Freeradius-Users

Download

freeradius-users@lists.freeradius.org

September 2018

73 participants
81 discussions

ntlm_auth with ms-chap
by Jürgen Obermeyer 01 Sep '18

01 Sep '18

Good evening from Germany, I installed (for the very first time) freeradius on an Ubuntu 18.04 box. The version is 3.0.16. I would like to use freeradius to authenticate my users against Samba passwords using ntlm_auth. I followed EXACTLY the instructions on the website deployingradius.com, beginning from the initial setup to the last step, "Configuring FreeRADIUS to use ntlm_auth for MS-CHAP". Only this last step fails, and I have no idea why. This is an excerpt of the debug output: *** (2) Found Auth-Type = mschap (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) authenticate { (2) mschap: Client is using MS-CHAPv1 with NT-Password (2) mschap: Executing: /usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --domain=%{%{mschap:NT-Domain}:-OEGNET} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}: (2) mschap: EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (2) mschap: --> --username=om (2) mschap: ERROR: No NT-Domain was found in the User-Name (2) mschap: EXPAND --domain=%{%{mschap:NT-Domain}:-OEGNET} (2) mschap: --> --domain=OEGNET (2) mschap: mschap1: 12 (2) mschap: EXPAND --challenge=%{%{mschap:Challenge}:-00} (2) mschap: --> --challenge=12473d849ab42a45 (2) mschap: EXPAND --nt-response=%{%{mschap:NT-Response}:-00} (2) mschap: --> --nt-response=7cba13f9a4b65406feb11d25441a189c18b2389b0fe6e922 (2) mschap: ERROR: Program returned code (1) and output 'The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d)' (2) mschap: External script failed (2) mschap: ERROR: External script says: The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d) (2) mschap: ERROR: MS-CHAP2-Response is incorrect (2) [mschap] = reject (2) } # authenticate = reject (2) Failed to authenticate the user *** I tried with 'radtest -t mschap ...' getting the following answer: *** root@hermes:/etc/freeradius.old# radtest -t mschap om topsecret localhost 0 testing123 Sent Access-Request Id 18 from 0.0.0.0:37196 to 127.0.0.1:1812 length 128 User-Name = "om" MS-CHAP-Password = "topsecret" NAS-IP-Address = 192.168.6.1 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "topsecret" MS-CHAP-Challenge = 0x6d7f7ccb15612a8a MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000db860e0276efb23bc02d3a0f2f5d0977ae73f0b6ea6f3937 Received Access-Reject Id 18 from 127.0.0.1:1812 to 0.0.0.0:0 length 61 MS-CHAP-Error = "\000E=691 R=1 C=9c9615bf2537c293 V=2" (0) -: Expected Access-Accept got Access-Reject *** Any advices are highly welcome. Kind regards, Jürgen

2 3