<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2900.2963" name=GENERATOR></HEAD>
<BODY>
<DIV><SPAN class=570090323-30102006><FONT face=Arial size=2>I had this working
before, and I can't figure out what I'm missing to get it working on this
server.</FONT></SPAN></DIV>
<DIV><SPAN class=570090323-30102006><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=570090323-30102006><FONT face=Arial size=2>Samba Version
3.0.23b</FONT></SPAN></DIV>
<DIV><SPAN class=570090323-30102006><FONT face=Arial size=2>FreeRADIUS version
1.0.4</FONT></SPAN></DIV>
<DIV><SPAN class=570090323-30102006><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=570090323-30102006><FONT face=Arial size=2>Users successfully
authenticate with the domain, Machine accounts do not
however.</FONT></SPAN></DIV>
<DIV><SPAN class=570090323-30102006><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=570090323-30102006><FONT face=Arial size=2>My ntlm_auth line
is:</FONT></SPAN></DIV>
<DIV><SPAN class=570090323-30102006><FONT face=Arial size=2>ntlm_auth =
"/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name}
--challenge=%{mschap:Challenge}
--nt-response=%{mschap:NT-Response}"</FONT></SPAN></DIV>
<DIV><SPAN class=570090323-30102006><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=570090323-30102006><FONT face=Arial size=2>I
have:</FONT></SPAN></DIV>
<DIV><SPAN class=570090323-30102006><FONT face=Arial size=2>with_ntdomain_hack =
yes</FONT></SPAN></DIV>
<DIV><SPAN class=570090323-30102006><FONT face=Arial size=2>in the mschap
section.</FONT></SPAN></DIV>
<DIV><SPAN class=570090323-30102006><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=570090323-30102006><FONT face=Arial size=2>The debug is
below</FONT></SPAN></DIV>
<DIV><SPAN class=570090323-30102006><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=570090323-30102006><FONT face=Arial size=2>The only thing that
looks different than last time is it looks like the host/ isn't getting stripped
off. Should it?</FONT></SPAN></DIV>
<DIV><SPAN class=570090323-30102006><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=570090323-30102006></SPAN> </DIV>
<DIV><SPAN class=570090323-30102006><FONT face=Arial size=2> </DIV>
<DIV>rad_recv: Access-Request packet from host 10.0.1.22:32769, id=171,
length=324<BR> User-Name =
"host/boytel2883.campus.bridgew.edu"<BR>
Calling-Station-Id =
"00-90-96-F4-2A-BB"<BR>
Called-Station-Id =
"00-0B-85-5B-55-A0:test"<BR> NAS-Port
= 29<BR> NAS-IP-Address =
10.0.1.22<BR> NAS-Identifier =
"BUWISM2-2"<BR> Vendor-14179-Attr-1 =
0x00000007<BR> Service-Type =
Framed-User<BR> Framed-MTU =
1300<BR> NAS-Port-Type =
Wireless-802.11<BR> Tunnel-Type:0 =
VLAN<BR> Tunnel-Medium-Type:0 =
IEEE-802<BR> Tunnel-Private-Group-Id:0
= "4000"<BR> EAP-Message =
0x0207007419001703010069fad4edfbbed6d8fb51dcf6cb01ead274ca25439081be3955bfd614a066335309bfcc72d0f20a0891d43fd085e948c3a635622fcd52658bdc817970b87e859a66ec970d7433349e6cbd2d19184182eb762ea246e13202349e8c32c8acd5e5c322df88f7fd45aa24e13f<BR>
State =
0xdfdc87766140b541e2ac318d7ce82e0f<BR>
Message-Authenticator = 0x42318a374d505be3af9ffa7af0c39484<BR> Processing
the authorize section of radiusd.conf<BR>modcall: entering group authorize for
request 19<BR> modcall[authorize]: module "preprocess" returns ok for
request 19<BR> modcall[authorize]: module "chap" returns noop for request
19<BR> modcall[authorize]: module "mschap" returns noop for request
19<BR> rlm_realm: No <A href="mailto:'@'">'@'</A> in User-Name
= "host/boytel2883.campus.bridgew.edu", looking up realm
NULL<BR> rlm_realm: No such realm "NULL"<BR>
modcall[authorize]: module "suffix" returns noop for request 19<BR>
rlm_eap: EAP packet type response id 7 length 116<BR> rlm_eap: No EAP
Start, assuming it's an on-going EAP conversation<BR> modcall[authorize]:
module "eap" returns updated for request 19<BR> users: Matched
entry DEFAULT at line 152<BR> users: Matched entry DEFAULT at
line 171<BR> modcall[authorize]: module "files" returns ok for request
19<BR>modcall: group authorize returns updated for request 19<BR>
rad_check_password: Found Auth-Type EAP<BR>auth: type "EAP"<BR>
Processing the authenticate section of radiusd.conf<BR>modcall: entering group
authenticate for request 19<BR> rlm_eap: Request found, released from the
list<BR> rlm_eap: EAP/peap<BR> rlm_eap: processing type
peap<BR> rlm_eap_peap: Authenticate<BR> rlm_eap_tls: processing
TLS<BR> eaptls_verify returned 7<BR> rlm_eap_tls: Done initial
handshake<BR> eaptls_process returned 7<BR> rlm_eap_peap:
EAPTLS_OK<BR> rlm_eap_peap: Session established. Decoding tunneled
attributes.<BR> rlm_eap_peap: EAP type mschapv2<BR> rlm_eap_peap:
Tunneled data is valid.<BR> PEAP: Setting User-Name to
host/boytel2883.campus.bridgew.edu<BR> PEAP: Adding old state with f4
4b<BR> Processing the authorize section of radiusd.conf<BR>modcall:
entering group authorize for request 19<BR> modcall[authorize]: module
"preprocess" returns ok for request 19<BR> modcall[authorize]: module
"chap" returns noop for request 19<BR> modcall[authorize]: module "mschap"
returns noop for request 19<BR> rlm_realm: No <A
href="mailto:'@'">'@'</A> in User-Name = "host/boytel2883.campus.bridgew.edu",
looking up realm NULL<BR> rlm_realm: No such realm
"NULL"<BR> modcall[authorize]: module "suffix" returns noop for request
19<BR> rlm_eap: EAP packet type response id 7 length 93<BR> rlm_eap:
No EAP Start, assuming it's an on-going EAP conversation<BR>
modcall[authorize]: module "eap" returns updated for request
19<BR> users: Matched entry DEFAULT at line 152<BR>
modcall[authorize]: module "files" returns ok for request 19<BR>modcall: group
authorize returns updated for request 19<BR> rad_check_password:
Found Auth-Type EAP<BR>auth: type "EAP"<BR> Processing the authenticate
section of radiusd.conf<BR>modcall: entering group authenticate for request
19<BR> rlm_eap: Request found, released from the list<BR> rlm_eap:
EAP/mschapv2<BR> rlm_eap: processing type mschapv2<BR> Processing
the authenticate section of radiusd.conf<BR>modcall: entering group Auth-Type
for request 19<BR> rlm_mschap: No User-Password configured. Cannot
create LM-Password.<BR> rlm_mschap: No User-Password configured.
Cannot create NT-Password.<BR> rlm_mschap: Told to do MS-CHAPv2 for
host/boytel2883.campus.bridgew.edu with NT-Password<BR>radius_xlat: Running
registered xlat function of module mschap for string 'User-Name'<BR>radius_xlat:
Running registered xlat function of module mschap for string
'Challenge'<BR> mschap2: c4<BR>radius_xlat: Running registered xlat
function of module mschap for string 'NT-Response'<BR>radius_xlat:
'/usr/bin/ntlm_auth --request-nt-key
--username=host/boytel2883.campus.bridgew.edu --challenge=896edabb073ecbba
--nt-response=ed45bb2d412865db09406089a5c4145c142b682a469717cb'<BR>Exec-Program:
/usr/bin/ntlm_auth --request-nt-key
--username=host/boytel2883.campus.bridgew.edu --challenge=896edabb073ecbba
--nt-response=ed45bb2d412865db09406089a5c4145c142b682a469717cb<BR>Exec-Program
output: Logon failure (0xc000006d)<BR>Exec-Program-Wait: plaintext: Logon
failure (0xc000006d)<BR>Exec-Program: returned: 1<BR> rlm_mschap: External
script failed.<BR> rlm_mschap: FAILED: MS-CHAP2-Response is
incorrect<BR> modcall[authenticate]: module "mschap" returns reject for
request 19<BR>modcall: group Auth-Type returns reject for request 19<BR>
rlm_eap: Freeing handler<BR> modcall[authenticate]: module "eap" returns
reject for request 19<BR>modcall: group authenticate returns reject for request
19<BR>auth: Failed to validate the user.<BR>Login incorrect:
[host/boytel2883.campus.bridgew.edu] (from client localhost port 0)<BR>
PEAP: Tunneled authentication was rejected.<BR> rlm_eap_peap:
FAILURE<BR> modcall[authenticate]: module "eap" returns handled for
request 19<BR>modcall: group authenticate returns handled for request
19<BR>Sending Access-Challenge of id 171 to
10.0.1.22:32769<BR> Framed-IP-Address
= 255.255.255.254<BR> Framed-MTU =
576<BR> Service-Type =
Framed-User<BR> EAP-Message =
0x010800261900170301001b117712344a946d2ec4a5810ca84e7e8d679cd4db81a9d3ba62f02c<BR>
Message-Authenticator =
0x00000000000000000000000000000000<BR>
State = 0xda9104a0e99cbf878c499197750025dd<BR>Finished request 19<BR>Going to
the next request<BR>Waking up in 3 seconds...<BR>rad_recv: Access-Request packet
from host 10.0.1.22:32769, id=172,
length=246<BR> User-Name =
"host/boytel2883.campus.bridgew.edu"<BR>
Calling-Station-Id =
"00-90-96-F4-2A-BB"<BR>
Called-Station-Id =
"00-0B-85-5B-55-A0:test"<BR> NAS-Port
= 29<BR> NAS-IP-Address =
10.0.1.22<BR> NAS-Identifier =
"BUWISM2-2"<BR> Vendor-14179-Attr-1 =
0x00000007<BR> Service-Type =
Framed-User<BR> Framed-MTU =
1300<BR> NAS-Port-Type =
Wireless-802.11<BR> Tunnel-Type:0 =
VLAN<BR> Tunnel-Medium-Type:0 =
IEEE-802<BR> Tunnel-Private-Group-Id:0
= "4000"<BR> EAP-Message =
0x020800261900170301001b8391b7780fd0e65e7da0ff923b9c0239457f612ac17c79044626be<BR>
State =
0xda9104a0e99cbf878c499197750025dd<BR>
Message-Authenticator = 0x58d7a64496d15d4c60e90495b86ab1db<BR> Processing
the authorize section of radiusd.conf<BR>modcall: entering group authorize for
request 20<BR> modcall[authorize]: module "preprocess" returns ok for
request 20<BR> modcall[authorize]: module "chap" returns noop for request
20<BR> modcall[authorize]: module "mschap" returns noop for request
20<BR> rlm_realm: No <A href="mailto:'@'">'@'</A> in User-Name
= "host/boytel2883.campus.bridgew.edu", looking up realm
NULL<BR> rlm_realm: No such realm "NULL"<BR>
modcall[authorize]: module "suffix" returns noop for request 20<BR>
rlm_eap: EAP packet type response id 8 length 38<BR> rlm_eap: No EAP
Start, assuming it's an on-going EAP conversation<BR> modcall[authorize]:
module "eap" returns updated for request 20<BR> users: Matched
entry DEFAULT at line 152<BR> users: Matched entry DEFAULT at
line 171<BR> modcall[authorize]: module "files" returns ok for request
20<BR>modcall: group authorize returns updated for request 20<BR>
rad_check_password: Found Auth-Type EAP<BR>auth: type "EAP"<BR>
Processing the authenticate section of radiusd.conf<BR>modcall: entering group
authenticate for request 20<BR> rlm_eap: Request found, released from the
list<BR> rlm_eap: EAP/peap<BR> rlm_eap: processing type
peap<BR> rlm_eap_peap: Authenticate<BR> rlm_eap_tls: processing
TLS<BR> eaptls_verify returned 7<BR> rlm_eap_tls: Done initial
handshake<BR> eaptls_process returned 7<BR> rlm_eap_peap:
EAPTLS_OK<BR> rlm_eap_peap: Session established. Decoding tunneled
attributes.<BR> rlm_eap_peap: Received EAP-TLV response.<BR>
rlm_eap_peap: Tunneled data is valid.<BR> rlm_eap_peap: Had sent TLV
failure, rejecting.<BR> rlm_eap: Handler failed in EAP/peap<BR>
rlm_eap: Failed in EAP select<BR> modcall[authenticate]: module "eap"
returns invalid for request 20<BR>modcall: group authenticate returns invalid
for request 20<BR>auth: Failed to validate the user.<BR>Login incorrect:
[host/boytel2883.campus.bridgew.edu] (from client BUWiSM-2-2 port 29 cli
00-90-96-F4-2A-BB)<BR>Delaying request 20 for 1 seconds<BR>Finished request
20<BR><BR></DIV></FONT></SPAN></BODY></HTML>