<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=iso-8859-2">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.StylE-mailovZprvy17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=CS link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><span lang=EN-US>Hi, I have working configuration of PPTPD
(Windows VPN) trought Radius to LDAP stored users. The think is ,that it
accepts only plain text stored passwords in ldap becouse of very well known NT-Password
for MSCHAPv2<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US>I figure out there is an option to make it
work with ntlm_auth in mschap configuration in radius.<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>But when I enable it :<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US> #with_ntdomain_hack = yes<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US> # The module can perform
authentication itself, OR<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US> # use a Windows Domain
Controller. This configuration<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US> # directive tells the
module to call the ntlm_auth<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US> # program, which will do
the authentication, and return<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US> # the NT-Key. Note that
you MUST have "winbindd" and<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US> # "nmbd" running
on the local machine for ntlm_auth<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US> # to work. See the
ntlm_auth program documentation<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US> # for details.<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US> #<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US> # Be VERY careful when
editing the following line!<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US> #<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US> ntlm_auth = "/usr/bin/ntlm_auth
--request-nt-key --username=%{Stripped-Use<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>r-Name:-%{User-Name:-None}}
--challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>Response:-00}"<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US> }<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US>I am getting following error :<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US> rad_check_password: Found Auth-Type
MS-CHAP<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>auth: type "MS-CHAP"<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US> Processing the authenticate section of
radiusd.conf<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>modcall: entering group MS-CHAP for request
1<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US> rlm_mschap: Told to do MS-CHAPv2 for boss
with NT-Password<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>radius_xlat: Running registered xlat
function of module mschap for string 'Challenge'<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US> mschap2: 6b<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>radius_xlat: Running registered xlat
function of module mschap for string 'NT-Response'<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>radius_xlat: '/usr/bin/ntlm_auth
--request-nt-key --username=boss --challenge=09c34801a6bafab3
--nt-response=e9aa9365702850c20847566b84c4c729efbac9d014ff1301'<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>Exec-Program: /usr/bin/ntlm_auth
--request-nt-key --username=boss --challenge=09c34801a6bafab3
--nt-response=e9aa9365702850c20847566b84c4c729efbac9d014ff1301<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>Exec-Program output:
NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) <o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>Exec-Program-Wait: plaintext:
NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) <o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>Exec-Program: returned: 1<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US> rlm_mschap: External script failed.<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US> rlm_mschap: FAILED: MS-CHAP2-Response is
incorrect<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US> modcall[authenticate]: module
"mschap" returns reject for request 1<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US>But I am not sending a domain trought VPN
connection (I have it clear). I have also tried #with_ntdomain_hack = yes<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>But without result.<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US>Please help me,<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US>David<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
</div>
</body>
</html>