<br><font size=2 face="sans-serif">All,</font>
<br><font size=2 face="sans-serif">I am trying to authenticate my wifi
users via our AD. I'm finding bits and pieces on the internet to configure
things, but no completely usable howto.</font>
<br><font size=2 face="sans-serif">Can someone of the users look at the
ouput below and point me to the correct solution/howto?</font>
<br>
<br><font size=2 face="sans-serif">I setup smb.conf,krb5.conf and freeradius.
I joined the server to the domain and tested the connection with ntlm_auth:</font>
<br><font size=2 face="sans-serif">[root@belx11ke ~]# /usr/bin/ntlm_auth
--request-nt-key --username=sstruyf --domain=KMT-EU.KMTG.NET</font>
<br><font size=2 face="sans-serif">password:</font>
<br><font size=2 face="sans-serif">NT_STATUS_OK: Success (0x0)</font>
<br><font size=2 face="sans-serif">[root@belx11ke ~]#</font>
<br>
<br><font size=2 face="sans-serif">rights of the winbind pipe: </font>
<br><font size=2 face="sans-serif">ls -l /var/cache/samba/winbindd_privileged</font>
<br><font size=2 face="sans-serif">total 0</font>
<br><font size=2 face="sans-serif">srwxrwxrwx 1 root root 0 Oct 25
14:46 pipe</font>
<br>
<br><font size=2 face="sans-serif">below is the debug output of freeradius</font>
<br>
<br><font size=2 face="sans-serif"> Processing the authenticate section
of radiusd.conf</font>
<br><font size=2 face="sans-serif">modcall: entering group authenticate
for request 7</font>
<br><font size=2 face="sans-serif"> rlm_eap: Request found, released
from the list</font>
<br><font size=2 face="sans-serif"> rlm_eap: EAP/peap</font>
<br><font size=2 face="sans-serif"> rlm_eap: processing type peap</font>
<br><font size=2 face="sans-serif"> rlm_eap_peap: Authenticate</font>
<br><font size=2 face="sans-serif"> rlm_eap_tls: processing TLS</font>
<br><font size=2 face="sans-serif"> eaptls_verify returned 7</font>
<br><font size=2 face="sans-serif"> rlm_eap_tls: Done initial handshake</font>
<br><font size=2 face="sans-serif"> eaptls_process returned 7</font>
<br><font size=2 face="sans-serif"> rlm_eap_peap: EAPTLS_OK</font>
<br><font size=2 face="sans-serif"> rlm_eap_peap: Session established.
Decoding tunneled attributes.</font>
<br><font size=2 face="sans-serif"> rlm_eap_peap: EAP type mschapv2</font>
<br><font size=2 face="sans-serif"> rlm_eap_peap: Tunneled data is
valid.</font>
<br><font size=2 face="sans-serif"> PEAP: Got tunneled EAP-Message</font>
<br><font size=2 face="sans-serif"> EAP-Message
= 0x020900521a0209004d3137d2b9533b5dbce9ca720a00d56208c30000
0000000000008a0b7468748de41ff9fc510e9cc7afb6e1f9faaf0d9a9972004b4d542d45552e4b4d54472e4e45545c73737472757966</font>
<br><font size=2 face="sans-serif"> PEAP: Setting User-Name to KMT-EU.KMTG.NET\sstruyf</font>
<br><font size=2 face="sans-serif"> PEAP: Adding old state with a4
c3</font>
<br><font size=2 face="sans-serif"> PEAP: Sending tunneled request</font>
<br><font size=2 face="sans-serif"> EAP-Message
= 0x020900521a0209004d3137d2b9533b5dbce9ca720a00d56208c30000
0000000000008a0b7468748de41ff9fc510e9cc7afb6e1f9faaf0d9a9972004b4d542d45552e4b4d54472e4e45545c73737472757966</font>
<br><font size=2 face="sans-serif"> FreeRADIUS-Proxied-To
= 127.0.0.1</font>
<br><font size=2 face="sans-serif"> User-Name
= "KMT-EU.KMTG.NET\\sstruyf"</font>
<br><font size=2 face="sans-serif"> State =
0xa4c337a92357e8d90a5f8c64b37d2df1</font>
<br><font size=2 face="sans-serif"> Processing the authorize section
of radiusd.conf</font>
<br><font size=2 face="sans-serif">modcall: entering group authorize for
request 7</font>
<br><font size=2 face="sans-serif"> modcall[authorize]: module "preprocess"
returns ok for request 7</font>
<br><font size=2 face="sans-serif"> modcall[authorize]: module "mschap"
returns noop for request 7</font>
<br><font size=2 face="sans-serif"> rlm_realm: No '@' in User-Name
= "KMT-EU.KMTG.NET\sstruyf", looking up realm NULL</font>
<br><font size=2 face="sans-serif"> rlm_realm: No such realm
"NULL"</font>
<br><font size=2 face="sans-serif"> modcall[authorize]: module "kmt-eu.kmtg.net"
returns noop for request 7</font>
<br><font size=2 face="sans-serif"> rlm_realm: Looking up
realm "KMT-EU.KMTG.NET" for User-Name = "KMT-EU.KMTG.NET\sstruyf"</font>
<br><font size=2 face="sans-serif"> rlm_realm: Found realm
"KMT-EU.KMTG.NET"</font>
<br><font size=2 face="sans-serif"> rlm_realm: Adding Stripped-User-Name
= "sstruyf"</font>
<br><font size=2 face="sans-serif"> rlm_realm: Proxying request
from user sstruyf to realm KMT-EU.KMTG.NET</font>
<br><font size=2 face="sans-serif"> rlm_realm: Adding Realm
= "KMT-EU.KMTG.NET"</font>
<br><font size=2 face="sans-serif"> rlm_realm: Authentication
realm is LOCAL.</font>
<br><font size=2 face="sans-serif"> modcall[authorize]: module "ntdomain"
returns noop for request 7</font>
<br><font size=2 face="sans-serif"> rlm_eap: EAP packet type response
id 9 length 82</font>
<br><font size=2 face="sans-serif"> rlm_eap: No EAP Start, assuming
it's an on-going EAP conversation</font>
<br><font size=2 face="sans-serif"> modcall[authorize]: module "eap"
returns updated for request 7</font>
<br><font size=2 face="sans-serif"> users: Matched sstruyf
at 98</font>
<br><font size=2 face="sans-serif"> modcall[authorize]: module "files"
returns ok for request 7</font>
<br><font size=2 face="sans-serif">modcall: group authorize returns updated
for request 7</font>
<br><font size=2 face="sans-serif"> rad_check_password: Found
Auth-Type EAP</font>
<br><font size=2 face="sans-serif">auth: type "EAP"</font>
<br><font size=2 face="sans-serif"> Processing the authenticate section
of radiusd.conf</font>
<br><font size=2 face="sans-serif">modcall: entering group authenticate
for request 7</font>
<br><font size=2 face="sans-serif"> rlm_eap: Request found, released
from the list</font>
<br><font size=2 face="sans-serif"> rlm_eap: EAP/mschapv2</font>
<br><font size=2 face="sans-serif"> rlm_eap: processing type mschapv2</font>
<br><font size=2 face="sans-serif"> Processing the authenticate section
of radiusd.conf</font>
<br><font size=2 face="sans-serif">modcall: entering group Auth-Type for
request 7</font>
<br><font size=2 face="sans-serif"> rlm_mschap: No User-Password
configured. Cannot create LM-Password.</font>
<br><font size=2 face="sans-serif"> rlm_mschap: No User-Password
configured. Cannot create NT-Password.</font>
<br><font size=2 face="sans-serif"> rlm_mschap: NT Domain delimeter
found, should we have enabled with_ntdomain_hack?</font>
<br><font size=2 face="sans-serif"> rlm_mschap: Told to do MS-CHAPv2
for KMT-EU.KMTG.NET\sstruyf with NT-Password</font>
<br><font size=2 face="sans-serif">radius_xlat: Running registered xlat
function of module mschap for string 'Challenge'</font>
<br><font size=2 face="sans-serif"> mschap2: 95</font>
<br><font size=2 face="sans-serif"> rlm_mschap: NT Domain delimeter
found, should we have enabled with_ntdomain_hack?</font>
<br><font size=2 face="sans-serif">radius_xlat: Running registered xlat
function of module mschap for string 'NT-Response'</font>
<br><font size=2 face="sans-serif">radius_xlat: '/usr/bin/ntlm_auth
--request-nt-key --username=sstruyf --challeng e=7b634e5c9dd73ddc --nt-response=8a0b7468748de41ff9fc510e9cc7afb6e1f9faaf0d9a9972'</font>
<br><font size=2 face="sans-serif">Exec-Program: /usr/bin/ntlm_auth --request-nt-key
--username=sstruyf --challenge=7b634e5c9dd73ddc --nt-response=8a0b7468748de41ff9fc510e9cc7afb6e1f9faaf0d9a9972</font>
<br><font size=2 face="sans-serif">Exec-Program output: winbind client
not authorized to use winbindd_pam_auth_crap. Ensure permissions
on /var/cache/samba/winbindd_privileged are set correctly.
(0xc0000022)</font>
<br><font size=2 face="sans-serif">Exec-Program-Wait: plaintext: winbind
client not authorized to use winbindd_pam_auth_crap. Ensure permissions
on /var/cache/samba/winbindd_privileged are set correctly. (0xc0000022)</font>
<br><font size=2 face="sans-serif">Exec-Program: returned: 1</font>
<br><font size=2 face="sans-serif"> rlm_mschap: External script failed.</font>
<br><font size=2 face="sans-serif"> rlm_mschap: FAILED: MS-CHAP2-Response
is incorrect</font>
<br><font size=2 face="sans-serif"> modcall[authenticate]: module
"mschap" returns reject for request 7</font>
<br><font size=2 face="sans-serif">modcall: group Auth-Type returns reject
for request 7</font>
<br><font size=2 face="sans-serif"> rlm_eap: Freeing handler</font>
<br><font size=2 face="sans-serif"> modcall[authenticate]: module
"eap" returns reject for request 7</font>
<br><font size=2 face="sans-serif">modcall: group authenticate returns
reject for request 7</font>
<br><font size=2 face="sans-serif">auth: Failed to validate the user.</font>
<br><font size=2 face="sans-serif">Login incorrect: [KMT-EU.KMTG.NET\\sstruyf/<no
User-Password attribute>] (from client localhost port 0)</font>
<br><font size=2 face="sans-serif"> Processing the post-auth section
of radiusd.conf</font>
<br><font size=2 face="sans-serif">modcall: entering group Post-Auth-Type
for request 7</font>
<br>
<br><font size=2 face="sans-serif">Stieven Struyf<br>
M.I.S. Division - System Operations <br>
Komatsu Europe International NV<br>
Mechelsesteenweg 586<br>
B-1800 Vilvoorde<br>
Stieven.Struyf@komatsu.eu<br>
Tel. +32 (0)2 2552551</font>