RE: DEFAULT access-reject Reply-Message

permalink · #1 (**permalink**) 12-01-2006

This is a multi-part message in MIME format.

--===============1396201157==
Content-class: urn:content-classes:message
Content-Type: multipart/alternative;
boundary="----_=_NextPart_001_01C7155E.E8FCC9AC"

This is a multi-part message in MIME format.

------_=_NextPart_001_01C7155E.E8FCC9AC
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

> How can I add default Reply-Message to the situation where
Access-Reject was sent because of incorrect password?

> I looked at the user's file but it seams that I have no way to
determine if access-accept or reject was sent... it only has example how
to send the message to a reject > group.=20

=20

If you're using LDAP, it already creates a Module-Failure-Message
request attribute upon failure. Also, I submitted bug 398 which Alan
incorporated into CVS head to provide the same functionality for MS-CHAP
(I assume this will be in FR 1.1.4). You could execute a Perl script in
a reject section of post_auth that looks for this request attribute and,
if found, set the Reply-Message reply attribute. If you're using a
different authentication method, it may be possible to change the code
to accomplish what you want. As someone else pointed out, it's not a
good idea to tell someone they entered the wrong password as it makes
brute-force password attacks easier (because you're telling them the
userid is valid). I believe ntlm_auth gives a generic (invalid userid
or password) response to a bad password. If the response you see is too
specific, you may want to obfuscate it..

=20

Here's an example of what you would put in radiusd.conf (this assumes
you have a sub in your perl script called post_auth_reject):

=20

modules {=20

..

..

..

perl set_reject_message {

module =3D /usr/local/etc/raddb/set_reject_message.pl

func_post_auth =3D post_auth_reject

}

..

..

..

}

..

..

..

post-auth {

Post-Auth-Type REJECT {

set_reject_message

}

}

------_=_NextPart_001_01C7155E.E8FCC9AC
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" =
xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns=3D"http://www.w3.org/TR/REC-html40">

<head>
<meta http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii">
<meta name=3DGenerator content=3D"Microsoft Word 11 (filtered medium)">
<style>

</style>

</head>

<body lang=3DEN-US link=3Dblue vlink=3Dpurple>

<div class=3DSection1>

> How can =
I add
default Reply-Message to the situation where Access-Reject was sent =
because of
incorrect password?<o:p></o:p>

> I looked =
at the
user’s file but it seams that I have no way to determine if =
access-accept
or reject was sent… it only has example how to send the message to =
a
reject > =
group. <o:p></o:p>

<o:p> </o:p>

If you’re using LDAP, it =
already creates
a Module-Failure-Message request attribute upon failure.  Also, I
submitted bug 398 which Alan incorporated into CVS head to provide the =
same
functionality for MS-CHAP (I assume this will be in FR 1.1.4).  You =
could
execute a Perl script in a reject section of post_auth that looks for =
this
request attribute and, if found, set the Reply-Message reply =
attribute. 
If you’re using a different authentication method, it may be =
possible to
change the code to accomplish what you want.  As someone else =
pointed out,
it’s not a good idea to tell someone they entered the wrong =
password as
it makes brute-force password attacks easier (because you’re =
telling them
the userid is valid).  I believe ntlm_auth gives a generic (invalid =
userid
or password) response to a bad password.  If the response you see =
is too
specific, you may want to obfuscate it..<o:p></o:p>

<o:p> </o:p>

Here’s an example of what you =
would
put in radiusd.conf (this assumes you have a sub in your perl script =
called
post_auth_reject):<o:p></o:p>

<o:p> </o:p>

modules { =
<o:p></o:p>

.<o:p></o:p>

.<o:p></o:p>

.<o:p></o:p>

   perl =
set_reject_message {<o:p></o:p>

   =
       modul e
=3D =
/usr/local/etc/raddb/set_reject_message.pl<o:p></o:p>

   =
       func_pos t_auth
=3D post_auth_reject<o:p></o:p>

   =
}<o:p></o:p>

.<o:p></o:p>

.<o:p></o:p>

.<o:p></o:p>

}<o:p></o:p>

.<o:p></o:p>

.<o:p></o:p>

.<o:p></o:p>

post-auth =
{<o:p></o:p>

    & nbsp; =
 
Post-Auth-Type REJECT {<o:p></o:p>

    & nbsp; =
    
set_reject_message<o:p></o:p>

    & nbsp; =
 
}<o:p></o:p>

}<o:p></o:p>

</div>

</body>

</html>

------_=_NextPart_001_01C7155E.E8FCC9AC--

--===============1396201157==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
--===============1396201157==--

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode