otp over radius preauthentication

[Frederic Van Espen]

On Sat, May 17, 2014 at 7:24 PM, Greg Hudson <ghudson at mit.edu> wrote:
> On 05/16/2014 02:51 AM, Frederic Van Espen wrote:
>> Of course! For the sake of completeness, I still cc'ed the list. I
>> attached a pcap trace of the packets that are exchanged.
>
> I discovered a fencepost error in our code which causes the KDC to time
> out after 2.5 seconds instead of five seconds.  But that's not your
> primary problem; something is causing the KDC to discard the RADIUS reply.
>
> Since the reply packet looks well-formed and has the same ID as the
> request, the obvious culprit is the response authenticator.  Per RFC
> 2865, this is supposed to be
> MD5(Code+ID+Length+RequestAuth+Attributes+Secret), or in the case of
> this packet trace:
>
>   MD5(02 4d 0014 f9b07553bdb3fcc249900650c0105cf2 <secret>)
>
> I don't have your RADIUS secret, so I can't verify that the response
> authenticator (bdc29c3024044ded5482d102f6628e4a) is correct.  If the
> checksum generated by FreeRADIUS is correct, then something else is
> wrong; if it is incorrect, then we need to figure out why.

I will gladly share the radius secret since it is only a lab setup: testing123

I tried to calculate the response authenticator myself but I'm not
sure if the secret is just concatenated plaintext, or if it are the
ascii hex values, or if there is some extra padding added.

> We do have automated tests which use the krb5 OTP RADIUS code against
> pyrad, so it seems odd that we would have an interoperability issue like
> this against FreeRADIUS.  I think if FreeRADIUS and krb5 were using
> different secrets, we would have trouble sooner (FreeRADIUS wouldn't be
> able to decrypt the password), so I'm not really sure what's going on.

I tried to modify my configuration to be more like the one in the
automated test, but now I'm getting segfaults in krb5kdc. The segfault
appears when I do 'setstr fes otp [{"type":yubikey}]'
When I reset it like: 'setstr fes otp [{}]', and change the otp type
back to DEFAULT in krb5.conf I don't see a segfault any more.

Here's the relevant part in krb5.conf:
[otp]
        yubikey = {
                server = 127.0.0.1:1812
                secret = /etc/krb5kdc/radius-secret
                strip_realm = true
        }

[plugins]
        kdcpreauth = {
                enable_only = otp
                enable_only = pkinit
        }

and the dmesg output:
May 18 12:45:13 obelix-clone kernel: [3374376.898313] krb5kdc[3175]:
segfault at fffffffffffffff0 ip 00007fc6ea041f70 sp 00007fffab558588
error 5 in libkrb5support.so.0.1[7fc6ea03b000+b000]

How can I enable core dumps so we can look at a backtrace?

I should mention that I'm using krb5 1.12.1 from the debian sid
distribution that I compiled myself on wheezy. I'm trying a manual
build from the downloaded source tree right now.

Thanks,

Frederic