Thank you for setting me on the right track; I have followed the directions on
http://deployingradius.com/documents/configuration/active_directory.html (the
bottom section on MSCHAP) and have ntlm_auth in the authenticate {} - as per
those directions.
When I run the ntlm_auth command manually, it works find / as does running
wbinfo -a
root@leopard:/etc/freeradius# wbinfo -a wyse1%K503D
plaintext password authentication succeeded
challenge/response password authentication succeeded
Ready to process requests.
rad_recv: Access-Request packet from host 127.0.0.1 port 60046, id=111,
length=113
User-Name = "wyse1"
NAS-IP-Address = 127.0.1.1
NAS-Port = 1812
MS-CHAP-Challenge = 0xe07a375bed09f1f7
MS-CHAP-Response =
0x0001000000000000000000000000000000000000000000000000065b157b183b4d29d455414b184c57af4912b1d74f4ed726
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
[mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap'
++[mschap] returns ok
++[digest] returns noop
[suffix] No '@' in User-Name = "wyse1", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] No EAP-Message, not doing EAP
++[eap] returns noop
++[files] returns noop
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING! No "known good" password found for the user. Authentication may
fail because of this.
++[pap] returns noop
Found Auth-Type = MSCHAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group MS-CHAP {...}
[mschap] Told to do MS-CHAPv1 with NT-Password
[mschap] expand: %{Stripped-User-Name} ->
[mschap] ... expanding second conditional
[mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for
details
[mschap] expand: %{User-Name:-None} -> wyse1
[mschap] expand: --username=%{%{Stripped-User-Name}:-%{User-Name:-None}}
-> --username=wyse1
[mschap] mschap1: e0
[mschap] expand: --challenge=%{mschap:Challenge:-00} ->
--challenge=e07a375bed09f1f7
[mschap] expand: --nt-response=%{mschap:NT-Response:-00} ->
--nt-response=065b157b183b4d29d455414b184c57af4912b1d74f4ed726
Exec-Program output: Reading winbind reply failed! (0xc0000001)
Exec-Program-Wait: plaintext: Reading winbind reply failed! (0xc0000001)
Exec-Program: returned: 1
[mschap] External script failed.
[mschap] MS-CHAP-Response is incorrect.
++[mschap] returns reject
Failed to authenticate the user.
Login incorrect (mschap: External script says Reading winbind reply failed!
(0xc0000001)): [wyse1/<via Auth-Type = mschap>] (from client localhost port
1812)
Using Post-Auth-Type Reject
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group REJECT {...}
[attr_filter.access_reject] expand: %{User-Name} -> wyse1
attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] returns updated
Delaying reject of request 0 for 1 seconds
Going to the next request
Waking up in 0.9 seconds.
Sending delayed reject for request 0
Sending Access-Reject of id 111 to 127.0.0.1 port 60046
Waking up in 4.9 seconds.
Cleaning up request 0 ID 111 with timestamp +15
Ready to process requests.
On Aug 22, 2013, at 5:50 AM, Phil Mayers <[email protected]> wrote:
> On 21/08/13 23:44, Chris Parker wrote:
>> Okay, pardon my confusion then. I had been following a howto online
>> and it reported that the command when run manually will produce the
>> key.
>>
>> Either way, I'm still having a failure in MSCHAP with radtest that
>> I'm not quite grasping.
>
> Well, as I explained in my other email, mschap == challenge/response,
> "modules/ntlm_auth" != challenge/response.
>
> To reiterate, "modules/ntlm_auth" is almost certainly not what you want, and
> is not intended to be used as-is. I would unconfigure it and concentrate on
> getting "modules/mschap" working.
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
