Hi Pete,
look at the radiusd.conf file, there is a sample line for ntml_auth.
"man ntml_auth" will give you details on the parameters.
regards,
St�phane
Hi!
Yes, that famous line! But I can't imagine that the configuration depends
all on that single line.
Here is my new state:
I have configured Samba to join the Windows domain. This is working (with
net rpc join..)
Then I launched nmbd and winbindd.
Winbind starts but gives the following errors:
Kinit failed: Malformed representation of principal
krb5_cc_get_principal failed (No credentials cache found)
kerberos_kinit_password host /SMF-210-1@ failed: Malformed representation of
principal
As I do not use Kerberos I think that those errors can be ignored.
wbinfo -g shows me the groups but wbinfo -u fails with "Error looking up
domain users".
When executing ntlm_auth --request-nt-key --domain=TESTDOMAIN
--username=pete --nt-response I am prompted for the password and then I get
NT_STATUS_OK: Success (0x0)
So ntlm_auth seems to work.
But even when checking the manual I can't figure out what hexadecimal string
I have to put for testing --challenge from the command line.
Back to freeradius.
In the Users file I added MS-CHAP-USE-NTLM-Auth = 1 but I cannot see in the
execution of ntlm_auth in the debug output. It should be logged at
"radius_xlat:" or not?
Here is the complete output that is generated:
rad_recv: Access-Request packet from host 192.168.33.44:1812, id=123,
length=108
NAS-IP-Address = 192.168.33.44
NAS-Port-Type = Async
User-Name = "pete"
Service-Type = Framed-User
Framed-MTU = 1500
Calling-Station-Id = "00-11-43-5c-77-d6"
EAP-Message = 0x0200000e0163736368776172747a
Message-Authenticator = 0x25f38b75fa3cb4abe24e239a027fee0c
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 0
modcall[authorize]: module "preprocess" returns ok for request 0
modcall[authorize]: module "chap" returns noop for request 0
modcall[authorize]: module "mschap" returns noop for request 0
rlm_realm: No '@' in User-Name = "pete", looking up realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 0
rlm_eap: EAP packet type response id 0 length 14
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 0
users: Matched entry DEFAULT at line 159
users: Matched entry DEFAULT at line 178
modcall[authorize]: module "files" returns ok for request 0
modcall: group authorize returns updated for request 0
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 0
rlm_eap: EAP Identity
rlm_eap: processing type md5
rlm_eap_md5: Issuing Challenge
modcall[authenticate]: module "eap" returns handled for request 0
modcall: group authenticate returns handled for request 0
Sending Access-Challenge of id 123 to 192.168.33.44:1812
Framed-IP-Address = 255.255.255.254
Framed-MTU = 576
Service-Type = Framed-User
EAP-Message = 0x010100160410b9e2efb64f157d1421f9078e7a3bea4c
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x4ec2da2c4cfabac97ead6fe8e31653bf
Finished request 0
Going to the next request
--- Walking the entire request list ---
Waking up in 6 seconds...
rad_recv: Access-Request packet from host 192.168.33.44:1812, id=124,
length=143
NAS-IP-Address = 192.168.33.44
NAS-Port-Type = Async
User-Name = "pete"
Service-Type = Framed-User
Framed-MTU = 1500
Calling-Station-Id = "00-11-43-5c-77-d6"
State = 0x4ec2da2c4cfabac97ead6fe8e31653bf
EAP-Message =
0x0201001f04102f942aff5c15b303e8f9165af155871063736368776172747a
Message-Authenticator = 0x2000b9a88b196b010901c1f9e01d3555
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 1
modcall[authorize]: module "preprocess" returns ok for request 1
modcall[authorize]: module "chap" returns noop for request 1
modcall[authorize]: module "mschap" returns noop for request 1
rlm_realm: No '@' in User-Name = "pete", looking up realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 1
rlm_eap: EAP packet type response id 1 length 31
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 1
users: Matched entry DEFAULT at line 159
users: Matched entry DEFAULT at line 178
modcall[authorize]: module "files" returns ok for request 1
modcall: group authorize returns updated for request 1
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 1
rlm_eap: Request found, released from the list
rlm_eap: EAP/md5
rlm_eap: processing type md5
rlm_eap_md5: User-Password is required for EAP-MD5 authentication
rlm_eap: Handler failed in EAP/md5
rlm_eap: Failed in EAP select
modcall[authenticate]: module "eap" returns invalid for request 1
modcall: group authenticate returns invalid for request 1
auth: Failed to validate the user.
Delaying request 1 for 1 seconds
Finished request 1
Going to the next request
Waking up in 6 seconds...
rad_recv: Access-Request packet from host 192.168.33.44:1812, id=124,
length=143
Sending Access-Reject of id 124 to 192.168.33.44:1812
EAP-Message = 0x04010004
Message-Authenticator = 0x00000000000000000000000000000000
--- Walking the entire request list ---
Waking up in 3 seconds...
--- Walking the entire request list ---
Cleaning up request 0 ID 123 with timestamp 429e8ebe
Cleaning up request 1 ID 124 with timestamp 429e8ebe
Nothing to do. Sleeping until we see a request.
Regards,
Pete
_________________________________________________________________
Express yourself instantly with MSN Messenger! Download today it's FREE!
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
