<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Has anyone gotten freeradius EAP-MSCHAPV2 authentication to work properly in samba versions beyond 3.0.30? On samba 3.3.8 I still get the same type of error I’d get as if I didn’t have the xpextensions on my cert (Even though I do.) No
response to access-challenge. If I go back to 3.0.30 it immediately works….Starting to run into a problem because 3.0.30 won’t work will 2008 r2 domain controllers. Again my cert does have the xpextensions. And it does this to all clients,, not just Microsoft.
Here’s the end of my debug:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">[mschap] expand: --username=%{mschap:User-Name:-None} -> --username=tomtom<o:p></o:p></p>
<p class="MsoNormal">[mschap] expand: %{mschap:NT-Domain} -> ADS<o:p></o:p></p>
<p class="MsoNormal">[mschap] expand: --domain=%{%{mschap:NT-Domain}:-ADS} -> --domain=ADS<o:p></o:p></p>
<p class="MsoNormal">[mschap] mschap2: d3<o:p></o:p></p>
<p class="MsoNormal">[mschap] Creating challenge hash with username: tomtom<o:p></o:p></p>
<p class="MsoNormal">[mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=ba19d84bdab789ef<o:p></o:p></p>
<p class="MsoNormal">[mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=27a757e4b32c51011216ac7fff78219563fc14af067f3d05<o:p></o:p></p>
<p class="MsoNormal">Exec-Program output: NT_KEY: D988C0C63F2D4C8034172DCBEB7B317F
<o:p></o:p></p>
<p class="MsoNormal">Exec-Program-Wait: plaintext: NT_KEY: D988C0C63F2D4C8034172DCBEB7B317F
<o:p></o:p></p>
<p class="MsoNormal">Exec-Program: returned: 0<o:p></o:p></p>
<p class="MsoNormal">[mschap] adding MS-CHAPv2 MPPE keys<o:p></o:p></p>
<p class="MsoNormal">++[mschap] returns ok<o:p></o:p></p>
<p class="MsoNormal">MSCHAP Success <o:p></o:p></p>
<p class="MsoNormal">++[eap] returns handled<o:p></o:p></p>
<p class="MsoNormal">} # server inner-tunnel<o:p></o:p></p>
<p class="MsoNormal">[peap] Got tunneled reply code 11<o:p></o:p></p>
<p class="MsoNormal"> EAP-Message = 0x010c00331a030b002e533d33333133453034393739353130383137303633423342413033324339383343383832413937323736<o:p></o:p></p>
<p class="MsoNormal"> Message-Authenticator = 0x00000000000000000000000000000000<o:p></o:p></p>
<p class="MsoNormal"> State = 0x3f8a0cb23e86164f4ea2f66ef66aa4ed<o:p></o:p></p>
<p class="MsoNormal">[peap] Got tunneled reply RADIUS code 11<o:p></o:p></p>
<p class="MsoNormal"> EAP-Message = 0x010c00331a030b002e533d33333133453034393739353130383137303633423342413033324339383343383832413937323736<o:p></o:p></p>
<p class="MsoNormal"> Message-Authenticator = 0x00000000000000000000000000000000<o:p></o:p></p>
<p class="MsoNormal"> State = 0x3f8a0cb23e86164f4ea2f66ef66aa4ed<o:p></o:p></p>
<p class="MsoNormal">[peap] Got tunneled Access-Challenge<o:p></o:p></p>
<p class="MsoNormal">++[eap] returns handled<o:p></o:p></p>
<p class="MsoNormal">Sending Access-Challenge of id 17 to 172.20.4.253 port 32769<o:p></o:p></p>
<p class="MsoNormal"> EAP-Message = 0x010c005b19001703010050e5f53b91a3b5214c1a0f1ee21b46045f6992732a92d882e4359ed17b1dfffcb69d20d4645caa74a94ea448cd54c76c041c642d05801fa0a4f830247b30f9723884d6fbaa35f6b11398741f833bc68f08<o:p></o:p></p>
<p class="MsoNormal"> Message-Authenticator = 0x00000000000000000000000000000000<o:p></o:p></p>
<p class="MsoNormal"> State = 0xedeb59b2eae740f09f949186981dc8bc<o:p></o:p></p>
<p class="MsoNormal">Finished request 10.<o:p></o:p></p>
<p class="MsoNormal">Going to the next request<o:p></o:p></p>
<p class="MsoNormal">Waking up in 4.7 seconds.<o:p></o:p></p>
<p class="MsoNormal">Cleaning up request 3 ID 10 with timestamp +11<o:p></o:p></p>
<p class="MsoNormal">Cleaning up request 4 ID 11 with timestamp +11<o:p></o:p></p>
<p class="MsoNormal">Cleaning up request 5 ID 12 with timestamp +11<o:p></o:p></p>
<p class="MsoNormal">Cleaning up request 6 ID 13 with timestamp +11<o:p></o:p></p>
<p class="MsoNormal">Cleaning up request 7 ID 14 with timestamp +11<o:p></o:p></p>
<p class="MsoNormal">Cleaning up request 8 ID 15 with timestamp +11<o:p></o:p></p>
<p class="MsoNormal">Waking up in 0.1 seconds.<o:p></o:p></p>
<p class="MsoNormal">Cleaning up request 9 ID 16 with timestamp +11<o:p></o:p></p>
<p class="MsoNormal">Cleaning up request 10 ID 17 with timestamp +11<o:p></o:p></p>
<p class="MsoNormal">WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!<o:p></o:p></p>
<p class="MsoNormal">WARNING: !! EAP session for state 0xedeb59b2eae740f0 did not finish!<o:p></o:p></p>
<p class="MsoNormal">WARNING: !! Please read <a href="http://wiki.freeradius.org/Certificate_Compatibility">
http://wiki.freeradius.org/Certificate_Compatibility</a><o:p></o:p></p>
<p class="MsoNormal">WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thomas E. Casartello, Jr.<o:p></o:p></p>
<p class="MsoNormal">Staff Assistant - Wireless/Linux Administrator<o:p></o:p></p>
<p class="MsoNormal">Information Technology<o:p></o:p></p>
<p class="MsoNormal">Wilson 105A<o:p></o:p></p>
<p class="MsoNormal">Westfield State College<o:p></o:p></p>
<p class="MsoNormal">(413) 572-8245<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Red Hat Certified Technician (RHCT)<o:p></o:p></p>
<p class="MsoNormal">Cisco Certified Network Associate (CCNA)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>