Hi, I´m having a problem deploying a FreeRadius server to authenticate Wireless users with an Active Directory. I get this message in the logs (user, challenge, domain and nt-response edited): Wed Dec 2 12:05:59 2009 : Debug: modsingle[authenticate]: calling mschap (rlm_mschap) for request 6 Wed Dec 2 12:05:59 2009 : Debug: rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. Wed Dec 2 12:05:59 2009 : Debug: rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. Wed Dec 2 12:05:59 2009 : Debug: rlm_mschap: Told to do MS-CHAPv2 for username with NT-Password Wed Dec 2 12:05:59 2009 : Debug: radius_xlat: Running registered xlat function of module mschap for string 'User-Name' Wed Dec 2 12:05:59 2009 : Debug: expand: --username=%{mschap:User-Name} -> --username=username Wed Dec 2 12:05:59 2009 : Debug: radius_xlat: Running registered xlat function of module mschap for string 'Challenge' Wed Dec 2 12:05:59 2009 : Debug: mschap2: 60 Wed Dec 2 12:05:59 2009 : Debug: expand: --challenge=%{mschap:Challenge:-00} -> --challenge=challenge Wed Dec 2 12:05:59 2009 : Debug: radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' Wed Dec 2 12:05:59 2009 : Debug: expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=nt-response Wed Dec 2 12:05:59 2009 : Debug: radius_xlat: Running registered xlat function of module mschap for string 'NT-Domain' Wed Dec 2 12:05:59 2009 : Debug: expand: --domain=%{mschap:NT-Domain} -> --domain=domain Wed Dec 2 12:05:59 2009 : Debug: Exec-Program output: Wed Dec 2 12:05:59 2009 : Debug: Exec-Program: returned: 1 Wed Dec 2 12:05:59 2009 : Debug: rlm_mschap: External script failed. Wed Dec 2 12:05:59 2009 : Debug: rlm_mschap: FAILED: MS-CHAP2-Response is incorrect Wed Dec 2 12:05:59 2009 : Debug: modsingle[authenticate]: returned from mschap (rlm_mschap) for request 6 Wed Dec 2 12:05:59 2009 : Debug: rlm_mschap: External script failed. Wed Dec 2 12:05:59 2009 : Debug: rlm_mschap: FAILED: MS-CHAP2-Response is incorrect If I execute in a shell the ntlm_auth with the same parameters as the log pointed I get an NT Key, so don´t really know why it's not working. I have tried varius solutions founded in internet without success. BTW, The entire log is attached (edited user, challenge.....). If needed I can send conf files. Thanks in advance. Unai.
Garcia Herguedas, Unai wrote:
Hi,
I´m having a problem deploying a FreeRadius server to authenticate Wireless users with an Active Directory.
If I execute in a shell the ntlm_auth with the same parameters as the log pointed I get an NT Key, so don´t really know why it's not working. I have tried varius solutions founded in internet without success.
Are you sure that the radius daemon user has permissions to run winbind? Check the permissions on /var/lib/samba/winbindd_privileged and also any SELinux policy, if you're running an SELinux-enabled distro.
BTW, The entire log is attached (edited user, challenge.....). If needed I can send conf files.
That's not helpful. Please run "radiusd -X" and send the output of a failing request. Please don't edit it unless you're certain the edits are for irrelevant security-critical data (the mschap challenge & response are not dangerous to disclose)
Phil Mayers wrote:
Garcia Herguedas, Unai wrote:
Hi,
I´m having a problem deploying a FreeRadius server to authenticate Wireless users with an Active Directory.
If I execute in a shell the ntlm_auth with the same parameters as the log pointed I get an NT Key, so don´t really know why it's not working. I have tried varius solutions founded in internet without success.
Are you sure that the radius daemon user has permissions to run winbind? Check the permissions on /var/lib/samba/winbindd_privileged and also any SELinux policy, if you're running an SELinux-enabled distro.
I don't have an /var/lib/samba/winbindd_privileged. I have /var/run/samba/winbindd_privileged which I assume is what you are referring. The permissionas are as follow: drwxr-x--- 2 root winbindd_priv 4096 2009-12-01 10:28 winbindd_privileged And the user freerad is part of the winbindd_priv group: winbindd_priv:x:105:freerad Don't have SELinux or AppArmor.
BTW, The entire log is attached (edited user, challenge.....). If needed I can send conf files.
That's not helpful. Please run "radiusd -X" and send the output of a failing request. Please don't edit it unless you're certain the edits are for irrelevant security-critical data (the mschap challenge & response are not dangerous to disclose)
The log that I attached previously was obtained with freeradius -X -xx -l /var/log/freeradius/radius.log
Garcia Herguedas, Unai wrote:
Phil Mayers wrote:
Garcia Herguedas, Unai wrote:
Hi,
I´m having a problem deploying a FreeRadius server to authenticate Wireless users with an Active Directory.
If I execute in a shell the ntlm_auth with the same parameters as the log pointed I get an NT Key, so don´t really know why it's not working. I have tried varius solutions founded in internet without success. Are you sure that the radius daemon user has permissions to run winbind? Check the permissions on /var/lib/samba/winbindd_privileged and also any SELinux policy, if you're running an SELinux-enabled distro.
I don't have an /var/lib/samba/winbindd_privileged. I have /var/run/samba/winbindd_privileged which I assume is what you are referring.
It's distribution-dependent, but yes, that's the file.
The permissionas are as follow: drwxr-x--- 2 root winbindd_priv 4096 2009-12-01 10:28 winbindd_privileged And the user freerad is part of the winbindd_priv group: winbindd_priv:x:105:freerad
Don't have SELinux or AppArmor.
You have a typo in your config: ntlm_auth = "usr/bin/ntlm_auth --request-nt-key You are missing a leading "/" from the binary, hence it's failing.
Phil Mayers wrote: You have a typo in your config:
ntlm_auth = "usr/bin/ntlm_auth --request-nt-key
You are missing a leading "/" from the binary, hence it's failing.
Typo corrected. Now It authenticated users but the Wireless Lan It's still not working. The Access Point is an HP Wireless Access Point 420 J8131B. ¿Any idea? Thanks. Unai.
I reboot the server and it's working know. Thanks for all. Unai. -----Mensaje original----- De: freeradius-users-bounces+u.garcia=ibermatica.com@lists.freeradius.org [mailto:freeradius-users-bounces+u.garcia=ibermatica.com@lists.freeradius.org] En nombre de Garcia Herguedas, Unai Enviado el: jueves, 03 de diciembre de 2009 11:35 Para: FreeRadius users mailing list Asunto: RE: MS-CHAP2 Response is incorrect.
Phil Mayers wrote: You have a typo in your config:
ntlm_auth = "usr/bin/ntlm_auth --request-nt-key
You are missing a leading "/" from the binary, hence it's failing.
Typo corrected. Now It authenticated users but the Wireless Lan It's still not working. The Access Point is an HP Wireless Access Point 420 J8131B. ¿Any idea? Thanks. Unai. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Garcia Herguedas, Unai -
Phil Mayers