January 2018 - Freeradius-Users - lists.freeradius.org

Compilation Warning - FreeRadius 3.0.16
by Andrea Mucci 01 Jun '18

01 Jun '18

Hi All, we downloaded the source software freeradius 3.0.16 from: git clone https://github.com/FreeRADIUS/freeradius-server.git cd freeradius-server git checkout release_3_0_16 The OS is RHEL 7.4. We will use freeRadius with Oracle 12 DataBase. We compiled with this enviroment variable seting export LD_LIBRARY_PATH=/usr/lib/oracle/12.2/client64/lib:/usr/lib:/usr/lib64 export ORACLE_HOME=/usr/include/oracle/12.2/client64 We had this WARNING: configure: WARNING: securid headers not found. Use --with-rlm-securid-include-dir=<path>. checking for SD_Init in -laceclnt... no checking for SD_Init in -laceclnt in /usr/local/lib... no checking for SD_Init in -laceclnt in /opt/lib... no configure: WARNING: securid libraries not found. Use --with-rlm-securid-lib-dir=<path>. configure: WARNING: silently not building rlm_securid. configure: WARNING: FAILURE: rlm_securid requires: acexport.h libaceclnt. configure: WARNING: silently not building rlm_opendirectory. configure: WARNING: FAILURE: rlm_opendirectory requires: membership.h. configure: WARNING: Oracle version >= 12 needs -laio We would like to know if these warnings can generate incorrect behavior of the software. Thanks Andrea

4 4

is there a way to identify the very first ACCESS-REQUEST
by Michael Hocke 16 Mar '18

16 Mar '18

Hi there, I want to improve our logging and want to keep track of authentication attempts that do not complete. I was thinking of logging the very first ACCESS-REQUEST and then later on the result. Is there a good way to identify the very first ACCESS-REQUEST from the client with unlang? Maybe by checking the contents of the session-state list or some such? Any ideas? Thanks! - Michael

4 6

Cisco-AVPair regex
by Kylián Martin 23 Feb '18

23 Feb '18

Hi all, I'm trying to save some of the Cisco-AVPair attributes into sql while acounting. Specifically, I'm interested in the dhcp-options and http-tlv attributes. WLC describes the connected device in these. Unfortunately, Freeradius 3.12 expands these values unregexable way. (With_cisco_vsa_hack = yes in preprocess the result is the same) Correctly expanded is just Cisco-AVPair = "audit-session-id=1ef1a8c000014809cba76859" Policy file: device_regex = '^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)' () fill_device_type { if (&Cisco-AVPair) { foreach &Cisco-AVPair { if ("%{Foreach-Variable-0}" =~ /${policy.device_regex}/i) { update request { &Calling-Device += "%{8} " } } } } } Processing: (98) Received Accounting-Request Id 28 from 192.168.241.30:57614 to 172.31.12.101:1813 length 482 (98) User-Name = "martin" (98) NAS-Port = 8 (98) NAS-IP-Address = 192.168.241.30 (98) Framed-IP-Address = 10.252.136.9 (98) Framed-IPv6-Prefix = 2a07:8d84:800:325f::/64 (98) Framed-IPv6-Prefix = 2a07:8d84:800:325f::/64 (98) Framed-IPv6-Prefix = 2a07:8d84:800:325f::/64 (98) Framed-IPv6-Prefix = 2a07:8d84:800:325f::/64 (98) Framed-IPv6-Prefix = 2a07:8d84:800:325f::/64 (98) Framed-IPv6-Prefix = fe80::/64 (98) NAS-Identifier = "d4-wlc5520" (98) Airespace-Wlan-Id = 20 (98) Acct-Session-Id = "5968a7cb/34:ab:37:ed:a2:bb/90671" (98) NAS-Port-Type = Wireless-802.11 (98) Cisco-AVPair = "audit-session-id=1ef1a8c000014809cba76859" (98) Acct-Authentic = RADIUS (98) Tunnel-Type:0 = VLAN (98) Tunnel-Medium-Type:0 = IEEE-802 (98) Tunnel-Private-Group-Id:0 = "595" (98) Event-Timestamp = "Jul 14 2017 14:47:01 CEST" (98) Cisco-AVPair = "dhcp-option=\000\014\000\0056spMK" (98) Cisco-AVPair = "http-tlv=\000\001\000\030iPhone8,2/10.3.2 (14F89)" How to regex these ? (98) Acct-Status-Type = Interim-Update (98) Acct-Input-Octets = 699538 (98) Acct-Input-Gigawords = 0 (98) Acct-Output-Octets = 2957172 (98) Acct-Output-Gigawords = 0 (98) Acct-Input-Packets = 5974 (98) Acct-Output-Packets = 5319 (98) Acct-Session-Time = 5494 (98) Acct-Delay-Time = 0 (98) Calling-Station-Id = "34-ab-37-ed-a2-bb" (98) Called-Station-Id = "d4-air1702-ap-1:UI MK tst" (98) # Executing section preacct from file /etc/freeradius/3.0/sites-enabled/default (98) preacct { (98) [preprocess] = ok (98) policy rewrite_called_station_id { (98) if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) { (98) if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) -> FALSE (98) elsif (&Called-Station-Id && (&Called-Station-Id =~ /^(.+)(:){1}((.+))?$/i)) { (98) elsif (&Called-Station-Id && (&Called-Station-Id =~ /^(.+)(:){1}((.+))?$/i)) -> TRUE (98) elsif (&Called-Station-Id && (&Called-Station-Id =~ /^(.+)(:){1}((.+))?$/i)) { (98) update request { (98) EXPAND %{1} (98) --> d4-air1702-ap-1 (98) &Called-Station-Id := d4-air1702-ap-1 (98) EXPAND %{3} (98) --> UI MK tst (98) &Called-Station-SSID := UI MK tst (98) } # update request = noop (98) [updated] = updated (98) } # elsif (&Called-Station-Id && (&Called-Station-Id =~ /^(.+)(:){1}((.+))?$/i)) = updated (98) ... skipping else: Preceding "if" was taken (98) } # policy rewrite_called_station_id = updated (98) policy fill_device_type { (98) if (&Cisco-AVPair) { (98) if (&Cisco-AVPair) -> TRUE (98) if (&Cisco-AVPair) { (98) foreach &Cisco-AVPair (98) if ("%{Foreach-Variable-0}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)/i) { (98) EXPAND Foreach-Variable-0 (98) --> audit-session-id=1ef1a8c000014809cba76859 (98) EXPAND %{Foreach-Variable-0} (98) --> audit-session-id=1ef1a8c000014809cba76859 (98) if ("%{Foreach-Variable-0}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)/i) -> FALSE (98) if ("%{Foreach-Variable-0}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)/i) { (98) EXPAND Foreach-Variable-0 (98) --> dhcp-option= (98) EXPAND %{Foreach-Variable-0} (98) --> dhcp-option= (98) if ("%{Foreach-Variable-0}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)/i) -> FALSE (98) if ("%{Foreach-Variable-0}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)/i) { (98) EXPAND Foreach-Variable-0 (98) --> http-tlv= (98) EXPAND %{Foreach-Variable-0} (98) --> http-tlv= Both attributes are expanded till first whitespace char (98) if ("%{Foreach-Variable-0}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)/i) -> FALSE (98) } # foreach &Cisco-AVPair = updated (98) } # if (&Cisco-AVPair) = updated How to get text values following whitespaces? I've already tried if ("unescape:%{Foreach-Variable-0}" =~ /${policy.device_regex}/i) with no luck Martin Kylián

4 11

cisco phones
by Vacheslav 12 Feb '18

12 Feb '18

Peace, I still can't authenticate the ip phones using md5 on the voice vlan, they keep getting authenticated on the data vlan. I ducked ducked the internet and found that: "device-traffic-class=voice:= Cisco-AVPair" Must be added. So I added it username of the ip phone in daloradius but the behavior has not changed. Perhaps, that must be added manually to the users file for it work. I only found documentation on how to do that in cisco ACS.

7 25

different user file for virtual server
by Matus UHLAR - fantomas 05 Feb '18

05 Feb '18

Hello, I'm configuring freeradius 2.2.5 (debian 8) I need to define two different user files for two virtual hosts - different types of users for different types of services. I have tried to follow docs and set up: modules/files: files files_netdev { usersfile = ${confdir}/users_netdev } from default and example virtual host I have created: sites-enabled/virtual_netdev: listen { type = auth port = 1822 virtual_server = virtual_netdev } server virtual_netdev { authorize { preprocess files_netdev chap mschap digest netdev expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } digest } } however the log file tells me: Thu Jan 25 13:48:54 2018 : Error: /etc/freeradius/sites-enabled/virtual_netdev[10]: Failed to find "files_netdev" in the "modules" section. Thu Jan 25 13:48:54 2018 : Error: /etc/freeradius/sites-enabled/virtual_netdev[8]: Errors parsing authorize section. Thu Jan 25 13:48:54 2018 : Error: Failed to load virtual server virtual_netdev any hint what is the mistake I did? Thank you -- Matus UHLAR - fantomas, uhlar(a)fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. Fighting for peace is like fucking for virginity...

2 4

Freeradius dhcp module configuration
by Daniel Ryšlink 05 Feb '18

05 Feb '18

Hello, First of all, I apologize for anything wrong in my approach or method (there is probably plenty), but my time is running short and so I come here to ask for advice. I am trying to setup a Freeradius server with a DHCP virtual server. An example from my users file: Gi0/19:10.010B465454582D535749544348 Cleartext-Password := "juniper-bng1" ERX-Ingress-Policy-Name := FF-1M, ERX-CoS-Shaping-Pmt-Type = "T02 2m", ERX-Cos-Scheduler-Pmt-Type = "VOIP-SCH T10 100k", Framed-IP-Address := 10.10.100.150 Gi0/20:10.010b465454582d535749544348 Cleartext-Password := "juniper-bng1", Pool-Name := "hohola" ERX-Ingress-Policy-Name := FF-1M, ERX-CoS-Shaping-Pmt-Type = "T02 2m", ERX-Cos-Scheduler-Pmt-Type = "VOIP-SCH T10 100k" There are two types of users - those who have a static IP set via the Framed-IP-Address as shown in the example above, and those who get their IP from the pool called "hohola" - for this purpose, I set up the ippool module: ippool hohola { filename = ${db_dir}/db.ippool range_start = 10.10.100.5 range_stop = 10.10.100.254 netmask = 255.255.255.0 cache_size = 800 ip_index = ${db_dir}/db.ipindex override = no maximum_timeout = 0 key = "%{ADSL-Agent-Circuit-Id}%{DHCP-Relay-Circuit-Id}%{ADSL-Agent-Remote-Id}%{DHCP-Relay-Remote-Id}" } The idea behind the "key" line is that the user should be identified by both the combination of Circuit-ID and Remote-ID (Option 82), and ADSL-Agent-Circuit-Id and ADSL-Agent-Remote-Id are present in the Radius packet but absent from the DHCP packet, but DHCP-Relay-Circuit-Id and DHCP-Relay-Remote-Id are present in the DHCP packet and absent from the Radius packet. Thus, no matter if the pool is called by the Radius or the DHCP virtual server, this line always expand to the same key for a given user. I have read in the docs that there is the DHCP configuration (mods-available/dhcp) file that allows to "decode the Option 82 values", but I did not manage to get it working since there is no working example in the documentation, and I could not even google one up. My questions: 1) If the address is in the static Framed-IP-Address in the users (files/authorize) file, how do I tell the DHCP server to use it for the given user via the ippool module when the DHCP request comes? 2) When assigning a dynamic address from the 'hohola' pool, I managed to get it working, but the Radius assigns one address and creates an entry in the ippool database, and then the DHCP server discovers that for a given key there is already an entry, but decides it is "stale", and assigns another IP address. Any advice would be most welcome, thank you in advance. -- S pozdravem, Daniel Ryšlink System Administrator Dial Telecom a. s. Křižíkova 36a/237 186 00 Praha 3, Česká Republika Tel.:+420.226204627 daniel.ryslink(a)dialtelecom.cz ----------------------------------------------- www.dialtelecom.cz Dial Telecom, a.s. Jednoduše se připojte -----------------------------------------------

3 3

BYOD and base on MAC
by Luc Paulin 01 Feb '18

01 Feb '18

Hi, I know that we can do a BYOD wireless setup with freeradius base on if the client setup was setup with certificate(EAP-TLS) or not by checking the EAP-Type field. But I was wondering would it be possible to do it base on MAC adresse. The idea here is that we would like to move user to the appropriate vlan base on his device mac. If MAC address is within that list, device is granted to the corp vlan, else it'll default to the BYOD vlan. In the post-auth section I did add some lines in order to try do the check base on mac addresse ======== # We rewrite calling_station_id in order to do mac checkup rewrite_calling_station_id # Check against the authorized_macs file authorized_macs if (!ok) { update reply { Tunnel-Type := 13 Tunnel-Medium-Type := 6 Tunnel-Private-Group-Id := 155 } } else { update reply { Tunnel-Type := 13 Tunnel-Medium-Type := 6 Tunnel-Private-Group-Id := 157 } } ======== However look like the authorized_macs always return noop. Am I doing something wrong or something not supported? Thanx !! -- !!!!! ( o o ) --------------oOO----(_)----OOo-------------- Luc Paulin email: paulinster(at)gmail.com Skype: paulinster

3 11

Can't use winbind in 3.0.16
by Jonathan Gazeley 01 Feb '18

01 Feb '18

I have just started upgraded from 3.0.15 to 3.0.16 (the latter being installed directly from http://packages.networkradius.com/centos/7/repo/) I now cannot start up the daemon and in debug mode it fails : radiusd -X ... # Instantiating module "eduroammschap" from file /etc/raddb/mods-enabled/eduroammschap /etc/raddb/mods-enabled/eduroammschap[10]: 'winbind' auth not enabled at compiled time /etc/raddb/mods-enabled/eduroammschap[10]: Instantiation failed for module "eduroammschap" My eduroammschap module is configured to use a winbind handle rather than a call to ntlm_auth, as recommend by Matthew Newton a while ago. [jg4461@radius-dev ~]$ cat /etc/raddb/mods-enabled/eduroammschap | grep -v '#' mschap eduroammschap { winbind_username = "%{%{Stripped-User-Name}:-%{eduroammschap:User-Name}}" winbind_domain = "%{eduroammschap:NT-Domain}" pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 retry_delay = 30 lifetime = 86400 cleanup_interval = 300 idle_timeout = 600 } passchange { } allow_retry = no retry_msg = "Verify username and re-enter your password" } I've been building the RPM myself from the official tarball + spec file up until now, but is the official RPM built differently? Thanks, Jonathan

5 8

Acctstoptime same as acctstarttime
by Yahn do Amaral Almeida Pinheiro 01 Feb '18

01 Feb '18

Hello, I'm using FreeRadius 2.1.12 and I gotta a database problem with the user connection registry. Can you help me? When the connection is registered, the acctstoptime field is filled with the same content from the acctstarttime field, the user doesn't loose connection but radius fills the field like it lost at the same time it started. However, when the user actually looses connection, the field gets updated to the right actual time. As of now, I can't update my FreeRadius since it's the one being used for the clients and it can't stop at any time then. Thank you in advance.

2 2

Debian 9 - Samba 4.5.12 - Freeradius 3.02 ntlm_auth not working
by Kasandra Padisha 01 Feb '18

01 Feb '18

Hi I have tried everything possible. I have read every publication available and I am about to give up !!! I could not make it work: Radius using ntlm_auth to autenthicate. Details ..: a bit long . apologies :-) --------------------------------- SAMBA --------------------------------- I have samba 4.5.12 working OK ------------------- smb.conf # Global parameters [global] netbios name = GALAPA realm = MINUT.EDU.CO workgroup = MINUT-EXT dns forwarder = 192.168.32.1 server role = active directory domain controller # Autenticaion sin dominio winbind use default domain = no [netlogon] path = /var/lib/samba/sysvol/minut.edu.co/scripts read only = No [sysvol] path = /var/lib/samba/sysvol read only = No ------------------- All tests of samba working OK ------------------- #>> smbclient -L localhost -U% Domain=[MINUT-EXT] OS=[Windows 6.1] Server=[Samba 4.5.12-Debian] Sharename Type Comment --------- ---- ------- netlogon Disk sysvol Disk IPC$ IPC IPC Service (Samba 4.5.12-Debian) Domain=[MINUT-EXT] OS=[Windows 6.1] Server=[Samba 4.5.12-Debian Server Comment --------- ------- Workgroup Master --------- ------- WORKGROUP GALAPA ------------------- #>> root@galapa:/etc/freeradius/3.0# smbclient //localhost/netlogon -Uskina%'Nio4LasOo' -c 'ls' Domain=[MINUT-EXT] OS=[Windows 6.1] Server=[Samba 4.5.12-Debian] . D 0 Tue Jan 30 11:11:29 2018 .. D 0 Tue Jan 30 11:11:48 2018 65799648 blocks of size 1024. 61762632 blocks available #>> ntlm_auth --request-nt-key --domain=MINUT-EXT --username=skina --password='Nio4LasOo' NT_STATUS_OK: Success (0x0) #>> wbinfo --ntlmv2 -a 'skina'%'Nio4LasOo' plaintext password authentication succeeded challenge/response password authentication succeeded # wbinfo -a 'skina'%'Nio4LasOo' plaintext password authentication succeeded challenge/response password authentication failed wbcAuthenticateUserEx(MINUT-EXT\skina): error code was NT_STATUS_WRONG_PASSWORD (0xc000006a) error message was: Wrong Password Could not authenticate user skina with challenge/response ------------------- **** This last message is my only clue. --------------------------------- FREERADIUS --------------------------------- I have installed y configured freeradius following every manual .. First .. the basic configuration .. and working OK http://wiki.freeradius.org/guide/Basic-configuration-HOWTO ------------------- #>> radtest bob hello localhost 0 testing123 Sent Access-Request Id 70 from 0.0.0.0:37544 to 127.0.0.1:1812 length 73 User-Name = "bob" User-Password = "hello" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "hello" Received Access-Accept Id 70 from 127.0.0.1:1812 to 0.0.0.0:0 length 20 Reply-Message = "Hello, bob" ------------------- Second .. configure OK freeradius with ntlm_auth and PAP http://wiki.freeradius.org/guide/NTLM%20Auth%20with%20PAP%20HOWTO ------------------- #>> radtest 'skina' 'Nio4LasOo' localhost 0 testing123 Sent Access-Request Id 14 from 0.0.0.0:34004 to 127.0.0.1:1812 length 75 User-Name = "skina" User-Password = "Nio4Las2Oo" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "Nio4LasOo" Received Access-Accept Id 14 from 127.0.0.1:1812 to 0.0.0.0:0 length 20 ------------------- Third .. tryied to configure freeradius ntlm_auth and MSCHAP http://deployingradius.com/documents/configuration/active_directory.html I have already set all the permissions to user freerad to winbindd_private directory so that not the issue. It does not matter what I do .. I always get the same error .. ------------------- #>> radtest -t mschap 'skina' 'Nio4LasOo' localhost 0 testing123 Sent Access-Request Id 158 from 0.0.0.0:33353 to 127.0.0.1:1812 length 131 User-Name = "skina" MS-CHAP-Password = "Nio4LasOo" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "Nio4LasOo" MS-CHAP-Challenge = 0x59e2a1e585ad94e6 MS-CHAP-Response = 0x00010000000000000000000000000000000000000000000000001eacb1bfed243034f718b74d89b6b11b84af50869ab40b06 Received Access-Reject Id 158 from 127.0.0.1:1812 to 0.0.0.0:0 length 61 MS-CHAP-Error = "\000E=691 R=1 C=c3f65e6f825239e4 V=2" (0) -: Expected Access-Accept got Access-Reject ------------------- And the output of "freeradius -X" ------------------- (2) Received Access-Request Id 57 from 127.0.0.1:34102 to 127.0.0.1:1812 length 131 (2) User-Name = "skina" (2) NAS-IP-Address = 127.0.1.1 (2) NAS-Port = 0 (2) Message-Authenticator = 0xe88750a3ffc2bc75b90b872caf81f7e5 (2) MS-CHAP-Challenge = 0x1fa8d5c8e307ea3f (2) MS-CHAP-Response = 0x000100000000000000000000000000000000000000000000000074102cb712031d37dcb5bda4745b7e918794c4168fa1e5f5 (2) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (2) authorize { (2) policy ntlm_auth.authorize { (2) if (!control:Auth-Type && User-Password) { (2) if (!control:Auth-Type && User-Password) -> FALSE (2) } # policy ntlm_auth.authorize = notfound (2) policy filter_username { (2) if (&User-Name) { (2) if (&User-Name) -> TRUE (2) if (&User-Name) { (2) if (&User-Name =~ / /) { (2) if (&User-Name =~ / /) -> FALSE (2) if (&User-Name =~ /@[^@]*@/ ) { (2) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (2) if (&User-Name =~ /\.\./ ) { (2) if (&User-Name =~ /\.\./ ) -> FALSE (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (2) if (&User-Name =~ /\.$/) { (2) if (&User-Name =~ /\.$/) -> FALSE (2) if (&User-Name =~ /(a)\./) { (2) if (&User-Name =~ /(a)\./) -> FALSE (2) } # if (&User-Name) = notfound (2) } # policy filter_username = notfound (2) [preprocess] = ok (2) [chap] = noop (2) mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' (2) [mschap] = ok (2) [digest] = noop (2) suffix: Checking for suffix after "@" (2) suffix: No '@' in User-Name = "skina", looking up realm NULL (2) suffix: No such realm "NULL" (2) [suffix] = noop (2) eap: No EAP-Message, not doing EAP (2) [eap] = noop (2) [files] = noop (2) [sql] = notfound (2) [expiration] = noop (2) [logintime] = noop (2) } # authorize = ok (2) Found Auth-Type = mschap (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) authenticate { (2) mschap: Client is using MS-CHAPv1 with NT-Password (2) mschap: Executing: /usr/bin/ntlm_auth --allow-mschapv2 --ntlmv2 --request-nt-key --username=%{mschap:User-Name:-None} --domain=MINUT-EXT --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}: (2) mschap: EXPAND --username=%{mschap:User-Name:-None} (2) mschap: --> --username=skina (2) mschap: mschap1: 1f (2) mschap: EXPAND --challenge=%{mschap:Challenge:-00} (2) mschap: --> --challenge=1fa8d5c8e307ea3f (2) mschap: EXPAND --nt-response=%{mschap:NT-Response:-00} (2) mschap: --> --nt-response=74102cb712031d37dcb5bda4745b7e918794c4168fa1e5f5 (2) mschap: ERROR: Program returned code (1) and output 'Logon failure (0xc000006d)' (2) mschap: External script failed (2) mschap: ERROR: External script says: Logon failure (0xc000006d) (2) mschap: ERROR: MS-CHAP2-Response is incorrect (2) [mschap] = reject (2) } # authenticate = reject (2) Failed to authenticate the user (2) Using Post-Auth-Type Reject (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) Post-Auth-Type REJECT { (2) [sql] = ok (2) attr_filter.access_reject: EXPAND %{User-Name} (2) attr_filter.access_reject: --> skina (2) attr_filter.access_reject: Matched entry DEFAULT at line 11 (2) [attr_filter.access_reject] = updated (2) [eap] = noop (2) policy remove_reply_message_if_eap { (2) if (&reply:EAP-Message && &reply:Reply-Message) { (2) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (2) else { (2) [noop] = noop (2) } # else = noop (2) } # policy remove_reply_message_if_eap = noop (2) } # Post-Auth-Type REJECT = updated (2) Delaying response for 1.000000 seconds Waking up in 0.2 seconds. Waking up in 0.7 seconds. (2) Sending delayed response (2) Sent Access-Reject Id 57 from 127.0.0.1:1812 to 127.0.0.1:34102 length 61 (2) MS-CHAP-Error = "\000E=691 R=1 C=be58a2cfd7660c37 V=2" Waking up in 3.9 seconds. (2) Cleaning up request packet ID 57 with timestamp +161 Ready to process requests ------------------- This is the same error when I used wbinfo without --ntlmv2 ... ( might be a clue) In mods_enabled/mschap I have tried many parameters in ntlm_auth command .. including hardcoding a known user .. ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=MINUT-EXT --username=skina --password='Nio4LasOo'" It returned NT OK . .. but when I added the other to parameters .. i came back to the same error. --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" ----------- I was wondering if it is a kind of incompatibility concerning the version of MSCHAP or NTLM .. I appreciate any help you can give me. I have four days trying every option, reading every post, .. without success. Kasandra

4 4