Problem with MSCHAP

Alan Buxey A.L.M.Buxey at lboro.ac.uk
Fri Oct 8 15:53:50 CEST 2010


Hi,

> I'm new to freeradius, I'm working on setting it up to authenticate users to our wireless network.  We want to use PEAP-MSCHAPv2 and authenticate against Active Directory.  I'm using samba and ntlm_auth.

okay - a fairly standard setup for modern 802.1X

> Versions:freeradius2-2.1.7-7.el5 and samba3.0.33-3.29

okay - the right 'blend'..as it were

> I have the ntlm_auth part working in as far as I can put DEFAULT Auth-Type = ntlm_auth in users and then do

you dont need to set Auth-Type for the MSCHAPv2 stuff... you might need it if, for example, you wanted
to do MSCHAPv2 AND kerberos for different type of requests - even then, you only need to set kerberos
to be the Auth-Type as the EAP module is intelligent

> I then configure MS-CHAP, removing the DEFAULT Auth-Type from users and editing modules/mschap as follows
> 
> ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-MYDOMAIN} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"

do you REALLY want to accept what the user puts in as the gospel truth?  ie, I wouldnt be comfirtable
taking the user-supplied domain for the ntlm_auth - I'd set it manually (if it really was a local user!)

> Output from radius -X at the bottom of this message.  The bit that looks relevant to me is

what you have posted is the 'replay' of a transaction - try starting the daemon up and launching
the request ASAP - ie so what we have is straight after the 'listen and ready' line - especially
as with your current ntlm_auth line I'd expect to see a deprecated warning

> [suffix] Looking up realm "mydomain.ox.ac.uk" for User-Name = "firstname.lastname at mydomain.ox.ac.uk"
> [suffix] No such realm "mydomain.ox.ac.uk"
> 
> However I'm not sure I need to worry about that bit - at the moment this is just a single, stand alone RADIUS server so I'm not sure I need to worry about realms or do I?....

it'd still be best to define that realm, if using prefix, to be local eg in proxy.conf

realm mydomain.ox.ac.uk {
	strip      
  }

alan



More information about the Freeradius-Users mailing list