On May 28, 2025, at 6:56 PM, Matthew Beechey <mobiusnz@gmail.com> wrote:
I've installed Freeradius 3.0 - That was a default with APT-GET - Let me know if manually getting a newer version is essential.
It should be dine.
I'm using it in front of a Windows Server and a Fortigate Firewall.
I have it talking to the server and joined to the domain. I can manually use NTLM_AUTH and it authenticates Windows users like a dream.
That's good.
With DEFAULT Auth-Type = ntlm_auth in files/authorize I can authenticate users with NTRadPing although I cannot without the DEFAULT.... entry.
If only there was some kind of debug output you could read to see what's going on. http://wiki.freeradius <http://wiki.freeradius/>.org/list-help
I cannot authenticate users from the radius settings on the Fortigate - They always fail. Looking at logging from Freeradius with -X i see this entry
mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap'
When I do it with NTRadPing with the DEFAULT set to ntlm_auth I get this entry in the logging
(0) Found Auth-Type = ntlm_auth
So I'm picking something about the request from the Fortigate is setting it to MSCHAP (v1) and with NTRadPing its doing it with ntlm_auth
What do I need to do here - disable MSCHAPv1 and if so how - Something else to force MSCHAP to use NTLM_AUTH
Perhaps read mods-available/mschap Look for "ntlm".
Essentially I want to use Windows users for Fortinet VPN and next step is going to be adding 2 Factor authentication with Google, Authy or Microsoft - Hoping I can do it as a rolling code so any app will work? Any pointers here or advice would be good if you have some.
The documentation is pretty much in front of you already. Just follow it, and it will work. Alan DeKok.