Ok - I've removed freeradius and freeradius-config and reinstalled to get a default config back. I've gone ahead and edited the files again from scratch following instructions. Again a NTRadPint with the default entry for NTLM in works - With that off it fails which I guess is to be expected as I see NTRadPing doesn't specify and auth type and the only option is CHAP not MSCHAP. With Radtest I get Received Access-Reject Id 190 from 127.0.0.1:1812 to 127.0.0.1:39439 length 79 Message-Authenticator = 0x55886eec80ca8cf69c744513651e6094 MS-CHAP-Error = "\000E=691 R=1 C=41d19098087818a0 V=2" (0) -: Expected Access-Accept got Access-Reject In the debug I can see mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' (0) [mschap] = ok Which I was failing on previously due to a bad edit somewhere. The one change due to the v4.0 instructions other than replacing raddb with freeradius/3.0 is that it talks about editing the /raddb/modules/mschap file - There is no modules path in 3.0 so I edited /etc/freeradius/3.0/mods-enabled/mschap . I apologise for being back here again - I feel that I'm 99.9% there and I'm just missing some small step. running ntlm_auth manually works well. On Fri, May 30, 2025 at 10:58 PM Alan DeKok via Freeradius-Users < freeradius-users@lists.freeradius.org> wrote:
On May 29, 2025, at 10:37 PM, Matthew Beechey <mobiusnz@gmail.com> wrote:
Sorry Alan - Still can't work it out. I follow
https://www.freeradius.org/documentation/freeradius-server/4.0.0/howto/datas...
While reading documentation is good, you'll note that's the 4.0 documentation. You're running 3.0.
Plus, I suggested that you read mods-available/mschap. That file is on your local system, and contains detailed documentation on getting ntlm_auth running with the mschap module.
and when I run the radtest -t mschap user password localhost 0 Secret it fails.
I also suggested that you read http://wiki.freeradius.org/list-help
That page SPECIFICALLY says that you shouldn't post the client output, because it's not needed.
(4) Found Auth-Type = mschap (4) Auth-Type sub-section not found. Ignoring.
As Matthew noted, you've edited the default configuration and broken it.
Why?
Don't do that. Go back to the default configuration, and start over. Follow the documentation... the VERSION 3 documentation.
It will work.
The reason it doesn't work is that you're not following the documentation, and you're making massive changes to the configuration without really knowing what the effects are.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html