Re: Configuring FreeRADIUS to use ntlm_auth
Alan:
Now I am trying to "Configuring my FreeRadius to use ntlm_auth for MS-CHAP" to authenticate my NT users, ok ?
The page does document that. ==> I am trying to following this document.
After that I configure the radiusd.conf file with the necessary changes (about ntlm_auth), I am trying to test the authenticate with a valid user of my NT Domain (by radtest) and the FreeRadius reject it.
radtest doesn't do MS-CHAP. The page tries to make this clear. ==> Sorry ... but I hadn´t understood it (I thought that just radclient doesn´t work). Now I know that radtest too ...
The output of my FreeRadius´s console: ... rad_check_password: Found Auth-Type System
You've done rather a lot more than just add "ntlm_auth" to the "authenticate" section. This means that the config that previously worked... now doesn't work. ==> I think this configuration is original (FreeRadius instalation´s). Because, in the previous test this configuration was already there. And the previous test works (Configuring FreeRADIUS to use ntlm_auth)! Go back to using the working configuration, and use a client that does MS-CHAP. This usually means trying a real login, without using "radtest" or "radclient". ==> I tried to use the working configuration with a real login, but the behavior is the same, it appears the message that you mencioned: "rad_check_password: Found Auth-Type System" Can you help me ? Best Regards, Charles.
Auth-Type System is coming from the DEFAULT entry towards the end of users file. Comment it out. Ivan Kalik Kalik Informatika ISP Dana 14/9/2007, "charles@copel.com" <charles@copel.com> piše:
Alan:
Now I am trying to "Configuring my FreeRadius to use ntlm_auth for MS-CHAP" to authenticate my NT users, ok ?
The page does document that. ==> I am trying to following this document.
After that I configure the radiusd.conf file with the necessary changes (about ntlm_auth), I am trying to test the authenticate with a valid user of my NT Domain (by radtest) and the FreeRadius reject it.
radtest doesn't do MS-CHAP. The page tries to make this clear. ==> Sorry ... but I hadn´t understood it (I thought that just radclient doesn´t work). Now I know that radtest too ...
The output of my FreeRadius´s console: .... rad_check_password: Found Auth-Type System
You've done rather a lot more than just add "ntlm_auth" to the "authenticate" section. This means that the config that previously worked... now doesn't work. ==> I think this configuration is original (FreeRadius instalation´s). Because, in the previous test this configuration was already there. And the previous test works (Configuring FreeRADIUS to use ntlm_auth)!
Go back to using the working configuration, and use a client that does MS-CHAP. This usually means trying a real login, without using "radtest" or "radclient". ==> I tried to use the working configuration with a real login, but the behavior is the same, it appears the message that you mencioned: "rad_check_password: Found Auth-Type System"
Can you help me ? Best Regards, Charles.
charles@copel.com wrote:
radtest doesn't do MS-CHAP. The page tries to make this clear. ==> Sorry ... but I hadn´t understood it (I thought that just radclient doesn´t work). Now I know that radtest too ...
radtest is just a shell script wrapper around radclient.
You've done rather a lot more than just add "ntlm_auth" to the "authenticate" section. This means that the config that previously worked... now doesn't work. ==> I think this configuration is original (FreeRadius instalation´s). Because, in the previous test this configuration was already there. And the previous test works (Configuring FreeRADIUS to use ntlm_auth)!
It's either the original FreeRADIUS config, or the one you modified to get the previous test to work. Which one is it?
==> I tried to use the working configuration with a real login, but the behavior is the same, it appears the message that you mencioned: "rad_check_password: Found Auth-Type System"
Yes... because your configuration for THIS test is not the same as for the LAST test.
Can you help me ?
Believe me, I'm trying. Alan DeKok.
participants (3)
-
Alan DeKok -
charles＠copel.com -
tnt＠kalik.co.yu