On Jul 19, 2021, at 11:02 AM, Marco Gaiarin <gaio@sv.lnf.it> wrote:
Debian stretch, freeradius 3.0.12+dfsg-5+deb9u1 and samba 2:4.10.18+dfsg-0.1stretch1, using the bultin winbind library.
Use the updated packages from http://packages.networkadius.com 3.0.12 is many years old.
I've setup freeradius to use PEAP/MSCHAPv2 auth aginst my AD domain, using samba as AD DC, following i suppose pretty standard info like:
https://wiki.freeradius.org/guide/freeradius-active-directory-integration-ho... https://wiki.samba.org/index.php/Authenticating_Freeradius_against_Active_Di...
That should work.
All works as expected for users, but i've tried also to enable 'machine auth' (eg, authentication of PC with the machine account stored in AD), and does not work.
Following the docs, i've setup in 'mschap' module:
winbind_username = "%{%{mschap:User-Name}:-None}" winbind_domain = "%{%{mschap:NT-Domain}:-LNFFVG}"
in this way i get in log (full log available):
(0) Received Access-Request Id 63 from 10.5.1.180:38380 to 10.5.1.3:1812 length 259 (0) User-Name = "host/AFTERSHOCK.ad.fvg.lnf.it" (0) NAS-Identifier = "f29fc27da970" (0) Called-Station-Id = "F2-9F-C2-7D-A9-70:LNFFVG" (0) NAS-Port-Type = Wireless-802.11 (0) Service-Type = Framed-User (0) Calling-Station-Id = "00-C2-C6-24-2D-63" [...] (9) eap: Calling submodule eap_mschapv2 to process data (9) eap_mschapv2: # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (9) eap_mschapv2: authenticate { (9) mschap: Creating challenge hash with username: host/AFTERSHOCK.ad.fvg.lnf.it (9) mschap: Client is using MS-CHAPv2 (9) mschap: EXPAND %{%{mschap:User-Name}:-None} (9) mschap: --> AFTERSHOCK$
That seems wrong.
(9) mschap: ERROR: The specified account does not exist. [0xC0000064]
That seems pretty clear.
So, seems to me that (and only for machine account! As stated users works as expected!) mschap{} module 'misinterpret' the domain (seems to strip the first dotted part from the long/kerberos domain, and use it a short/netbios domain).
Use 3.0.23. We've fixed a bunch of issues. That may help. Alan DEKok.