On Mar 23, 2019, at 10:28 AM, Niels Tomey <niels@ixs.ph> wrote:
I’ve set up freeradius 3.0.17 quite some time ago to process ssh logins based on LDAP/AD accounts (with group membership in post-auth) and this works fine. I followed the guide on deployingradius.com ( http://deployingradius.com/documents/configuration/active_directory.html), but haven’t implemented the mschap section as I didn’t need it at the time.
Ok.
Now I am running into this need and I was trying to figure out why it wasn’t working only to discover that I left the
DEFAULT Auth-Type = ntlm_auth
Line in the mods-config/files/authorize file. As expected this breaks my attempts to include mschap.
Yes. You can set that only if there's no MS-CHAP attributes.
My problem is that this is the only non-commented line in the entire file, so rather than just delete the line I need to enter some other information here to prevent the
ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject
Yes.
In the comments in the file it states that multiple DEFAULTs can be used with Fall-Through so I tried this:
DEFAULT Auth-Type = ntlm_auth
Fall-Through = Yes
DEFAULT Auth-Type = mschap
But this doesn’t work.
Yes. Don't set multiple Auth-Types. Plus, the "users" file can't really do complex if / then / else checks. Use "unlang" for that.
What is the best approach for this? I would like to avoid having to name my users here since they are in ldap already and I don’t know if a device will only authenticate using mschap or not (e.g. it will be difficult to split this out in the clients.conf file).
Delete the Auth-Type entries from mods-config/files/authorize . Then edit sites-enabled/default: authorize { ... mschap # sets Auth-Type mschap for MSCHAP stuff... ... # # If it's PAP, use ntlm_auth # if (User-Password) { update control { Auth-Type := ntlm_auth } } pap } That should work. Alan DeKok.