Still unable to get this to work via
freeradius, but works with ntlm_auth from the command line.
[root@phllnxsrv01 raddb]# ntlm_auth
--username="test ops" --password=m1sg0ps --domain=usmisgnet
--request-NT-key
NT_STATUS_OK: Success (0x0)
BUT
wbinfo -a "ken
george"%262144
plaintext password authentication failed
error code was NT_STATUS_NO_SUCH_USER
(0xc0000064)
error messsage was: No such user
Could not authenticate user ken
george%262144 with plaintext password
challenge/response password authentication
succeeded
Is this a samba/winbindd/Windows 2003
issue or is my freeradius configuration still lacking??
radiusd.conf
exec win_domain {
wait = yes
input_pairs = request
output_pairs = reply
program = "/usr/bin/ntlm_auth --username=\"%{User-Name}\"
--password=\"%{User-Password}\" --domain=usmisgnet"
}
.
.
.
#
Auth-Type win_domain {
win_domain
}
#
In the users file
#
DEFAULT Auth-Type = win_domain
#
radtest "test ops" m1sg0ps
localhost 0 xxxxxx
[root@phllnxsrv01 raddb]# radiusd -xxyz -l
stdout
Starting - reading configuration files ...
reread_config: reading radiusd.conf
Config: including file:
/etc/raddb/proxy.conf
Config: including file:
/etc/raddb/clients.conf
Config: including file:
/etc/raddb/snmp.conf
Config: including file:
/etc/raddb/eap.conf
Config: including file:
/etc/raddb/sql.conf
main: prefix = "/usr"
main: localstatedir =
"/var"
main: logdir =
"/var/log/radius"
main: libdir = "/usr/lib"
main: radacctdir =
"/var/log/radius/radacct"
main: hostname_lookups = no
main: max_request_time = 30
main: cleanup_delay = 5
main: max_requests = 1024
main: delete_blocked_requests = 0
main: port = 0
main: allow_core_dumps = no
main: log_stripped_names = no
main: log_file =
"/var/log/radius/radius.log"
main: log_auth = yes
main: log_auth_badpass = no
main: log_auth_goodpass = no
main: pidfile =
"/var/run/radiusd/radiusd.pid"
main: user = "radiusd"
main: group = "radiusd"
main: usercollide = no
main: lower_user =
"before"
main: lower_pass = "no"
main: nospace_user = "no"
main: nospace_pass = "no"
main: checkrad =
"/usr/sbin/checkrad"
main: proxy_requests = yes
proxy: retry_delay = 5
proxy: retry_count = 3
proxy: synchronous = no
proxy: default_fallback = yes
proxy: dead_time = 120
proxy: post_proxy_authorize = yes
proxy: wake_all_if_all_dead = no
security: max_attributes = 200
security: reject_delay = 1
security: status_server = no
main: debug_level = 0
read_config_files: reading
dictionary
read_config_files: reading naslist
Using deprecated naslist file.
Support for this will go away soon.
read_config_files: reading clients
read_config_files: reading realms
radiusd: entering modules setup
Module: Library search path is /usr/lib
Module: Loaded exec
exec: wait = yes
exec: program = "(null)"
exec: input_pairs =
"request"
exec: output_pairs =
"(null)"
exec: packet_type =
"(null)"
rlm_exec: Wait=yes but no output defined.
Did you mean output=none?
Module: Instantiated exec (exec)
Module: Loaded expr
Module: Instantiated expr (expr)
Module: Loaded PAP
pap: encryption_scheme =
"crypt"
Module: Instantiated pap (pap)
Module: Loaded CHAP
Module: Instantiated chap (chap)
Module: Loaded MS-CHAP
mschap: use_mppe = yes
mschap: require_encryption = yes
mschap: require_strong = yes
mschap: with_ntdomain_hack = no
mschap: passwd = "(null)"
mschap: authtype =
"MS-CHAP"
mschap: ntlm_auth =
"/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}}
--domain=%{mschap:NT-Domain} --challenge=%{mschap:Challenge:-00}
--nt-response=%{mschap:NT-Response:-00}"
Module: Instantiated mschap (mschap)
exec: wait = yes
exec: program =
"/usr/bin/ntlm_auth --username="%{User-Name}" --password="%{User-Password}"
--domain=usmisgnet"
exec: input_pairs =
"request"
exec: output_pairs =
"reply"
exec: packet_type =
"(null)"
Module: Instantiated exec (win_domain)
Module: Loaded System
unix: cache = no
unix: passwd = "(null)"
unix: shadow = "/etc/shadow"
unix: group = "(null)"
unix: radwtmp =
"/var/log/radius/radwtmp"
unix: usegroup = no
unix: cache_reload = 600
Module: Instantiated unix (unix)
Module: Loaded eap
eap: default_eap_type =
"md5"
eap: timer_expire = 60
eap: ignore_unknown_eap_types = no
eap: cisco_accounting_username_bug =
no
rlm_eap: Loaded and initialized type md5
rlm_eap: Loaded and initialized type leap
gtc: challenge = "Password:
"
gtc: auth_type = "PAP"
rlm_eap: Loaded and initialized type gtc
mschapv2: with_ntdomain_hack = no
rlm_eap: Loaded and initialized type
mschapv2
Module: Instantiated eap (eap)
Module: Loaded preprocess
preprocess: huntgroups =
"/etc/raddb/huntgroups"
preprocess: hints =
"/etc/raddb/hints"
preprocess: with_ascend_hack = no
preprocess: ascend_channels_per_line
= 23
preprocess: with_ntdomain_hack = yes
preprocess:
with_specialix_jetstream_hack = no
preprocess: with_cisco_vsa_hack =
yes
Module: Instantiated preprocess
(preprocess)
Module: Loaded realm
realm: format = "suffix"
realm: delimiter = "@"
realm: ignore_default = no
realm: ignore_null = no
Module: Instantiated realm (suffix)
realm: format = "prefix"
realm: delimiter = "\"
realm: ignore_default = no
realm: ignore_null = no
Module: Instantiated realm (ntdomain)
Module: Loaded files
files: usersfile =
"/etc/raddb/users"
files: acctusersfile =
"/etc/raddb/acct_users"
files: preproxy_usersfile =
"/etc/raddb/preproxy_users"
files: compat = "no"
Module: Instantiated files (files)
Module: Loaded Acct-Unique-Session-Id
acct_unique: key = "User-Name,
Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
Module: Instantiated acct_unique
(acct_unique)
Module: Loaded detail
detail: detailfile =
"/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d"
detail: detailperm = 384
detail: dirperm = 493
detail: locking = no
Module: Instantiated detail (detail)
Module: Loaded radutmp
radutmp: filename =
"/var/log/radius/radutmp"
radutmp: username =
"%{User-Name}"
radutmp: case_sensitive = yes
radutmp: check_with_nas = yes
radutmp: perm = 384
radutmp: callerid = yes
Module: Instantiated radutmp (radutmp)
Initializing the thread pool...
thread: start_servers = 5
thread: max_servers = 32
thread: min_spare_servers = 3
thread: max_spare_servers = 10
thread: max_requests_per_server = 0
thread: cleanup_delay = 5
Thread 1 waiting to be assigned a request
Thread spawned new child 1. Total threads
in pool: 1
Thread 2 waiting to be assigned a request
Thread spawned new child 2. Total threads
in pool: 2
Thread 3 waiting to be assigned a request
Thread spawned new child 3. Total threads
in pool: 3
Thread 4 waiting to be assigned a request
Thread spawned new child 4. Total threads
in pool: 4
Thread 5 waiting to be assigned a request
Thread spawned new child 5. Total threads
in pool: 5
Thread pool initialized
Listening on authentication *:1812
Listening on accounting *:1813
Listening on proxy *:1814
Ready to process requests.
rad_recv: Access-Request packet from host
127.0.0.1:32785, id=139, length=60
--- Walking the entire request list ---
Waking up in 31 seconds...
Threads: total/active/spare threads =
5/0/5
Thread 1 got semaphore
Thread 1 handling request 0, (1 handled so
far)
User-Name = "test ops"
User-Password = "xxxxxx"
NAS-IP-Address = 255.255.255.255
NAS-Port = 0
rad_lowerpair: User-Name now 'test
ops'
Processing the authorize section of
radiusd.conf
modcall: entering group authorize for
request 0
modcall[authorize]: module
"preprocess" returns ok for request 0
modcall[authorize]: module
"chap" returns noop for request 0
modcall[authorize]: module
"mschap" returns noop for request 0
rlm_realm: No '@' in
User-Name = "test ops", looking up realm NULL
rlm_realm: No such
realm "NULL"
modcall[authorize]: module
"suffix" returns noop for request 0
rlm_realm: No '\' in
User-Name = "test ops", looking up realm NULL
rlm_realm: No such
realm "NULL"
modcall[authorize]: module
"ntdomain" returns noop for request 0
rlm_eap: No EAP-Message, not doing
EAP
modcall[authorize]: module
"eap" returns noop for request 0
users: Matched DEFAULT
at 204
modcall[authorize]: module
"files" returns ok for request 0
modcall: group authorize returns ok for
request 0
rad_check_password: Found
Auth-Type win_domain
auth: type "win_domain"
Processing the authenticate section
of radiusd.conf
modcall: entering group Auth-Type for
request 0
radius_xlat: '/usr/bin/ntlm_auth
--username="test ops" --password="xxxxxx" --domain=usmisgnet'
Exec-Program: /usr/bin/ntlm_auth
--username="test ops" --password="xxxxxx"
--domain=usmisgnet
Exec-Program output:
NT_STATUS_NO_SUCH_USER: No such user (0xc0000064)
Exec-Program-Wait: plaintext:
NT_STATUS_NO_SUCH_USER: No such user (0xc0000064)
Exec-Program: returned: 1
rlm_exec (win_domain): External script
failed
modcall[authenticate]: module
"win_domain" returns fail for request 0
modcall: group Auth-Type returns fail for
request 0
auth: Failed to validate the user.
Login incorrect: [test ops] (from client
localhost port 0)
Delaying request 0 for 1 seconds
Finished request 0
Going to the next request
Thread 1 waiting to be assigned a request
rad_recv: Access-Request packet from host
127.0.0.1:32785, id=139, length=60
Sending Access-Reject of id 139 to
127.0.0.1:32785
--- Walking the entire request list ---
Waking up in 3 seconds...
--- Walking the entire request list ---
Cleaning up request 0 ID 139 with
timestamp 42d682b2
Nothing to do. Sleeping until we see
a request.
Systems and
Network Engineering
Mi Services
Group, Inc. 
+1 610-230-2500
x129