -3824,4 +3847,170 @@ EOD; } +function freeradius_motp_resync() { + global $config; + $conf = ''; + + $varsettings = $config['installedpackages']['freeradiussettings']['config'][0]; + + // check if disabled then we delete bash und otpverify.sh script + if ($varsettings['varsettingsmotpenable'] == '') { + unlink("/usr/local/bin/otpverify.sh"); + exec("cd /var/db/pkg && pkg_delete `ls | grep bash`"); + log_error('FreeRADIUS: Uninstalling package "bash-4.1.7" which comes with Mobile-One-Time-Password (motp) if not already done.'); + } + + // check if enabled then we need to download "bash" + else { + if (exec("cd /var/db/pkg && ls | grep bash") != "bash-4.1.7") { + log_error('FreeRADIUS: Downloading and installing package "bash-4.1.7" to use Mobile-One-Time-Password (motp).'); + exec("pkg_add -r http://ftp-archive.freebsd.org/pub/FreeBSD-Archive/ports/`uname -m`/packages-8.1-release/All/bash-4.1.7.tbz"); + } + + $conf .= <<<EOD +#!/bin/bash +# +# Mobile One Time Passwords (Mobile-OTP) for Java 2 Micro Edition, J2ME +# written by Matthias Straub, Heilbronn, Germany, 2003 +# (c) 2003 by Matthias Straub +# Modified 2012 by Alexander Wilke <nachtfalkeaw@web.de> +# +# Version 1.05a +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU Library General Public +# License as published by the Free Software Foundation; either +# version 2 of the License, or (at your option) any later version. +# +# This software is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Library General Public License for more details. +# +# arguments: \$1 \$2 \$3 \$4 \$5 +# \$1 - username +# \$2 - one-time-password that is to be checked +# \$3 - init-secred from token (to init token: #**#) +# \$4 - user PIN +# \$5 - time difference between token and server in 10s of seconds (360 = 1 hour) +# +# one-time-password must match md5(EPOCHTIME+SECRET+PIN) +# +# +# otpverify.sh version 1.04b, Feb. 2003 +# otpverify.sh version 1.04c, Nov. 2008 +# changed line 1 to ksh because of problems with todays bash an sh +# otpverify.sh version 1.05a, Jan. 2011 +# changed back to bash and added in shopts line to ensure aliases handled +# correctly (bash is always available on any modern *nix unlike ksh) +# + +PATH=\$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin + + alias checksum=md5 + have_md5="true" + +# ensure aliases are expanded by bash +shopt -s expand_aliases + +if [ -e "`which md5 2>/dev/null`" ] +then + alias checksum=md5 + have_md5="true" +fi +if [ -e "`which md5sum 2>/dev/null`" ] +then + alias checksum=md5sum + have_md5="true" +fi + +if [ \$have_md5 != "true" ] +then + echo "No md5 or md5sum available on server!" + exit 16 +fi + +function chop +{ + num=`echo -n "\$1" | wc -c | sed 's/ //g' ` + nummin1=`expr \$num "-" 1` + echo -n "\$1" | cut -b 1-\$nummin1 +} + +if [ ! \$# -eq 5 ] ; then +echo "USAGE: otpverify.sh Username, OTP, Init-Secret, PIN, Offset" +logger -f /var/log/system.log "FreeRADIUS: Mobile-One-Time-Password - wrong syntax - USAGE: otpverify.sh Username, OTP, Init-Secret, PIN, Offset"; +exit 14 +fi + +mkdir /var/log/motp 2>/dev/null +mkdir /var/log/motp/cache 2>/dev/null +mkdir /var/log/motp/users 2>/dev/null +chmod og-rxw /var/log/motp 2>/dev/null || { echo "FAIL! Need write-access to /var/log/motp";logger -f /var/log/system.log "FreeRADIUS: Mobile-One-Time-Password - need write-access to /var/log/motp"; exit 17; } +chmod og-rxw /var/log/motp/cache +chmod og-rxw /var/log/motp/users + +USERNAME=`echo -n "\$1" | sed 's/[^0-9a-zA-Z._-]/X/g' ` +PASSWD=`echo -n "\$2" | sed 's/[^0-9a-f]/0/g' ` +SECRET=`echo -n "\$3" | sed 's/[^0-9a-f]/0/g' ` +PIN=`echo -n "\$4" | sed 's/[^0-9]/0/g' ` +OFFSET=`echo -n "\$5" | sed 's/[^0-9]/0/g' ` +EPOCHTIME=`date +%s` ; EPOCHTIME=`chop \$EPOCHTIME` + +# delete old logins +find /var/log/motp/cache -type f -cmin +5 | xargs rm 2>/dev/null + +if [ -e "/var/log/motp/cache/\$PASSWD" ]; then + echo "FAIL" + logger -f /var/log/system.log "FreeRADIUS: Authentication failed! Mobile-One-Time-Password incorrect or expired!" + exit 15 +fi + +# account locked? +if [ "`cat /var/log/motp/users/\$USERNAME 2>/dev/null`" == "8" ]; then + echo "FAIL" + logger -f /var/log/system.log "FreeRADIUS: Authentication failed! Mobile-One-Time-Password incorrect or expired!" + exit 13 +fi + +I=0 +EPOCHTIME=`expr \$EPOCHTIME - 18` +EPOCHTIME=`expr \$EPOCHTIME + \$OFFSET` +while [ \$I -lt 36 ] ; do # 3 minutes before and after + OTP=`printf \$EPOCHTIME\$SECRET\$PIN|checksum|cut -b 1-6` + if [ "\$OTP" = "\$PASSWD" ] ; then + touch /var/log/motp/cache/\$OTP || { echo "FAIL! Need write-access to /var/log/motp";logger -f /var/log/system.log "FreeRADIUS: Mobile-One-Time-Password - need write-access to /var/log/motp/cache"; exit 17; } + echo "ACCEPT" + logger -f /var/log/system.log "FreeRADIUS: Authentication success! Mobile-One-Time-Password is correct!" + rm "/var/log/motp/users/\$USERNAME" 2>/dev/null + exit 0 + fi + I=`expr \$I + 1` + EPOCHTIME=`expr \$EPOCHTIME + 1` +done + +echo "FAIL" +NUMFAILS=`cat "/var/log/motp/users/\$USERNAME" 2>/dev/null` +if [ "\$NUMFAILS" = "" ]; then + NUMFAILS=0 +fi +NUMFAILS=`expr \$NUMFAILS + 1` +echo \$NUMFAILS > "/var/log/motp/users/\$USERNAME" +logger -f /var/log/system.log "FreeRADIUS: Authentication failed! Mobile-One-Time-Password incorrect or expired!" +exit 11 + + +EOD; + + $filename = '/usr/local/bin/otpverify.sh'; + conf_mount_rw(); + file_put_contents($filename, $conf); + chmod($filename, 0775); + conf_mount_ro(); + + // end of above 'check if enabled then we need to download "bash"' + } + +} + ?>
\ No newline at end of file |