<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7654.12">
<TITLE>Talking to Windows 2003 AD</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P DIR=LTR><SPAN LANG="en-gb"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">Firstly I am new to FreeRadius and am configuring my first radius server to talk to our Windows 2003 AD.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">I have i</FONT><FONT FACE="Calibri">ntalled and configured </FONT> <FONT FACE="Calibri">FreeRadius 2.1.8 to talk to the AD as documented in various tutorials on the int</FONT><FONT FACE="Calibri">ernet.</FONT></SPAN><SPAN LANG="en-gb"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">Initially I had configured the connection between the Freeradius server and our Windows 2003 Active directory using ntlm_auth.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Using the command line</FONT></SPAN><SPAN LANG="en-gb"></SPAN><SPAN LANG="en-us"> </SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"></SPAN><SPAN LANG="en-gb"> <FONT SIZE=2 FACE="Courier New">ntlm_auth –-request-nt-key –-domain=<your domain> –-username= <your username></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"></SPAN><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">comes back with </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"></SPAN><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Courier New">NT_STATUS_OK : Success (0x0)</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"></SPAN><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">Which is what i would expect as a valid username and password.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"></FONT> <FONT FACE="Calibri">Now when I go to the next step and enable this in /etc/raddb/modules/mschap</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri"> ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username==%{%{Stripped-User-Name}:-%{User-Name:-None}} --domain=%{%{mschap:NT-Domain}:-</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri">OURDOMAIN</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri">} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"</FONT></SPAN><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">Our active directory server does comes back with an error. When I look at the server log on our AD it shows</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">Event Type: Failure Audit</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">Event Source: Security</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">Event Category: Account Logon </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">Event ID: 680</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">Date: 17/03/2010</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">Time: 13:35:51</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">User: NT AUTHORITY\SYSTEM</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">Computer: DCB</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">Description:</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri"> Logon account: =</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri"><radius_user></FONT></SPAN><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri"> Source Workstation: </FONT></SPAN><SPAN LANG="en-gb"> <FONT FACE="Calibri">\\</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri"><radius_server></FONT></SPAN><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri"> Error Code: 0xC0000064</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">When I google the windows error code I get</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">Error code: 0xC0000064 - This error code can occur if a server is configured to Require NTLMv2 Session Security and the client either is configured to not use it or is unable to negotiate it (e.g., Altiris DOS network boot stuff).</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">I know our server is configured for NTLMv2 and not V1.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">Any ideas on how I can resolve this issue ?</FONT></SPAN><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">I can</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri">no</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri">t understand why running the command works and using the line in MSCHAP fails ?</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"></SPAN></P>
<BR>
______________________________________________________<BR>
SCRI, Invergowrie, Dundee, DD2 5DA. <BR>
The Scottish Crop Research Institute is a charitable company limited by guarantee. <BR>
Registered in Scotland No: SC 29367.<BR>
Recognised by the Inland Revenue as a Scottish Charity No: SC 006662.<BR>
<BR>
<BR>
DISCLAIMER:<BR>
<BR>
This email is from the Scottish Crop Research Institute, but the views expressed by the sender are not necessarily the views of SCRI and its subsidiaries. This email and any files transmitted with it are confidential to the intended recipient at the e-mail address to which it has been addressed. It may not be disclosed or used by any other than that<BR>
addressee.<BR>
If you are not the intended recipient you are requested to preserve this confidentiality and you must not use, disclose, copy, print or rely on this e-mail in any way. Please notify postmaster@scri.ac.uk quoting the name of the sender and delete the email from your system.<BR>
<BR>
Although SCRI has taken reasonable precautions to ensure no viruses are present in this email, neither the Institute nor the sender accepts any responsibility for any viruses, and it is your responsibility to scan the email and the attachments (if any).<BR>
______________________________________________________<BR>
</BODY>
</HTML>