PEAP-MSCHAPv2 against AD
Jonathan De Graeve
Jonathan.DeGraeve at imelda.be
Mon Sep 25 17:33:55 CEST 2006
I'm trying todo PEAP-MSCHAPv2 with authentication against an AD
Currently I have the following problem:
When the domain is in the username the authentication fails, if the
domainname isn't in the authentication the authentication succeeds. I'm
using the following ntlm_auth line in radiusd.conf:
ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key
--username=%{Stripped-User-Name:-%{User-Name:-None}}
--challenge=%{mschap:Challenge:-00}
--nt-response=%{mschap:NT-Response:-00}
--require-membership-of=S-1-5-21-3816208617-2573269785-2633524980-1134
--domain=%{mschap:NT-Domain:-IMZ}"
The with_ntdomain_hack = yes is enabled in the mschap {}
Output from shell:
radius1:/etc/freeradius# /usr/bin/ntlm_auth --request-nt-key
--username=IMZ\\beheerder --challenge=e456e008c25a9ac7
--nt-response=28e9d997b30267a36af64a4fcb530cd6b08f1141c09bc580
--require-membership-of=S-1-5-21-3816208617-2573269785-2633524980-1134
--domain=IMZ
Logon failure (0xc000006d)
radius1:/etc/freeradius# /usr/bin/ntlm_auth --request-nt-key
--username=beheerder --challenge=e456e008c25a9ac7
--nt-response=28e9d997b30267a36af64a4fcb530cd6b08f1141c09bc580
--require-membership-of=S-1-5-21-3816208617-2573269785-2633524980-1134
--domain=IMZ
NT_KEY: EB23807FB13B1CAB06F4F0BBE5C199D0
Debugging information (with a different user)
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 252
rlm_eap: Request found, released from the list
rlm_eap: EAP/peap
rlm_eap: processing type peap
rlm_eap_peap: Authenticate
rlm_eap_tls: processing TLS
eaptls_verify returned 7
rlm_eap_tls: Done initial handshake
eaptls_process returned 7
rlm_eap_peap: EAPTLS_OK
rlm_eap_peap: Session established. Decoding tunneled attributes.
rlm_eap_peap: EAP type mschapv2
rlm_eap_peap: Tunneled data is valid.
PEAP: Got tunneled EAP-Message
EAP-Message =
0x020800471a0208004231f622919de18b1fdab0ca9902b9729d49000000000000000013
37f654a247b82ba252becd3320cdd94974567666fa081800494d5a5c6a6f6e617468616e
PEAP: Setting User-Name to IMZ\jonathan
PEAP: Adding old state with 8f f9
PEAP: Sending tunneled request
EAP-Message =
0x020800471a0208004231f622919de18b1fdab0ca9902b9729d49000000000000000013
37f654a247b82ba252becd3320cdd94974567666fa081800494d5a5c6a6f6e617468616e
FreeRADIUS-Proxied-To = 127.0.0.1
User-Name = "IMZ\\jonathan"
State = 0x8ff913e6997d7ca8d6a9b4832ff5c931
NAS-IP-Address = 194.8.52.161
Connect-Info = "CONNECT 802.11"
Called-Station-Id = "000fb5df0524"
Calling-Station-Id = "004096ab4eed"
NAS-Identifier = "ap"
NAS-Port-Type = Wireless-802.11
NAS-Port = 4
NAS-Port-Id = "4"
Framed-MTU = 1400
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 252
modcall[authorize]: module "preprocess" returns ok for request 252
modcall[authorize]: module "attr_filter" returns noop for request 252
modcall[authorize]: module "chap" returns noop for request 252
modcall[authorize]: module "mschap" returns noop for request 252
modcall[authorize]: module "digest" returns noop for request 252
rlm_realm: No '@' in User-Name = "IMZ\jonathan", looking up realm
NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 252
rlm_eap: EAP packet type response id 8 length 71
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 252
modcall[authorize]: module "files" returns notfound for request 252
radius_xlat: 'IMZ\\jonathan'
rlm_sql (sql): sql_set_user escaped user --> 'IMZ\\jonathan'
radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM
radcheck WHERE Username = 'IMZ=5C=5C=5C=5Cjonathan'
ORDER BY id'
rlm_sql (sql): Reserving sql socket id: 3
rlm_sql (sql): User IMZ\\jonathan not found in radcheck
radius_xlat: 'SELECT
radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgrou
pcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE
usergroup.Username = 'IMZ=5C=5C=5C=5Cjonathan' AND usergroup.GroupName =
radgroupcheck.GroupName ORDER BY radgroupcheck.id'
radius_xlat: 'SELECT
radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgrou
preply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE
usergroup.Username = 'IMZ=5C=5C=5C=5Cjonathan' AND usergroup.GroupName =
radgroupreply.GroupName ORDER BY radgroupreply.id'
rlm_sql (sql): User IMZ\\jonathan not found in radgroupcheck
rlm_sql (sql): Released sql socket id: 3
rlm_sql (sql): User not found
modcall[authorize]: module "sql" returns notfound for request 252
rlm_sqlcounter: Entering module authorize code
rlm_sqlcounter: Could not find Check item value pair
modcall[authorize]: module "validfromlogin" returns noop for request
252
rlm_sqlcounter: Entering module authorize code
rlm_sqlcounter: Could not find Check item value pair
modcall[authorize]: module "validfromcreation" returns noop for
request 252
rlm_sqlcounter: Entering module authorize code
rlm_sqlcounter: Could not find Check item value pair
modcall[authorize]: module "uploadlimit" returns noop for request 252
rlm_sqlcounter: Entering module authorize code
rlm_sqlcounter: Could not find Check item value pair
modcall[authorize]: module "volumelimit" returns noop for request 252
rlm_sqlcounter: Entering module authorize code
rlm_sqlcounter: Could not find Check item value pair
modcall[authorize]: module "prepaidcounter" returns noop for request
252
modcall: leaving group authorize (returns updated) for request 252
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 252
rlm_eap: Request found, released from the list
rlm_eap: EAP/mschapv2
rlm_eap: processing type mschapv2
Processing the authenticate section of radiusd.conf
modcall: entering group MS-CHAP for request 252
rlm_mschap: No User-Password configured. Cannot create LM-Password.
rlm_mschap: No User-Password configured. Cannot create NT-Password.
rlm_mschap: Told to do MS-CHAPv2 for jonathan with NT-Password
radius_xlat: Running registered xlat function of module mschap for
string 'Challenge'
mschap2: 05
radius_xlat: Running registered xlat function of module mschap for
string 'NT-Response'
radius_xlat: Running registered xlat function of module mschap for
string 'NT-Domain'
radius_xlat: '/usr/bin/ntlm_auth --request-nt-key
--username=IMZ\\jonathan --challenge=d13cab581e1c3097
--nt-response=1337f654a247b82ba252becd3320cdd94974567666fa0818
--require-membership-of=S-1-5-21-3816208617-2573269785-2633524980-1134
--domain=IMZ'
Exec-Program: /usr/bin/ntlm_auth --request-nt-key
--username=IMZ\\jonathan --challenge=d13cab581e1c3097
--nt-response=1337f654a247b82ba252becd3320cdd94974567666fa0818
--require-membership-of=S-1-5-21-3816208617-2573269785-2633524980-1134
--domain=IMZ
Exec-Program output: Logon failure (0xc000006d)
Exec-Program-Wait: plaintext: Logon failure (0xc000006d)
Exec-Program: returned: 1
rlm_mschap: External script failed.
rlm_mschap: FAILED: MS-CHAP2-Response is incorrect
modcall[authenticate]: module "mschap" returns reject for request 252
modcall: leaving group MS-CHAP (returns reject) for request 252
rlm_eap: Freeing handler
modcall[authenticate]: module "eap" returns reject for request 252
modcall: leaving group authenticate (returns reject) for request 252
auth: Failed to validate the user.
Login incorrect: [IMZ\\jonathan/<no User-Password attribute>] (from
client localhost port 4 cli 004096ab4eed)
PEAP: Got tunneled reply RADIUS code 3
MS-CHAP-Error = "\010E=691 R=1"
EAP-Message = 0x04080004
Message-Authenticator = 0x00000000000000000000000000000000
PEAP: Processing from tunneled session code 0x8978750 3
MS-CHAP-Error = "\010E=691 R=1"
EAP-Message = 0x04080004
Message-Authenticator = 0x00000000000000000000000000000000
PEAP: Tunneled authentication was rejected.
rlm_eap_peap: FAILURE
Anyone out there who nows how to solve this problem?
PS I'm running freeradius 1.1.3
Thx in advance,
J.
--
Jonathan De Graeve
Network/System Engineer
Imelda vzw
Informatica Dienst
+32 15/50.52.98
jonathan.de.graeve at imelda.be
---------
Always read the manual for the correct way to do things because the
number of incorrect ways to do things is almost infinite
---------
More information about the Freeradius-Users
mailing list