On 23/09/2025 12:04, Rob Taylor via Freeradius-Users wrote:
Below are full debug logs. Trying to use freeradius to authenticate to AD, so that I can use it to support eduroam. using eapol to test, which worked correctly with files.
# Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no }
You haven't configured ntlm_auth or winbind here, so mschap can't do any external authentication.
# Loading module "ntlm_auth" from file /etc/freeradius/3.0/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --allow-mschapv2 --domain=ccdom --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes }
Don't use the 'ntlm_auth' configuration. It's for PAP based auth only, and sends the password in the clear. If you want this, use LDAP instead.
(8) inner-eap: Removing EAP session with state 0x17eaa20b170cb824 (8) inner-eap: Previous EAP request found for state 0x17eaa20b170cb824, released from the list (8) inner-eap: Peer sent packet with method EAP MSCHAPv2 (26) (8) inner-eap: Calling submodule eap_mschapv2 to process data (8) eap_mschapv2: # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (8) eap_mschapv2: authenticate { (8) mschap: Found Cleartext-Password, hashing to create NT-Password (8) mschap: Creating challenge hash with username: rgt@wi.mit.edu (8) mschap: Client is using MS-CHAPv2 (8) mschap: ERROR: MS-CHAP2-Response is incorrect
Internal MSCHAP auth only.
(8) eap_mschapv2: [mschap] = reject (8) eap_mschapv2: } # authenticate = reject (8) eap_mschapv2: MSCHAP-Error: ?E=691 R=1 C=af9121d55ab76fc424446fdeafaacdc3 V=3 M=Authentication rejected (8) eap_mschapv2: Found new challenge from MS-CHAP-Error: err=691 retry=1 challenge=af9121d55ab76fc424446fdeafaacdc3 (8) eap_mschapv2: ERROR: MSCHAP Failure
Never tried to contact winbind because it's not configured in the mschap module. Fix that config and you should make progress. -- Matthew