802.1x machine authentication patch help
Hi Jamie, Marco from BBC in london. I have read your message (http://lists.cistron.nl/pipermail/freeradius-users/2005-November/048576 .html related to the error when the radius is trying to authenticate in AD and I am getting exactly the same message. "No logon workstation trust account (0xc0000199)". The article is dated Nov 2005 so I hope you have the solution by now! ;-) How did you fix the problem? I cant find any resolution on the net. Thanks Marco This email may contain confidential information. If you receive it in error please immediately advise the sender and delete it from your system without copying, distributing or taking any action in reliance upon it. Red Bee Media Limited has taken precautions in respect of its email communications to preserve confidentiality and to ensure that any attachment has been checked for viruses. However, we cannot accept liability for any damage sustained as a result of interceptions and software viruses and you should take your own precautions before responding to us by email and carry out your own virus checks before opening any attachment. Red Bee Media Limited Registered No: 04257461 England Registered Office: BC2 A1 Broadcast Centre, 201 Wood Lane, London W12 7TP
On Fri, 2007-09-28 at 12:06 +0100, Marco Casulli wrote:
Hi Jamie,
Marco from BBC in london.
I have read your message (http://lists.cistron.nl/pipermail/freeradius-users/2005-November/048576.html related to the error when the radius is trying to authenticate in AD and I am getting exactly the same message.
"No logon workstation trust account (0xc0000199)".
The article is dated Nov 2005 so I hope you have the solution by now! ;-)
You need a suitably recent version of Samba. I can't remember the exact version number, but I'm sure judicious use of Google will find it, or just use the most recent.
Thanks for your reply Phil, However how is samba related to this error? This is an error coming from the AD server no able to authenticate a user. Thanks Marco -----Original Message----- From: freeradius-users-bounces@lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Phil Mayers Sent: 01 October 2007 09:55 To: FreeRadius users mailing list Subject: Re: 802.1x machine authentication patch help On Fri, 2007-09-28 at 12:06 +0100, Marco Casulli wrote:
Hi Jamie,
Marco from BBC in london.
I have read your message (http://lists.cistron.nl/pipermail/freeradius-users/2005-November/0485 76.html related to the error when the radius is trying to authenticate
in AD and I am getting exactly the same message.
"No logon workstation trust account (0xc0000199)".
The article is dated Nov 2005 so I hope you have the solution by now! ;-)
You need a suitably recent version of Samba. I can't remember the exact version number, but I'm sure judicious use of Google will find it, or just use the most recent. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________ ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________ This email may contain confidential information. If you receive it in error please immediately advise the sender and delete it from your system without copying, distributing or taking any action in reliance upon it. Red Bee Media Limited has taken precautions in respect of its email communications to preserve confidentiality and to ensure that any attachment has been checked for viruses. However, we cannot accept liability for any damage sustained as a result of interceptions and software viruses and you should take your own precautions before responding to us by email and carry out your own virus checks before opening any attachment. Red Bee Media Limited Registered No: 04257461 England Registered Office: BC2 A1 Broadcast Centre, 201 Wood Lane, London W12 7TP
Marco Casulli wrote:
However how is samba related to this error?
This is an error coming from the AD server no able to authenticate a user.
If you're not going to believe the answers on this list, I don't see why you're asking questions here. Q: Are you using Samba? Yes: upgrade as you were told to do No: You can't get the error message you posted without using Samba, so you ARE using Samba. Alan DeKok.
Touchy! :-) I was only asking as I am not an expert on this subject and wanted to understand why Samba came in the loop? Now that you have clarified the point it makes sense. I will follow your advice. Thanks Alan -----Original Message----- From: freeradius-users-bounces@lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 01 October 2007 10:20 To: FreeRadius users mailing list Subject: Re: 802.1x machine authentication patch help Marco Casulli wrote:
However how is samba related to this error?
This is an error coming from the AD server no able to authenticate a user.
If you're not going to believe the answers on this list, I don't see why you're asking questions here. Q: Are you using Samba? Yes: upgrade as you were told to do No: You can't get the error message you posted without using Samba, so you ARE using Samba. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________ ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________ This email may contain confidential information. If you receive it in error please immediately advise the sender and delete it from your system without copying, distributing or taking any action in reliance upon it. Red Bee Media Limited has taken precautions in respect of its email communications to preserve confidentiality and to ensure that any attachment has been checked for viruses. However, we cannot accept liability for any damage sustained as a result of interceptions and software viruses and you should take your own precautions before responding to us by email and carry out your own virus checks before opening any attachment. Red Bee Media Limited Registered No: 04257461 England Registered Office: BC2 A1 Broadcast Centre, 201 Wood Lane, London W12 7TP
On Mon, 2007-10-01 at 10:41 +0100, Marco Casulli wrote:
Touchy! :-)
Read this list for a while, then you'll see why people get irate when their advice isn't followed ;o)
I was only asking as I am not an expert on this subject and wanted to understand why Samba came in the loop?
In a domain environment, FreeRadius authenticates mschap by a callout to the Samba "ntlm_auth" program; this in turn makes an RPC call to the domain controller. In older versions of samba, the RPC call lacks the flag to say "machine accounts are acceptable here", so they fail authentication. In later versions, the flag is present.
participants (3)
-
Alan DeKok -
Marco Casulli -
Phil Mayers