<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Hi All,<div><br></div><div>I'm trying to configure Freeradius Active Directory Authentication using ntlm_auth.</div><div><font size="3">When I run from the shell I could get the </font>positive<font size="3"> response.</font></div><div><span style="font-size: 12pt;"><br></span></div><div><span style="font-size: 12pt;"><i>ntlm_auth --username shyju --password</i></span></div><div><div><i>Password:</i></div><div><i>NT_STATUS_OK: Success (0x0)</i></div><div><br></div><div>But when I test with the radtest authentication does not work. Please Find below the logs.</div><div><br></div><div><br></div><div><br></div><div><b>Client - Side</b></div><div><div><i>radtest shyju password localhost 0 testing123</i></div></div><div><i><br></i></div><div><div><i>Sending Access-Request of id 125 to 127.0.0.1 port 1812</i></div><div><i> User-Name = "shyju"</i></div><div><i> User-Password = "password"</i></div><div><i> NAS-IP-Address = 127.0.1.1</i></div><div><i> NAS-Port = 0</i></div><div><i> Message-Authenticator = 0x00000000000000000000000000000000</i></div><div><i>rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=125, length=20</i></div></div><div><br></div><div><br></div><div><b>Server-Side</b></div><div><br></div><div><div>rad_recv: Access-Request packet from host 127.0.0.1 port 60581, id=253, length=131</div><div> User-Name = "shyju"</div><div> NAS-IP-Address = 127.0.1.1</div><div> NAS-Port = 0</div><div> Message-Authenticator = 0x0156cd3b06a063bf8c9dee41dca40c37</div><div> MS-CHAP-Challenge = 0x3b41e041947f5126</div><div> MS-CHAP-Response = 0x00010000000000000000000000000000000000000000000000003d43a50a42ac1c73b4beeab62bfba628013e7764d8651047</div><div># Executing section authorize from file /etc/freeradius/sites-enabled/default</div><div>+- entering group authorize {...}</div><div>++[preprocess] returns ok</div><div>++[chap] returns noop</div><div>[mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap'</div><div>++[mschap] returns ok</div><div>++[digest] returns noop</div><div>[suffix] No '@' in User-Name = "shyju", looking up realm NULL</div><div>[suffix] No such realm "NULL"</div><div>++[suffix] returns noop</div><div>[eap] No EAP-Message, not doing EAP</div><div>++[eap] returns noop</div><div>++[files] returns noop</div><div>++[expiration] returns noop</div><div>++[logintime] returns noop</div><div>[pap] WARNING! No "known good" password found for the user. Authentication may fail because of this.</div><div>++[pap] returns noop</div><div>Found Auth-Type = MSCHAP</div><div># Executing group from file /etc/freeradius/sites-enabled/default</div><div>+- entering group MS-CHAP {...}</div><div>[mschap] Told to do MS-CHAPv1 with NT-Password</div><div>[mschap] expand: %{Stripped-User-Name} -></div><div>[mschap] ... expanding second conditional</div><div>[mschap] expand: %{User-Name} -> shyju</div><div>[mschap] expand: %{%{User-Name}:-None} -> shyju</div><div>[mschap] expand: --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} -> --username=shyju</div><div>[mschap] No NT-Domain was found in the User-Name.</div><div>[mschap] expand: %{mschap:NT-Domain} -></div><div>[mschap] ... expanding second conditional</div><div>[mschap] expand: --domain=%{%{mschap:NT-Domain}:-DOMAIN.LOCAL} -> --domain=DOMAIN.LOCAL</div><div>[mschap] mschap1: 3b</div><div>[mschap] expand: %{mschap:Challenge} -> 3b41e041947f5126</div><div>[mschap] expand: --challenge=%{%{mschap:Challenge}:-00} -> --challenge=3b41e041947f5126</div><div>[mschap] expand: %{mschap:NT-Response} -> 3d43a50a42ac1c73b4beeab62bfba628013e7764d8651047</div><div>[mschap] expand: --nt-response=%{%{mschap:NT-Response}:-00} -> --nt-response=3d43a50a42ac1c73b4beeab62bfba628013e7764d8651047</div><div>Exec-Program output: Reading winbind reply failed! (0xc0000001)</div><div>Exec-Program-Wait: plaintext: Reading winbind reply failed! (0xc0000001)</div><div>Exec-Program: returned: 1</div><div>[mschap] External script failed.</div><div>[mschap] MS-CHAP-Response is incorrect.</div><div>++[mschap] returns reject</div><div>Failed to authenticate the user.</div><div>Using Post-Auth-Type Reject</div><div># Executing group from file /etc/freeradius/sites-enabled/default</div><div>+- entering group REJECT {...}</div><div>[attr_filter.access_reject] expand: %{User-Name} -> shyju</div><div>attr_filter: Matched entry DEFAULT at line 11</div><div>++[attr_filter.access_reject] returns updated</div><div>Delaying reject of request 2 for 1 seconds</div><div>Going to the next request</div><div>Waking up in 0.8 seconds.</div><div>Sending delayed reject for request 2</div><div>Sending Access-Reject of id 253 to 127.0.0.1 port 60581</div><div> MS-CHAP-Error = "\000E=691 R=1"</div><div>Waking up in 4.9 seconds.</div><div>Cleaning up request 2 ID 253 with timestamp +73</div><div>Ready to process requests.</div></div><div><br></div><div><br></div><br><font face="Franklin Gothic Medium">_______<br>
Regards,<br>
<strong>Shyju</strong></font><br></div> </div></body>
</html>