I just figured it out. I had to add radiusd to the wbpriv group. -b On 02/03/2014 11:14 AM, Brian C. Huffman wrote:
All,
I'm trying to configure freeradius to work with Samba winbind. Winbind seems to be working, but I'm having issues when I try to integrate freeradius.
I've got the following versions installed: [root@auth01 raddb]# more /etc/redhat-release CentOS release 6.5 (Final) [root@auth01 raddb]# rpm -qa |grep winbind samba-winbind-clients-3.6.9-167.el6_5.x86_64 samba-winbind-3.6.9-167.el6_5.x86_64 [root@auth01 raddb]# rpm -qa |grep freeradius freeradius-2.1.12-4.el6_3.x86_64 freeradius-utils-2.1.12-4.el6_3.x86_64
wbinfo -u works.
This works as well: [root@auth01 raddb]# ntlm_auth --request-nt-key --domain=ETI --username=bhuffman --password=<pass_removed> NT_STATUS_OK: Success (0x0)
I've followed this guide for configuring freeradius: http://deployingradius.com/documents/configuration/active_directory.html
Running the test with basic ntlm_auth also works. But when I try to use mschap, it fails:
rad_recv: Access-Request packet from host 127.0.0.1 port 36958, id=54, length=134 User-Name = "bhuffman" NAS-IP-Address = 192.168.12.13 NAS-Port = 0 Message-Authenticator = 0x5218e5194bf4c321ed41c29cd6d10690 MS-CHAP-Challenge = 0x1491f6269d04d59a MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000bdf10bf06b435645c7db6279bba9c4765c16c9fcd06dcd03 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok ++[digest] returns noop [suffix] No '@' in User-Name = "bhuffman", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv1 with NT-Password [mschap] expand: %{Stripped-User-Name} -> [mschap] ... expanding second conditional [mschap] expand: %{User-Name} -> bhuffman [mschap] expand: %{%{User-Name}:-None} -> bhuffman [mschap] expand: --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} -> --username=bhuffman [mschap] No NT-Domain was found in the User-Name. [mschap] expand: %{mschap:NT-Domain} -> [mschap] ... expanding second conditional [mschap] expand: --domain=%{%{mschap:NT-Domain}:-ETI} -> --domain=ETI [mschap] mschap1: 14 [mschap] expand: %{mschap:Challenge} -> 1491f6269d04d59a [mschap] expand: --challenge=%{%{mschap:Challenge}:-00} -> --challenge=1491f6269d04d59a [mschap] expand: %{mschap:NT-Response} -> bdf10bf06b435645c7db6279bba9c4765c16c9fcd06dcd03 [mschap] expand: --nt-response=%{%{mschap:NT-Response}:-00} -> --nt-response=bdf10bf06b435645c7db6279bba9c4765c16c9fcd06dcd03 Exec-Program output: Reading winbind reply failed! (0xc0000001) Exec-Program-Wait: plaintext: Reading winbind reply failed! (0xc0000001) Exec-Program: returned: 1 [mschap] External script failed. [mschap] MS-CHAP-Response is incorrect. ++[mschap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> bhuffman attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 54 to 127.0.0.1 port 36958 MS-CHAP-Error = "\000E=691 R=1"
Can anyone help me to troubleshoot this?
Thanks, Brian
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html