Freeradius2 and Samba3x

[Alan DeKok]

freeradius at corwyn.net wrote:
> So we upgraded to samba 3x, but that appears to break freeradius. Hrm.

  The upgrade screwed up the file permissions.  See the debug output.

> We're using freeradius to auth VPN users that are connecting from a
> sonicwall firewall, using the windows l2tp client.
> 
> freeradius2-2.1.8-2.el5
> 
> Here's the output from radiusd -xX

  The FAQ, "man" page, etc., all say "radiusd -X".  The first step to
solving a problem is following documentation.
...
> Wed Jul 14 10:51:16 2010 : Debug: Exec-Program output: winbind client
> not authorized to use winbindd_pam_auth_crap. Ensure permissions on
> /var/lib/samba/winbindd_privileged are set correctly. (0xc0000022)
> Wed Jul 14 10:51:16 2010 : Debug: Exec-Program-Wait: plaintext: winbind
> client not authorized to use winbindd_pam_auth_crap. Ensure permissions
> on /var/lib/samba/winbindd_privileged are set correctly. (0xc0000022)

  While that message is buried in lots of debug output, the following
few lines help:

> Wed Jul 14 10:51:16 2010 : Debug: Exec-Program: returned: 1
> Wed Jul 14 10:51:16 2010 : Info: [mschap] External script failed.
> Wed Jul 14 10:51:16 2010 : Info: [mschap] FAILED: MS-CHAP2-Response is
> incorrect

  If you read the debug output looking *only* for WARNING, ERROR,
Failed, or Reject, you will almost always find a message describing the
problem.  As with this one, the message often says how to fix it, too.

 And another authentication request yields:

> Wed Jul 14 11:18:08 2010 : Info: [mschap]       expand:
> --nt-response=%{mschap:NT-Response:-00} ->
> --nt-response=00be3e466ff82a106ee9e3144e442c6caa1bcb71636031b6
> Wed Jul 14 11:18:08 2010 : Debug: Exec-Program output: NT_KEY:
> 580B07A2801E5E9B5CDD55BC23C38D1F
> Wed Jul 14 11:18:08 2010 : Debug: Exec-Program-Wait: plaintext: NT_KEY:
> 580B07A2801E5E9B5CDD55BC23C38D1F
> Wed Jul 14 11:18:08 2010 : Debug: Exec-Program: returned: 0
...
> Sending Access-Accept of id 224 to 10.4.1.2 port 2452
>         Reply-Message := "Authorized Users Only"
>         MS-CHAP2-Success =
> 0x01533d45453444463034303730304331303545384245463834323743454544353433303841303643454530
> 
>         MS-MPPE-Recv-Key = 0x908aea21b6fbe22426feafd473d29657
>         MS-MPPE-Send-Key = 0xe2cddf5bd3f2aaa193fbce0410b840e8
>         MS-MPPE-Encryption-Policy = 0x00000001
>         MS-MPPE-Encryption-Types = 0x00000006

  OK... so what's the problem?  MS-CHAP works...

> Any ideas?

  Read the debug output.  Post the debug output for *one* authentication
request, not 3-4.

> Here are the complete details of our config:

  Which the documentation does not ask for.  The "radiusd -X" output is
all that's necessary.

  Alan DeKok.