Has anyone gotten freeradius EAP-MSCHAPV2 authentication to work properly in samba versions beyond 3.0.30? On samba 3.3.8 I still get the same type of error I'd get as if I didn't have the xpextensions on my cert (Even though I do.) No response to access-challenge. If I go back to 3.0.30 it immediately works....Starting to run into a problem because 3.0.30 won't work will 2008 r2 domain controllers. Again my cert does have the xpextensions. And it does this to all clients,, not just Microsoft. Here's the end of my debug: [mschap] expand: --username=%{mschap:User-Name:-None} -> --username=tomtom [mschap] expand: %{mschap:NT-Domain} -> ADS [mschap] expand: --domain=%{%{mschap:NT-Domain}:-ADS} -> --domain=ADS [mschap] mschap2: d3 [mschap] Creating challenge hash with username: tomtom [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=ba19d84bdab789ef [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=27a757e4b32c51011216ac7fff78219563fc14af067f3d05 Exec-Program output: NT_KEY: D988C0C63F2D4C8034172DCBEB7B317F Exec-Program-Wait: plaintext: NT_KEY: D988C0C63F2D4C8034172DCBEB7B317F Exec-Program: returned: 0 [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010c00331a030b002e533d33333133453034393739353130383137303633423342413033324339383343383832413937323736 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3f8a0cb23e86164f4ea2f66ef66aa4ed [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010c00331a030b002e533d33333133453034393739353130383137303633423342413033324339383343383832413937323736 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3f8a0cb23e86164f4ea2f66ef66aa4ed [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 17 to 172.20.4.253 port 32769 EAP-Message = 0x010c005b19001703010050e5f53b91a3b5214c1a0f1ee21b46045f6992732a92d882e4359ed17b1dfffcb69d20d4645caa74a94ea448cd54c76c041c642d05801fa0a4f830247b30f9723884d6fbaa35f6b11398741f833bc68f08 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xedeb59b2eae740f09f949186981dc8bc Finished request 10. Going to the next request Waking up in 4.7 seconds. Cleaning up request 3 ID 10 with timestamp +11 Cleaning up request 4 ID 11 with timestamp +11 Cleaning up request 5 ID 12 with timestamp +11 Cleaning up request 6 ID 13 with timestamp +11 Cleaning up request 7 ID 14 with timestamp +11 Cleaning up request 8 ID 15 with timestamp +11 Waking up in 0.1 seconds. Cleaning up request 9 ID 16 with timestamp +11 Cleaning up request 10 ID 17 with timestamp +11 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0xedeb59b2eae740f0 did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Thomas E. Casartello, Jr. Staff Assistant - Wireless/Linux Administrator Information Technology Wilson 105A Westfield State College (413) 572-8245 Red Hat Certified Technician (RHCT) Cisco Certified Network Associate (CCNA)
On 01/11/2011 02:11 AM, Casartello, Thomas wrote:
Has anyone gotten freeradius EAP-MSCHAPV2 authentication to work properly in samba versions beyond 3.0.30? On samba 3.3.8 I still get the
Yes. We run the samba3x RHEL RPM, which is a version of 3.3.8 with patches. The specific fix you need is: https://bugzilla.samba.org/show_bug.cgi?id=7568
Does the samba 3x RHEL RPM already have that patch installed? That's exactly what I was running this last time when I tried it. Thomas E. Casartello, Jr. Staff Assistant - Wireless/Linux Administrator Information Technology Wilson 105A We tfield State College -----Original Message----- From: freeradius-users-bounces+tcasartello=wsc.ma.edu@lists.freeradius.org [mailto:freeradius-users-bounces+tcasartello=wsc.ma.edu@lists.freeradius.org] On Behalf Of Phil Mayers Sent: Tuesday, January 11, 2011 2:18 AM To: freeradius-users@lists.freeradius.org Subject: Re: samba > 3.0.33 On 01/11/2011 02:11 AM, Casartello, Thomas wrote:
Has anyone gotten freeradius EAP-MSCHAPV2 authentication to work properly in samba versions beyond 3.0.30? On samba 3.3.8 I still get the
Yes. We run the samba3x RHEL RPM, which is a version of 3.3.8 with patches. The specific fix you need is: https://bugzilla.samba.org/show_bug.cgi?id=7568 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 01/11/2011 10:13 PM, Casartello, Thomas wrote:
Does the samba 3x RHEL RPM already have that patch installed? That's exactly what I was running this last time when I tried it.
We are running against 2008R2 AD controllers without problem using that RPM, so I guess so.
In your config file what are you using for an ntlm_auth command? This is what I'm using ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-ADS} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Thomas E. Casartello, Jr. Staff Assistant - Wireless/Linux Administrator Information Technology Wilson 105A We tfield State College -----Original Message----- From: freeradius-users-bounces+tcasartello=wsc.ma.edu@lists.freeradius.org [mailto:freeradius-users-bounces+tcasartello=wsc.ma.edu@lists.freeradius.org] On Behalf Of Phil Mayers Sent: Wednesday, January 12, 2011 5:12 AM To: freeradius-users@lists.freeradius.org Subject: Re: samba > 3.0.33 On 01/11/2011 10:13 PM, Casartello, Thomas wrote:
Does the samba 3x RHEL RPM already have that patch installed? That's exactly what I was running this last time when I tried it.
We are running against 2008R2 AD controllers without problem using that RPM, so I guess so. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I've got it working somewhat. It works for a while and then stops working. When I restart smb and winbind it starts working again for a while and then stops. Is there some kind of cache that samba uses that gets cleared when you restart it that might be causing it? Thomas E. Casartello, Jr. Staff Assistant - Wireless/Linux Administrator Information Technology Wilson 105A Wetfield State College -----Original Message----- From: freeradius-users-bounces+tcasartello=wsc.ma.edu@lists.freeradius.org [mailto:freeradius-users-bounces+tcasartello=wsc.ma.edu@lists.freeradius.org] On Behalf Of Casartello, Thomas Sent: Wednesday, January 12, 2011 4:10 PM To: freeradius-users@lists.freeradius.org Subject: RE: samba > 3.0.33 In your config file what are you using for an ntlm_auth command? This is what I'm using ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-ADS} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Thomas E. Casartello, Jr. Staff Assistant - Wireless/Linux Administrator Information Technology Wilson 105A We tfield State College -----Original Message----- From: freeradius-users-bounces+tcasartello=wsc.ma.edu@lists.freeradius.org [mailto:freeradius-users-bounces+tcasartello=wsc.ma.edu@lists.freeradius.org] On Behalf Of Phil Mayers Sent: Wednesday, January 12, 2011 5:12 AM To: freeradius-users@lists.freeradius.org Subject: Re: samba > 3.0.33 On 01/11/2011 10:13 PM, Casartello, Thomas wrote:
Does the samba 3x RHEL RPM already have that patch installed? That's exactly what I was running this last time when I tried it.
We are running against 2008R2 AD controllers without problem using that RPM, so I guess so. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Casartello, Thomas wrote:
I've got it working somewhat. It works for a while and then stops working. When I restart smb and winbind it starts working again for a while and then stops. Is there some kind of cache that samba uses that gets cleared when you restart it that might be causing it?
See the comments in eap.conf, about a Samba bug. It has been fixed in newer versions of Samba. Alan DeKok.
Thank you very much for pointing that out. I never noticed that in the eap.conf file. When I added the winbind:forcesamlogon = True That finally fixed it. I've been plagued by this issue everytime I've tried to upgrade beyond the 3.0.* line. I never saw the info about this fix. Thanks for pointing it out. Tom Thomas E. Casartello, Jr. Staff Assistant - Wireless/Linux Administrator Information Technology Wilson 105A We tfield State College -----Original Message----- From: freeradius-users-bounces+tcasartello=wsc.ma.edu@lists.freeradius.org [mailto:freeradius-users-bounces+tcasartello=wsc.ma.edu@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Thursday, January 13, 2011 3:24 AM To: FreeRadius users mailing list Subject: Re: samba > 3.0.33 Casartello, Thomas wrote:
I've got it working somewhat. It works for a while and then stops working. When I restart smb and winbind it starts working again for a while and then stops. Is there some kind of cache that samba uses that gets cleared when you restart it that might be causing it?
See the comments in eap.conf, about a Samba bug. It has been fixed in newer versions of Samba. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 13/01/11 01:19, Casartello, Thomas wrote:
I've got it working somewhat. It works for a while and then stops working. When I restart smb and winbind it starts working again for a while and then stops. Is there some kind of cache that samba uses that gets cleared when you restart it that might be causing it?
No idea. We don't see that. I would suggest a couple of things: 1. Run FreeRadius in debug mode (-X) and do a test auth. Capture the ntlm_auth command and save it so you can re-run it later 2. Re-start FreeRadius normally 3. Wait until it stops working 4. Run the ntlm_auth command from the CLI and examine the /var/log/samba/* files to see if anything obvious complains; possibly perform a "tcpdump" at the same time to see which DC your winbind is talking to, and if there's any obvious problem on-the-wire; examine the logs on that DC to see if there are any obvious problems there ...but it sounds like a Samba problem.
On 12/01/11 21:09, Casartello, Thomas wrote:
In your config file what are you using for an ntlm_auth command? This is what I'm using
ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{mschap:User-Name}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"
participants (3)
-
Alan DeKok -
Casartello, Thomas -
Phil Mayers