<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>
hello all,<div><br></div><div>I am always getting this error, when I am trying to authenticate user against Active Directory </div><div><br></div><div><div>ad_recv: Access-Request packet from host 127.0.0.1 port 54512, id=249, length=151</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Service-Type = Framed-User</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Framed-Protocol = PPP</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>User-Name = "harry"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>MS-CHAP-Challenge = 0x7437d73ff6b61e500d046b77a88ecf34</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>MS-CHAP2-Response = 0x3f0098a0a16cb193cbb58c495977aa125765000000000000000073a5f468c08966d100e3963f8763bcb764d450f23800cade</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Calling-Station-Id = "192.168.1.1"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>NAS-IP-Address = 192.168.2.3</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>NAS-Port = 0</div><div># Executing section authorize from file /etc/raddb/sites-enabled/default</div><div>+- entering group authorize {...}</div><div>++[preprocess] returns ok</div><div>++[chap] returns noop</div><div>[mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap'</div><div>++[mschap] returns ok</div><div>++[digest] returns noop</div><div>[suffix] No '@' in User-Name = "harry", looking up realm NULL</div><div>[suffix] No such realm "NULL"</div><div>++[suffix] returns noop</div><div>[eap] No EAP-Message, not doing EAP</div><div>++[eap] returns noop</div><div>[files] users: Matched entry DEFAULT at line 172</div><div>++[files] returns ok</div><div>++[expiration] returns noop</div><div>++[logintime] returns noop</div><div><span style="font-size: 10pt; ">[mschap] No Cleartext-Password configured. Cannot create LM-Password.</span></div></div><div><div>[mschap] No Cleartext-Password configured. Cannot create NT-Password.</div><div>[mschap] Creating challenge hash with username: harry</div><div>[mschap] Told to do MS-CHAPv2 for harry with NT-Password</div><div>[mschap] FAILED: No NT/LM-Password. Cannot perform authentication.</div><div>[mschap] FAILED: MS-CHAP2-Response is incorrect</div></div><div><br></div><div>Pacakages I have installed.</div><div><div>samba.x86_64</div><div>samba-client.x86_64</div><div>samba-common.x86_64 </div><div>samba-winbind.x86_64 </div><div>samba-winbind-clients.x86_64 </div><div><span style="font-size: 10pt; ">freeradius.x86_64</span></div><div>radiusclient-ng-0.5.6-5.el6.x86_64</div><div><br></div></div><div>My /etc/pptp/option.pptpd is :</div><div><br></div><div><div>name pptpd</div></div><div><div>refuse-pap</div><div>refuse-chap</div><div>refuse-mschap</div></div><div><div>require-mschap-v2</div></div><div>require-mppe-128</div><div><div>ms-dns 10.1.1.1</div><div><span style="font-size: 10pt; ">proxyarp</span></div></div><div>debug</div><div>lock</div><div>nobsdcomp</div><div>novj</div><div>novjccomp</div><div>nologfd</div><div>auth</div><div>nodefaultroute</div><div>plugin winbind.so</div><div><div>#ntlm_auth-helper "/usr/bin/ntlm_auth --helper-protocol=ntlm-server-1"</div></div><div><span style="font-size: 10pt; ">plugin radius.so</span></div><div>plugin radattr.so</div><div><br></div><div>And in /etc/radd/modules/mschap i have following </div><div>mschap {</div><div> <span style="font-size: 10pt; "> use_mppe = yes</span></div><div> <span style="font-size: 10pt; "> require_encryption =yes</span></div><div><div> require_strong = yes</div><div><span style="font-size: 10pt; "> </span><span style="font-size: 10pt; "> #with_ntdomain_hack = yes</span></div><div><span style="font-size: 10pt; ">ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-none}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"</span></div></div><div>}</div><div><br></div><div><span style="font-size: 10pt; ">AD connection is working well, if I do wbinfo -u it returns users from the AD. Both samba, nmb and winbind services are running. If I use only winbind without radius plugin it work but when I try to use radius plugin it complains the error I mentioned above. </span></div><div><br></div><div>I have following this :</div><div><a href="http://wiki.freeradius.org/PopTop#Setting-up-the-Poptop-server">http://wiki.freeradius.org/PopTop#Setting-up-the-Poptop-server</a></div><div><br></div><div>and this one :</div><div><a href="http://www.members.optushome.com.au/~wskwok/poptop_ads_howto_8.htm">http://www.members.optushome.com.au/~wskwok/poptop_ads_howto_8.htm</a></div><div><br></div><div>All I am doing here is have a pptp server use radius and Active directory for authentication. I use freeraius so that I can do IP pool and other stuff. </div><div><br></div><div>Any help or right direction would be great.</div><div><br></div><div><br></div> </div></body>
</html>