Can someone please help provide a clue into the problems with using ntlm_auth
in a Freeradius config running on Debian.
The user/password information are held in the LDAP server. I have been able
to authenticate successfully with packets coming from non-EAP clients. But
for EAP authentication clients, I have been receiving the following error
lines. (I am using ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key
--username=%{Stripped-User-Name:-%{User-Name:-None}}
--challenge=%{mschap:Challenge:-00} to call the LDAP server.
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/mschapv2
[eap] processing type mschapv2
[mschapv2] +- entering group MS-CHAP {...}
[mschap] No Cleartext-Password configured. Cannot create LM-Password.
[mschap] No Cleartext-Password configured. Cannot create NT-Password.
[mschap] Told to do MS-CHAPv2 for otha1_00 with NT-Password
[mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang"
for details
[mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang"
for details
[mschap] expand: --username=%{Stripped-User-Name:-%{User-Name:-None}}
-> --username=otha1_00
[mschap] mschap2: 18
[mschap] expand: --challenge=%{mschap:Challenge:-00} ->
--challenge=b06bae6a129ec4e7
[mschap] expand: --nt-response=%{mschap:NT-Response:-00} ->
--nt-response=c0bec1a04bdd9fb489ef30a2bc22e5806405493ac2038167
Exec-Program output: Invalid handle (0xc0000008)
Exec-Program-Wait: plaintext: Invalid handle (0xc0000008)
Exec-Program: returned: 1
[mschap] External script failed.
[mschap] FAILED: MS-CHAP2-Response is incorrect
++[mschap] returns reject
[eap] Freeing handler
++[eap] returns reject
Failed to authenticate the user.
} # server inner-tunnel
[peap] Got tunneled reply code 3
MS-CHAP-Error = "\026E=691 R=1"
EAP-Message = 0x04160004
Message-Authenticator = 0x00000000000000000000000000000000
[peap] Got tunneled reply RADIUS code 3
MS-CHAP-Error = "\026E=691 R=1"
EAP-Message = 0x04160004
Message-Authenticator = 0x00000000000000000000000000000000
[peap] Tunneled authentication was rejected.
Clement
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
