21 Aug
2017
21 Aug
'17
2:06 a.m.
Thank you Alan,
After some testing, it turns out that:
use_mppe = yes
Is not the same as
#use_mppe = no
But it works again now.
Cheers,
Dirk
On 2017-08-19 18:38, Alan Buxey wrote:
> Use eg eapol_test for testing and ensure you have all the options eg
> mppe
> etc set to yes in mschap module
>
> alan
>
> On 18 Aug 2017 2:36 pm, "Dirk Bonenkamp - ProActive"
> <dirk@proactive.nl>
> wrote:
>
>> Hi All,
>>
>> I'm running Ubuntu 16.04 LTS, Samba 4.3.11 and Freeradius 3.0.15.
>>
>> I'm having trouble using mschap when authenticating against my AD
>> using
>> ntlm_auth. Testing with wbinfo or ntlm_auth from the command line
>> works.
>> Running NTLM_AUTH trough freeradius (configured by myself, which just
>> calls
>> ntlm_auth staight), works fine:
>>
>> radtest dirk MyPaSsWord localhost 0 testing123
>>
>> Ouput:
>>
>> (2) Found Auth-Type = NTLM_AUTH
>> (2) # Executing group from file /etc/freeradius/sites-enabled/default
>> (2) Auth-Type NTLM_AUTH {
>> (2) ntlm_auth: Executing: /usr/bin/ntlm_auth --request-nt-key
>> --domain=PROACTIVE --username=%{mschap:User-Name}
>> --password=%{User-Password}:
>> (2) ntlm_auth: EXPAND --username=%{mschap:User-Name}
>> (2) ntlm_auth: --> --username=dirk
>> (2) ntlm_auth: EXPAND --password=%{User-Password}
>> (2) ntlm_auth: --> --password=MyPaSsWord
>> (2) ntlm_auth: Program returned code (0) and output 'NT_STATUS_OK:
>> Success
>> (0x0)'
>> (2) ntlm_auth: Program executed successfully
>> (2) [ntlm_auth] = ok
>> (2) } # Auth-Type NTLM_AUTH = ok
>>
>> But when running:
>>
>> radtest -t mschap dirk MyPaSsWord localhost 0 testing123
>>
>> I get:
>>
>> (0) Found Auth-Type = mschap
>> (0) # Executing group from file /etc/freeradius/sites-enabled/default
>> (0) authenticate {
>> (0) mschap: Client is using MS-CHAPv1 with NT-Password
>> (0) mschap: Executing: /usr/bin/ntlm_auth --request-nt-key
>> --domain=PROACTIVE --username=%{mschap:User-Name}
>> --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Re
>> sponse}:-00}:
>> (0) mschap: EXPAND --username=%{mschap:User-Name}
>> (0) mschap: --> --username=dirk
>> (0) mschap: mschap1: a2
>> (0) mschap: EXPAND --challenge=%{%{mschap:Challenge}:-00}
>> (0) mschap: --> --challenge=a2ecd01e5bdf0ef6
>> (0) mschap: EXPAND --nt-response=%{%{mschap:NT-Response}:-00}
>> (0) mschap: --> --nt-response=28c30e8ce6d1a2ec
>> d6877be94a654d6336afa03527aace03
>> (0) mschap: ERROR: Program returned code (1) and output 'Logon failure
>> (0xc000006d)'
>> (0) mschap: External script failed
>> (0) mschap: ERROR: External script says: Logon failure (0xc000006d)
>> (0) mschap: ERROR: MS-CHAP2-Response is incorrect
>> (0) [mschap] = reject
>>
>> I'm really puzzled here... I had this working on an Ubuntu 12.04 /
>> freeradius 2.x setup, but I'm really stuck now.
>>
>> Any help or hints are highly appreciated. Thank you in advance, kind
>> regards,
>>
>> Dirk
>> -
>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list
>> /users.html
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html