After doing more testing rather than doing PEAP authentication I attempted to do TLS Authentication. When I did TLS authentication my TLS User authenticated just fine and I was able to receive an access-accept. When doing PEAP Authentication my PEAP user will fail with an access-reject leaving me to believe it has something to do with the MSCHAP module. I anm still investigating.

Scott

On Mon, May 14, 2012 at 1:55 PM, James J J Hooper [via FreeRadius] <[hidden email]> wrote:

On 11/05/2012 13:35, Phil Mayers wrote:

> On 11/05/12 13:10, sgilmour wrote:
>
>> --nt-response=46eb0f981a6121ad65e5726b0ee0e2097d610172204c7f24
>> Fri May 11 08:08:13 2012 : Debug: Exec-Program output: Access denied
>> (0xc0000022)
>> Fri May 11 08:08:13 2012 : Debug: Exec-Program-Wait: plaintext: Access
>> denied (0xc0000022)
>> Fri May 11 08:08:13 2012 : Debug: Exec-Program: returned: 1
>> Fri May 11 08:08:13 2012 : Info: [mschap] External script failed.
>> Fri May 11 08:08:13 2012 : Info: [mschap] FAILED: MS-CHAP2-Response is
>> incorrect
>
>
> The "ntlm_auth" helper is returning errors. Try the command from the CLI
> and examine the output. Check the permissions on the winbind socket
> (google for details) and SELinux contexts, if applicable.
AD can return 0xc0000022 when for example the domain controller
ntlm_auth/winbind is talking to can not contact the PDC. If you are
continuing to have issues, and have completed Phil's suggestions, check
the logs on your domain controllers for anomalies.

-James
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

If you reply to this email, your message will be added to the discussion below:
http://freeradius.1045715.n5.nabble.com/MSCHAP-Errors-tp5702886p5709347.html

To unsubscribe from MSCHAP Errors, click here.
NAML

Scott Gilmour | SQA Engineer

Enterasys Networks | A Siemens Enterprise Communications Company

Office: 978.684.1236

Email: [hidden email]