Hi I have tried everything possible. I have read every publication available and I am about to give up !!! I could not make it work: Radius using ntlm_auth to autenthicate. Details ..: a bit long . apologies :-) --------------------------------- SAMBA --------------------------------- I have samba 4.5.12 working OK ------------------- smb.conf # Global parameters [global] netbios name = GALAPA realm = MINUT.EDU.CO workgroup = MINUT-EXT dns forwarder = 192.168.32.1 server role = active directory domain controller # Autenticaion sin dominio winbind use default domain = no [netlogon] path = /var/lib/samba/sysvol/minut.edu.co/scripts read only = No [sysvol] path = /var/lib/samba/sysvol read only = No ------------------- All tests of samba working OK ------------------- #>> smbclient -L localhost -U% Domain=[MINUT-EXT] OS=[Windows 6.1] Server=[Samba 4.5.12-Debian] Sharename Type Comment --------- ---- ------- netlogon Disk sysvol Disk IPC$ IPC IPC Service (Samba 4.5.12-Debian) Domain=[MINUT-EXT] OS=[Windows 6.1] Server=[Samba 4.5.12-Debian Server Comment --------- ------- Workgroup Master --------- ------- WORKGROUP GALAPA ------------------- #>> root@galapa:/etc/freeradius/3.0# smbclient //localhost/netlogon -Uskina%'Nio4LasOo' -c 'ls' Domain=[MINUT-EXT] OS=[Windows 6.1] Server=[Samba 4.5.12-Debian] . D 0 Tue Jan 30 11:11:29 2018 .. D 0 Tue Jan 30 11:11:48 2018 65799648 blocks of size 1024. 61762632 blocks available #>> ntlm_auth --request-nt-key --domain=MINUT-EXT --username=skina --password='Nio4LasOo' NT_STATUS_OK: Success (0x0) #>> wbinfo --ntlmv2 -a 'skina'%'Nio4LasOo' plaintext password authentication succeeded challenge/response password authentication succeeded # wbinfo -a 'skina'%'Nio4LasOo' plaintext password authentication succeeded challenge/response password authentication failed wbcAuthenticateUserEx(MINUT-EXT\skina): error code was NT_STATUS_WRONG_PASSWORD (0xc000006a) error message was: Wrong Password Could not authenticate user skina with challenge/response ------------------- **** This last message is my only clue. --------------------------------- FREERADIUS --------------------------------- I have installed y configured freeradius following every manual .. First .. the basic configuration .. and working OK http://wiki.freeradius.org/guide/Basic-configuration-HOWTO ------------------- #>> radtest bob hello localhost 0 testing123 Sent Access-Request Id 70 from 0.0.0.0:37544 to 127.0.0.1:1812 length 73 User-Name = "bob" User-Password = "hello" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "hello" Received Access-Accept Id 70 from 127.0.0.1:1812 to 0.0.0.0:0 length 20 Reply-Message = "Hello, bob" ------------------- Second .. configure OK freeradius with ntlm_auth and PAP http://wiki.freeradius.org/guide/NTLM%20Auth%20with%20PAP%20HOWTO ------------------- #>> radtest 'skina' 'Nio4LasOo' localhost 0 testing123 Sent Access-Request Id 14 from 0.0.0.0:34004 to 127.0.0.1:1812 length 75 User-Name = "skina" User-Password = "Nio4Las2Oo" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "Nio4LasOo" Received Access-Accept Id 14 from 127.0.0.1:1812 to 0.0.0.0:0 length 20 ------------------- Third .. tryied to configure freeradius ntlm_auth and MSCHAP http://deployingradius.com/documents/configuration/active_directory.html I have already set all the permissions to user freerad to winbindd_private directory so that not the issue. It does not matter what I do .. I always get the same error .. ------------------- #>> radtest -t mschap 'skina' 'Nio4LasOo' localhost 0 testing123 Sent Access-Request Id 158 from 0.0.0.0:33353 to 127.0.0.1:1812 length 131 User-Name = "skina" MS-CHAP-Password = "Nio4LasOo" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "Nio4LasOo" MS-CHAP-Challenge = 0x59e2a1e585ad94e6 MS-CHAP-Response = 0x00010000000000000000000000000000000000000000000000001eacb1bfed243034f718b74d89b6b11b84af50869ab40b06 Received Access-Reject Id 158 from 127.0.0.1:1812 to 0.0.0.0:0 length 61 MS-CHAP-Error = "\000E=691 R=1 C=c3f65e6f825239e4 V=2" (0) -: Expected Access-Accept got Access-Reject ------------------- And the output of "freeradius -X" ------------------- (2) Received Access-Request Id 57 from 127.0.0.1:34102 to 127.0.0.1:1812 length 131 (2) User-Name = "skina" (2) NAS-IP-Address = 127.0.1.1 (2) NAS-Port = 0 (2) Message-Authenticator = 0xe88750a3ffc2bc75b90b872caf81f7e5 (2) MS-CHAP-Challenge = 0x1fa8d5c8e307ea3f (2) MS-CHAP-Response = 0x000100000000000000000000000000000000000000000000000074102cb712031d37dcb5bda4745b7e918794c4168fa1e5f5 (2) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (2) authorize { (2) policy ntlm_auth.authorize { (2) if (!control:Auth-Type && User-Password) { (2) if (!control:Auth-Type && User-Password) -> FALSE (2) } # policy ntlm_auth.authorize = notfound (2) policy filter_username { (2) if (&User-Name) { (2) if (&User-Name) -> TRUE (2) if (&User-Name) { (2) if (&User-Name =~ / /) { (2) if (&User-Name =~ / /) -> FALSE (2) if (&User-Name =~ /@[^@]*@/ ) { (2) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (2) if (&User-Name =~ /\.\./ ) { (2) if (&User-Name =~ /\.\./ ) -> FALSE (2) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (2) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (2) if (&User-Name =~ /\.$/) { (2) if (&User-Name =~ /\.$/) -> FALSE (2) if (&User-Name =~ /@\./) { (2) if (&User-Name =~ /@\./) -> FALSE (2) } # if (&User-Name) = notfound (2) } # policy filter_username = notfound (2) [preprocess] = ok (2) [chap] = noop (2) mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' (2) [mschap] = ok (2) [digest] = noop (2) suffix: Checking for suffix after "@" (2) suffix: No '@' in User-Name = "skina", looking up realm NULL (2) suffix: No such realm "NULL" (2) [suffix] = noop (2) eap: No EAP-Message, not doing EAP (2) [eap] = noop (2) [files] = noop (2) [sql] = notfound (2) [expiration] = noop (2) [logintime] = noop (2) } # authorize = ok (2) Found Auth-Type = mschap (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) authenticate { (2) mschap: Client is using MS-CHAPv1 with NT-Password (2) mschap: Executing: /usr/bin/ntlm_auth --allow-mschapv2 --ntlmv2 --request-nt-key --username=%{mschap:User-Name:-None} --domain=MINUT-EXT --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}: (2) mschap: EXPAND --username=%{mschap:User-Name:-None} (2) mschap: --> --username=skina (2) mschap: mschap1: 1f (2) mschap: EXPAND --challenge=%{mschap:Challenge:-00} (2) mschap: --> --challenge=1fa8d5c8e307ea3f (2) mschap: EXPAND --nt-response=%{mschap:NT-Response:-00} (2) mschap: --> --nt-response=74102cb712031d37dcb5bda4745b7e918794c4168fa1e5f5 (2) mschap: ERROR: Program returned code (1) and output 'Logon failure (0xc000006d)' (2) mschap: External script failed (2) mschap: ERROR: External script says: Logon failure (0xc000006d) (2) mschap: ERROR: MS-CHAP2-Response is incorrect (2) [mschap] = reject (2) } # authenticate = reject (2) Failed to authenticate the user (2) Using Post-Auth-Type Reject (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) Post-Auth-Type REJECT { (2) [sql] = ok (2) attr_filter.access_reject: EXPAND %{User-Name} (2) attr_filter.access_reject: --> skina (2) attr_filter.access_reject: Matched entry DEFAULT at line 11 (2) [attr_filter.access_reject] = updated (2) [eap] = noop (2) policy remove_reply_message_if_eap { (2) if (&reply:EAP-Message && &reply:Reply-Message) { (2) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (2) else { (2) [noop] = noop (2) } # else = noop (2) } # policy remove_reply_message_if_eap = noop (2) } # Post-Auth-Type REJECT = updated (2) Delaying response for 1.000000 seconds Waking up in 0.2 seconds. Waking up in 0.7 seconds. (2) Sending delayed response (2) Sent Access-Reject Id 57 from 127.0.0.1:1812 to 127.0.0.1:34102 length 61 (2) MS-CHAP-Error = "\000E=691 R=1 C=be58a2cfd7660c37 V=2" Waking up in 3.9 seconds. (2) Cleaning up request packet ID 57 with timestamp +161 Ready to process requests ------------------- This is the same error when I used wbinfo without --ntlmv2 ... ( might be a clue) In mods_enabled/mschap I have tried many parameters in ntlm_auth command .. including hardcoding a known user .. ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=MINUT-EXT --username=skina --password='Nio4LasOo'" It returned NT OK . .. but when I added the other to parameters .. i came back to the same error. --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" ----------- I was wondering if it is a kind of incompatibility concerning the version of MSCHAP or NTLM .. I appreciate any help you can give me. I have four days trying every option, reading every post, .. without success. Kasandra