Hello, I have a problem with a freeradius + samba and ntlm authetication. the configuration work very well and without problems for a random period of time, but after 2, 4, 7 days, the freeradius stop to work and only work again if I restart the service (/etc/init.d/freeradius restart). in the same machine, I have a samba file server (connected to a domain) and winbindd service... both still working without problems. I have this packages installed ====================== dpkg -l | egrep '(winb|samba|freeradius)' ii freeradius 2.1.12+dfsg-1.2ubuntu8.1 amd64 high-performance and highly configurable RADIUS server ii freeradius-common 2.1.12+dfsg-1.2ubuntu8.1 all FreeRADIUS common files ii freeradius-utils 2.1.12+dfsg-1.2ubuntu8.1 amd64 FreeRADIUS client utilities ii libfreeradius2 2.1.12+dfsg-1.2ubuntu8.1 amd64 FreeRADIUS shared library ii libnss-winbind:amd64 2:4.3.9+dfsg-0ubuntu0.14.04.3 amd64 Samba nameservice integration plugins ii libwbclient0:amd64 2:4.3.9+dfsg-0ubuntu0.14.04.3 amd64 Samba winbind client library ii python-samba 2:4.3.9+dfsg-0ubuntu0.14.04.3 amd64 Python bindings for Samba ii samba 2:4.3.9+dfsg-0ubuntu0.14.04.3 amd64 SMB/CIFS file, print, and login server for Unix ii samba-common 2:4.3.9+dfsg-0ubuntu0.14.04.3 all common files used by both the Samba server and client ii samba-common-bin 2:4.3.9+dfsg-0ubuntu0.14.04.3 amd64 Samba common files used by both the server and the client ii samba-dsdb-modules 2:4.3.9+dfsg-0ubuntu0.14.04.3 amd64 Samba Directory Services Database ii samba-libs:amd64 2:4.3.9+dfsg-0ubuntu0.14.04.3 amd64 Samba core libraries ii samba-vfs-modules 2:4.3.9+dfsg-0ubuntu0.14.04.3 amd64 Samba Virtual FileSystem plugins ii winbind 2:4.3.9+dfsg-0ubuntu0.14.04.3 amd64 service to resolve user and group information from Windows NT servers ====================== on ====================== # cat /etc/lsb-release DISTRIB_ID=Ubuntu DISTRIB_RELEASE=14.04 DISTRIB_CODENAME=trusty DISTRIB_DESCRIPTION="Ubuntu 14.04.4 LTS" ====================== and in log file I found this (why the logs dont have the time for default ??) =================================== # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: operador [mschap] Told to do MS-CHAPv2 for operador with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Finished request 788. Going to the next request Thread 4 waiting to be assigned a request Waking up in 0.9 seconds. Thread 5 got semaphore Thread 5 handling request 789, (158 handled so far) [<thread>] # Executing section authorize from file /etc/freeradius/sites-enabled/default [<thread>] +- entering group authorize {...} [<thread>] ++- entering policy filter_hostname {...} [<thread>] +++? if (User-Name =~ /^host/) [<thread>] ? Evaluating (User-Name =~ /^host/) -> FALSE [<thread>] +++? if (User-Name =~ /^host/) -> FALSE [<thread>] ++- policy filter_hostname returns notfound ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "operador", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 10 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv failure [peap] Received EAP-TLV response. [peap] The users session was previously rejected: returning reject (again.) [peap] *** This means you need to read the PREVIOUS messages in the debug output [peap] *** to find out the reason why the user was rejected. [peap] *** Look for "reject" or "fail". Those earlier messages will tell you. [peap] *** what went wrong, and how to fix the problem. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> operador attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 789 for 1 seconds Going to the next request Thread 5 waiting to be assigned a request Waking up in 0.9 seconds. Waiting to send Access-Reject to client red-gasco port 36995 - ID: 19 Sending delayed reject for request 789 Waking up in 3.9 seconds. =================================== any help or idea ? thanks and attentive -- -- Victor Hugo dos Santos http://www.vhsantos.net Linux Counter #224399