I have packetfence 7.3 setup for radius auth with AD.
Everything works fine at first, but after a few minutes request begin to fail
with:
chrooted_mschap: ERROR: Failed to read from child output
(676) chrooted_mschap: Creating challenge hash with username: XXXXXXXXXXXX
(676) chrooted_mschap: Client is using MS-CHAPv2
(676) chrooted_mschap: Executing: /usr/bin/sudo /usr/sbin/chroot
/chroots/%{PacketFence-Domain} /usr/local/pf/bin/ntlm_auth_wrapper -- Â Â Â
 --request-nt-key
--username=%{%{Stripped-User-Name}:-%{mschap:User-Name:-None}}
--challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}:
(676) chrooted_mschap: EXPAND /chroots/%{PacketFence-Domain}
(676) chrooted_mschap: --> /chroots/XXXXX
(676) chrooted_mschap: EXPAND
--username=%{%{Stripped-User-Name}:-%{mschap:User-Name:-None}}
(676) chrooted_mschap: --> --username=XXXXXXX
(676) chrooted_mschap: Creating challenge hash with username: XXXXXXX
(676) chrooted_mschap: EXPAND --challenge=%{mschap:Challenge:-00}
(676) chrooted_mschap: --> --challenge=XXXXXXXXXXXXXXXXXXXXXXXXXXXXX
(676) chrooted_mschap: EXPAND --nt-response=%{mschap:NT-Response:-00}
(676) chrooted_mschap: -->
--nt-response=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
...
(676) chrooted_mschap: ERROR: Failed to read from child output[0m
(676) chrooted_mschap: External script failed
(676) chrooted_mschap: ERROR: External script says: [0m
(676) chrooted_mschap: ERROR: MS-CHAP2-Response is incorrect[0m
(676) [chrooted_mschap] = reject
(676) } # else = reject
(676) } # if (PacketFence-Domain) = reject
(676) } # policy packetfence-mschap-authenticate = reject
(676) } # else = reject
(676) } # Auth-Type MS-CHAP = reject
(676) eap: Sending EAP Failure (code 4) ID 22 length 4
(676) eap: Freeing handler
(676) [eap] = reject
(676) } # authenticate = reject
(676) Failed to authenticate the user
(676) Login incorrect (chrooted_mschap: Failed to read from child output):
[sappleby] (from client 192.168.240.47 port 104 cli 88:6b:6e:65:1c:09 via TLS
tunnel)[0m
(676) Using Post-Auth-Type Reject
(676) # Executing group from file
/usr/local/pf/raddb/sites-enabled/packetfence-tunnel
(676) Rejected in post-auth: [xxxxxxxx] (from client XXX.XXX.XXX.XXX port 104
cli XX:XX:XX:XX:XX:XX via TLS tunnel)[0m
(676) } # server packetfence-tunnel
(676) Virtual server sending reply
(676) MS-CHAP-Error = "\026E=691 R=0 C=2623d2a0843c8b7eb91e144ca1a4ca81 V=3
M=Authentication failed"
(676) EAP-Message = 0x04160004
(676) Message-Authenticator = 0x00000000000000000000000000000000
(676) eap_peap: Got tunneled reply code 3
(676) eap_peap: MS-CHAP-Error = "\026E=691 R=0
C=2623d2a0843c8b7eb91e144ca1a4ca81 V=3 M=Authentication failed"
(676) eap_peap: EAP-Message = 0x04160004
(676) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000
(676) eap_peap: Got tunneled reply RADIUS code 3
(676) eap_peap: MS-CHAP-Error = "\026E=691 R=0
C=2623d2a0843c8b7eb91e144ca1a4ca81 V=3 M=Authentication failed"
(676) eap_peap: EAP-Message = 0x04160004
(676) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000
(676) eap_peap: Tunneled authentication was rejected
(676) eap_peap: FAILURE
(676) eap: Sending EAP Request (code 1) ID 23 length 46
(676) eap: EAP session adding &reply:State = 0xc01f10b7c60809ca
(676) WARNING: Module rlm_eap became unblocked[0m
I've executed the failed request in the cli and it's successful.
Any help would be appreciated.
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
PacketFence-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/packetfence-users
