On 09/21/2015 03:16 PM, Matthew Newton wrote:
On Mon, Sep 21, 2015 at 02:57:07PM -0500, Alex Moen wrote:
(12) User-Name = "debio@ndtel.com" ... rlm_ldap (ldap): Connecting to ldap://66.163.129.140:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Reserved connection (7) (19) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (19) ldap: --> (uid=debio) (19) ldap: Performing search in "o=ndtc" with filter "(uid=debio)", scope "sub" (19) ldap: Waiting for search result... (19) ldap: Search returned no results
^^^ this ^^^
Your LDAP search is failing for user debio...
...
(19) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (19) mschap: WARNING: No Cleartext-Password configured. Cannot create LM-Password (19) mschap: Creating challenge hash with username: debio@ndtel.com (19) mschap: Client is using MS-CHAPv2 (19) mschap: ERROR: FAILED: No NT/LM-Password. Cannot perform authentication
(21) User-Name = "alexm@ndtel.com" ... rlm_ldap (ldap): Connecting to ldap://66.163.129.140:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Reserved connection (10) (28) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (28) ldap: --> (uid=alexm) (28) ldap: Performing search in "o=ndtc" with filter "(uid=alexm)", scope "sub" (28) ldap: Waiting for search result... (28) ldap: User object found at DN "uid=alexm,ou=ndtcadministration,o=ndtc" (28) ldap: Processing user attributes (28) ldap: control:Password-With-Header += 'ose55m1'
...but fine for alexm.
...
(28) pap: No {...} in Password-With-Header, re-writing to Cleartext-Password (28) pap: Removing &control:Password-With-Header ... (28) mschap: Found Cleartext-Password, hashing to create NT-Password (28) mschap: Found Cleartext-Password, hashing to create LM-Password (28) mschap: Creating challenge hash with username: alexm@ndtel.com (28) mschap: Client is using MS-CHAPv2 (28) mschap: Adding MS-CHAPv2 MPPE keys (28) [mschap] = ok
So FreeRADIUS can't get a password, hence mschap fails.
When you bind as the same account FR binds as and do a search as below, does it find anything?
(19) ldap: Performing search in "o=ndtc" with filter "(uid=debio)", scope "sub"
Matthew
In a word, yes. Here's a copy of the output from the server running FreeRADIUS: [root@ndtc-fs]# ldapsearch -x -H ldap://66.163.129.140 -D 'cn=admin,o=ndtc' -W -b 'uid=debio@ndtel.com,ou=ndtel,o=ndtc' -s sub Enter LDAP Password: # extended LDIF # # LDAPv3 # base <uid=debio@ndtel.com,ou=ndtel,o=ndtc> with scope subtree # filter: (objectclass=*) # requesting: ALL # # debio@ndtel.com, ndtel, ndtc dn: uid=debio@ndtel.com,ou=ndtel,o=ndtc uid: debio@ndtel.com cn: Debi sn: O mail: debio@ndtel.com uidNumber: 640 homeDirectory: /cust/ndtel/users/debio gecos: Debi Ohma,, objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: sambaSamAccount objectClass: mailUser loginShell: /bin/bash sambaLogonTime: 0 sambaLogoffTime: 2147483647 sambaKickoffTime: 2147483647 sambaPwdCanChange: 0 sambaSID: S-1-5-21-3311107553-3899660464-2674327009-2280 sambaHomeDrive: F: sambaHomePath: \\ndtc-fs\cust\ndtel\users gidNumber: 500 sambaPrimaryGroupSID: S-1-5-21-3311107553-3899660464-2674327009-2001 shadowExpire: -1 sambaLMPassword: B15F999EA3OBFUSCATED!NOTHING2SEE sambaAcctFlags: [U] sambaNTPassword: 6F005855B7OBFUSCATED!NOTHING2SEE sambaPwdLastSet: 1390515443 sambaPwdMustChange: 1394403443 shadowLastChange: 16093 shadowMax: 99999 userPassword:: e1NTSEF9cEkwUUOBFUSCATED!NOTHING2SEERWJ5VFlLTVkyUzk= # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 -- Alex Moen NSTII North Dakota Telephone Company 701-662-6481