I see one difference between my machine auth and user auth cases: User auth: (18) mschap : Creating challenge hash with username: dxu (18) mschap : Client is using MS-CHAPv2 Executing: /usr/bin/ntlm_auth --request-nt-key --username=%{%{mschap:User-Name}:-00} --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --domain=%{%{mschap:NT-Domain}:-CFS.UOGUELPH.CA} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}: (18) mschap : EXPAND --username=%{%{mschap:User-Name}:-00} (18) mschap : --> --username=dxu (18) mschap : EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (18) mschap : --> --username=dxu (18) ERROR: mschap : No NT-Domain was found in the User-Name (18) mschap : EXPAND --domain=%{%{mschap:NT-Domain}:-CFS.UOGUELPH.CA} (18) mschap : --> --domain=CFS.UOGUELPH.CA (18) mschap : Creating challenge hash with username: dxu (18) mschap : EXPAND --challenge=%{%{mschap:Challenge}:-00} (18) mschap : --> --challenge=5cf265648d2f7da7 (18) mschap : EXPAND --nt-response=%{%{mschap:NT-Response}:-00} (18) mschap : --> --nt-response=5f4067f8278986cb3b524f75e1af8eef82e7753376f06191 Program returned code (0) and output 'NT_KEY: 0DB0BDD00DBF8F89BB011EB4035FE849' (18) mschap : Adding MS-CHAPv2 MPPE keys (18) [mschap] = ok (18) } # Auth-Type MS-CHAP = ok MSCHAP Success Machine auth: (19) mschap : Creating challenge hash with username: host/CCS-252.cfs.uoguelph.ca (19) mschap : Client is using MS-CHAPv2 Executing: /usr/bin/ntlm_auth --request-nt-key --username=%{%{mschap:User-Name}:-00} --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --domain=%{%{mschap:NT-Domain}:-CFS.UOGUELPH.CA} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}: (19) mschap : EXPAND --username=%{%{mschap:User-Name}:-00} (19) mschap : --> --username=CCS-252$ (19) mschap : EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (19) mschap : --> --username=host/CCS-252.cfs.uoguelph.ca (19) mschap : EXPAND --domain=%{%{mschap:NT-Domain}:-CFS.UOGUELPH.CA} (19) mschap : --> --domain=cfs (19) mschap : Creating challenge hash with username: host/CCS-252.cfs.uoguelph.ca (19) mschap : EXPAND --challenge=%{%{mschap:Challenge}:-00} (19) mschap : --> --challenge=9845f8f1049eec1c (19) mschap : EXPAND --nt-response=%{%{mschap:NT-Response}:-00} (19) mschap : --> --nt-response=c1ee140e5d85a62db9d4dd943a841a0f317a77521e0c26e0 Program returned code (1) and output 'Logon failure (0xc000006d)' (19) mschap : External script failed (19) ERROR: mschap : External script says: Logon failure (0xc000006d) (19) ERROR: mschap : MS-CHAP2-Response is incorrect (19) [mschap] = reject (19) } # Auth-Type MS-CHAP = reject The EXPAND domain value from user auth is "domain=CFS.UOGUELPH.CA" which is correct, but it got "domain=cfs" in the machine auth case. I am not sure if that is important. ----- Original Message ----- From: "Dennis Xu" <dxu@uoguelph.ca> To: "Alan DeKok" <aland@deployingradius.com> Cc: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Tuesday, December 8, 2015 12:23:51 PM Subject: Re: Machine auth fails but user auth works Sorry attached the wrong debug file in previous email. Please see this one. Dennis ----- Original Message ----- From: "Dennis Xu" <dxu@uoguelph.ca> To: "Alan DeKok" <aland@deployingradius.com> Cc: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Tuesday, December 8, 2015 12:22:36 PM Subject: Re: Machine auth fails but user auth works Here I have the complete eap file and debug outputs. Thanks. ----- Original Message ----- From: "Alan DeKok" <aland@deployingradius.com> To: dxu@uoguelph.ca, "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Tuesday, December 8, 2015 11:39:55 AM Subject: Re: Machine auth fails but user auth works On Dec 8, 2015, at 11:35 AM, Dennis Xu <dxu@uoguelph.ca> wrote:
Just started to work on this again today. I put the server cert and all intermediate CAs into the same file and changed the /mods-available/eap file as below: certificate_file = ${certdir}/all_certs.pem ca_file = ${cadir}/all_certs.pem
Machine auth still failed but with different outputs. I don't see the "tlsv1 alert unknown ca" errors anymore.
Would you please check the debug outputs again and advise?
You've deleted the useful portions, which is unhelpful. Post ALL of the debug output. And don't waste our time with edited portions of it. Since you can't solve the problem, you don't know which pieces are useful, and which aren't. So don't edit the debug output. Alan DeKok.