MSChap via ntlm_auth problem
Hi! I tried to use aythentication via Active Directory domain. FreeRadius 2.1.6 return error: [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for BAS with NT-Password [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] expand: --username=%{Stripped-User-Name:-%{User-Name:-None}} -> --username=BAS [mschap] mschap2: bb [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=256c4a167da6dfb6 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=d57ebadb8c21cc5b95dfc9022b621678897e529734e979ba Exec-Program output: Exec-Program: Abnormal child exit: Invalid argument [mschap] External script failed. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. If I call ntlm_auth from shell I get right answer. It was tested with samba-3.0.35 and samba 3.3.4. My radiusd.conf, modules/mschap and dump of radiusd output in attachments. Thanks, Anton.
hi, whoa! you are piping the output via tee to a log file - therefore the code isnt getting the return value - hence the badness. alan
2009/8/17 Alan Buxey <A.L.M.Buxey@lboro.ac.uk>
whoa! you are piping the output via tee to a log file - therefore the code isnt getting the return value - hence the badness.
How can I get return value? 2009/8/17 Garber, Neal <Neal.Garber@energyeast.com>:
Try removing the single double quote (“) just before the last right curly brace (“}”) at the bottom of the mschap file
Sorry, it's casual noise. It's not a cause of problem. Thanks, Anton.
Anton Brinyov wrote:
2009/8/17 Alan Buxey <A.L.M.Buxey@lboro.ac.uk>
whoa! you are piping the output via tee to a log file - therefore the code isnt getting the return value - hence the badness.
How can I get return value?
Don't use the pipe. Use ntlm_auth as configured in the mschap module, without any extra changes. Alan DeKok.
2009/8/18 Alan DeKok <aland@deployingradius.com>:
Don't use the pipe. Use ntlm_auth as configured in the mschap module, without any extra changes.
Oh, sorry. I tried to get some about ntlm_auth output and forgot to remove changes. I delete pipe but it did't remove problem.
Hi,
Oh, sorry. I tried to get some about ntlm_auth output and forgot to remove changes.
I delete pipe but it did't remove problem.
..now post the debug again
Please, find in attachment. Nothing changed.
hmm, not sure about the require-membership bit as I've never used it. which version of SAMBA are you running? Latest version is known to have issues - they've changed things with its output. also, recommend you change the command to have this instead --username=%{Stripped-User-Name:-%{User-Name:-None}} that'll get rid of that annoying output error alan
Hi, 2009/8/18 Alan Buxey <A.L.M.Buxey@lboro.ac.uk>:
hmm, not sure about the require-membership bit as I've never used it.
The problem appears in any case - with or without require-membership option.
which version of SAMBA are you running? Latest version is known to have issues - they've changed things with its output.
I use samba 3.0.35 on FreeBSD 7.2 box.
also, recommend you change the command to have this instead
--username=%{Stripped-User-Name:-%{User-Name:-None}}
that'll get rid of that annoying output error
I have the following command: ntlm_auth = "/usr/local/bin/ntlm_auth --request-nt-key --require-membership-of=CENTAURA+InternetUsers --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" If I call it from shell with options from radius request - I get result: # /usr/local/bin/ntlm_auth --request-nt-key --require-membership-of=CENTAURA+InternetUsers --username=BAS --challenge=6b6f49357dccee7c --nt-response=ce2480f1e35c222a4d3481b83ee78854094394517f29d9ec NT_KEY: A9B342EC3E218E54A330556C468415CD What can I do for getting some details about error? Thanks, Anton.
Hi,
The problem appears in any case - with or without require-membership option.
which version of SAMBA are you running? Latest version is known to have issues - they've changed things with its output.
I use samba 3.0.35 on FreeBSD 7.2 box.
also, recommend you change the command to have this instead
--username=%{Stripped-User-Name:-%{User-Name:-None}}
that'll get rid of that annoying output error
I have the following command:
ntlm_auth = "/usr/local/bin/ntlm_auth --request-nt-key --require-membership-of=CENTAURA+InternetUsers --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"
If I call it from shell with options from radius request - I get result:
# /usr/local/bin/ntlm_auth --request-nt-key --require-membership-of=CENTAURA+InternetUsers --username=BAS --challenge=6b6f49357dccee7c --nt-response=ce2480f1e35c222a4d3481b83ee78854094394517f29d9ec
NT_KEY: A9B342EC3E218E54A330556C468415CD
What can I do for getting some details about error?
<clutching at straws> maybe escape the + in your command (ie \+ ? </clutching> alan
2009/8/18 Alan Buxey <A.L.M.Buxey@lboro.ac.uk>:
Hi,
The problem appears in any case - with or without require-membership option.
which version of SAMBA are you running? Latest version is known to have issues - they've changed things with its output.
I use samba 3.0.35 on FreeBSD 7.2 box.
also, recommend you change the command to have this instead
--username=%{Stripped-User-Name:-%{User-Name:-None}}
that'll get rid of that annoying output error
I have the following command:
ntlm_auth = "/usr/local/bin/ntlm_auth --request-nt-key --require-membership-of=CENTAURA+InternetUsers --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"
If I call it from shell with options from radius request - I get result:
# /usr/local/bin/ntlm_auth --request-nt-key --require-membership-of=CENTAURA+InternetUsers --username=BAS --challenge=6b6f49357dccee7c --nt-response=ce2480f1e35c222a4d3481b83ee78854094394517f29d9ec
NT_KEY: A9B342EC3E218E54A330556C468415CD
What can I do for getting some details about error?
<clutching at straws> maybe escape the + in your command (ie \+ ? </clutching>
*The problem appears in any case - with or without require-membership option.* The command can be looked like ntlm_auth = "/usr/local/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" And output is the same as in previous case. Thanks, Anton
Hi, I have another freeradius host (freeradius 2.1.3) with the same authentication scheme. I look at debug output on it: Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for BAS with NT-Password [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] expand: --username=%{Stripped-User-Name:-%{User-Name:-None}} -> --username=BAS [mschap] mschap2: bb [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=205180e1818e1214 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=0a9b4e0053367b750904915b08aa65b792be3274e312aa78 Exec-Program output: NT_KEY: A9B342EC3E218E54A330556C468415CD Exec-Program-Wait: plaintext: NT_KEY: A9B342EC3E218E54A330556C468415CD Exec-Program: returned: 0 [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok ntlm_auth comands is the same on both hosts. The difference is "Exec-Program output:" Why? Thanks, Anton. 2009/8/18 Anton Brinyov <anton.brinyov@gmail.com>:
2009/8/18 Alan Buxey <A.L.M.Buxey@lboro.ac.uk>:
Hi,
The problem appears in any case - with or without require-membership option.
which version of SAMBA are you running? Latest version is known to have issues - they've changed things with its output.
I use samba 3.0.35 on FreeBSD 7.2 box.
also, recommend you change the command to have this instead
--username=%{Stripped-User-Name:-%{User-Name:-None}}
that'll get rid of that annoying output error
I have the following command:
ntlm_auth = "/usr/local/bin/ntlm_auth --request-nt-key --require-membership-of=CENTAURA+InternetUsers --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"
If I call it from shell with options from radius request - I get result:
# /usr/local/bin/ntlm_auth --request-nt-key --require-membership-of=CENTAURA+InternetUsers --username=BAS --challenge=6b6f49357dccee7c --nt-response=ce2480f1e35c222a4d3481b83ee78854094394517f29d9ec
NT_KEY: A9B342EC3E218E54A330556C468415CD
What can I do for getting some details about error?
<clutching at straws> maybe escape the + in your command (ie \+ ? </clutching>
*The problem appears in any case - with or without require-membership option.* The command can be looked like
ntlm_auth = "/usr/local/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"
And output is the same as in previous case.
Thanks, Anton
Hi,
I have another freeradius host (freeradius 2.1.3) with the same authentication scheme. I look at debug output on it:
Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for BAS with NT-Password [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] expand: --username=%{Stripped-User-Name:-%{User-Name:-None}} -> --username=BAS [mschap] mschap2: bb [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=205180e1818e1214 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=0a9b4e0053367b750904915b08aa65b792be3274e312aa78 Exec-Program output: NT_KEY: A9B342EC3E218E54A330556C468415CD Exec-Program-Wait: plaintext: NT_KEY: A9B342EC3E218E54A330556C468415CD Exec-Program: returned: 0 [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok
ntlm_auth comands is the same on both hosts.
The difference is "Exec-Program output:"
Why?
your previous emails only listed the mschap module and radiusd.conf - but not the sites-enabled/default or sites-enabled/inner-tunnel files..... alan
Here my sites-enabled/default and sites-enabled/inner-tunnel files. Thanks, Anton 2009/8/19 Alan Buxey <A.L.M.Buxey@lboro.ac.uk>:
Hi,
I have another freeradius host (freeradius 2.1.3) with the same authentication scheme. I look at debug output on it:
Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for BAS with NT-Password [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] expand: --username=%{Stripped-User-Name:-%{User-Name:-None}} -> --username=BAS [mschap] mschap2: bb [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=205180e1818e1214 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=0a9b4e0053367b750904915b08aa65b792be3274e312aa78 Exec-Program output: NT_KEY: A9B342EC3E218E54A330556C468415CD Exec-Program-Wait: plaintext: NT_KEY: A9B342EC3E218E54A330556C468415CD Exec-Program: returned: 0 [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok
ntlm_auth comands is the same on both hosts.
The difference is "Exec-Program output:"
Why?
your previous emails only listed the mschap module and radiusd.conf - but not the sites-enabled/default or sites-enabled/inner-tunnel files.....
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Here are my sites-enabled/default and sites-enabled/inner-tunnel files. Thanks, Anton 2009/8/19 Alan Buxey <A.L.M.Buxey@lboro.ac.uk>:
Hi,
I have another freeradius host (freeradius 2.1.3) with the same authentication scheme. I look at debug output on it:
Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for BAS with NT-Password [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] expand: --username=%{Stripped-User-Name:-%{User-Name:-None}} -> --username=BAS [mschap] mschap2: bb [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=205180e1818e1214 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=0a9b4e0053367b750904915b08aa65b792be3274e312aa78 Exec-Program output: NT_KEY: A9B342EC3E218E54A330556C468415CD Exec-Program-Wait: plaintext: NT_KEY: A9B342EC3E218E54A330556C468415CD Exec-Program: returned: 0 [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok
ntlm_auth comands is the same on both hosts.
The difference is "Exec-Program output:"
Why?
your previous emails only listed the mschap module and radiusd.conf - but not the sites-enabled/default or sites-enabled/inner-tunnel files.....
alan -
Hi, I try to move samba's ntlm_auth program and replace it by simple shell script: #!/bin/sh echo "Test!" But NOTHING CHANGED! I think, radius don't call ntlm_auth program, but I don't know why. Thanks, Anton 2009/8/20 Anton Brinyov <anton.brinyov@gmail.com>:
Here are my sites-enabled/default and sites-enabled/inner-tunnel files.
Thanks, Anton
2009/8/19 Alan Buxey <A.L.M.Buxey@lboro.ac.uk>:
Hi,
I have another freeradius host (freeradius 2.1.3) with the same authentication scheme. I look at debug output on it:
Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for BAS with NT-Password [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] expand: --username=%{Stripped-User-Name:-%{User-Name:-None}} -> --username=BAS [mschap] mschap2: bb [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=205180e1818e1214 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=0a9b4e0053367b750904915b08aa65b792be3274e312aa78 Exec-Program output: NT_KEY: A9B342EC3E218E54A330556C468415CD Exec-Program-Wait: plaintext: NT_KEY: A9B342EC3E218E54A330556C468415CD Exec-Program: returned: 0 [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok
ntlm_auth comands is the same on both hosts.
The difference is "Exec-Program output:"
Why?
your previous emails only listed the mschap module and radiusd.conf - but not the sites-enabled/default or sites-enabled/inner-tunnel files.....
alan -
Oh! I notice in /var/log/messages follow line after each auth attempt: Aug 22 18:28:33 gate1 kernel: pid 78473 (radiusd), uid 133: exited on signal 12 Thanks, Anton 2009/8/22 Anton Brinyov <anton.brinyov@gmail.com>:
Hi,
I try to move samba's ntlm_auth program and replace it by simple shell script:
#!/bin/sh echo "Test!"
But NOTHING CHANGED!
I think, radius don't call ntlm_auth program, but I don't know why.
Thanks, Anton
2009/8/20 Anton Brinyov <anton.brinyov@gmail.com>:
Here are my sites-enabled/default and sites-enabled/inner-tunnel files.
Thanks, Anton
2009/8/19 Alan Buxey <A.L.M.Buxey@lboro.ac.uk>:
Hi,
I have another freeradius host (freeradius 2.1.3) with the same authentication scheme. I look at debug output on it:
Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for BAS with NT-Password [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] expand: --username=%{Stripped-User-Name:-%{User-Name:-None}} -> --username=BAS [mschap] mschap2: bb [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=205180e1818e1214 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=0a9b4e0053367b750904915b08aa65b792be3274e312aa78 Exec-Program output: NT_KEY: A9B342EC3E218E54A330556C468415CD Exec-Program-Wait: plaintext: NT_KEY: A9B342EC3E218E54A330556C468415CD Exec-Program: returned: 0 [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok
ntlm_auth comands is the same on both hosts.
The difference is "Exec-Program output:"
Why?
your previous emails only listed the mschap module and radiusd.conf - but not the sites-enabled/default or sites-enabled/inner-tunnel files.....
alan -
Hmmm... Problem was solved by recompiling kernel and freeradius. Thanks, Anton. 2009/8/22 Anton Brinyov <anton.brinyov@gmail.com>:
Oh!
I notice in /var/log/messages follow line after each auth attempt:
Aug 22 18:28:33 gate1 kernel: pid 78473 (radiusd), uid 133: exited on signal 12
Thanks, Anton
2009/8/22 Anton Brinyov <anton.brinyov@gmail.com>:
Hi,
I try to move samba's ntlm_auth program and replace it by simple shell script:
#!/bin/sh echo "Test!"
But NOTHING CHANGED!
I think, radius don't call ntlm_auth program, but I don't know why.
Thanks, Anton
2009/8/20 Anton Brinyov <anton.brinyov@gmail.com>:
Here are my sites-enabled/default and sites-enabled/inner-tunnel files.
Thanks, Anton
2009/8/19 Alan Buxey <A.L.M.Buxey@lboro.ac.uk>:
Hi,
I have another freeradius host (freeradius 2.1.3) with the same authentication scheme. I look at debug output on it:
Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for BAS with NT-Password [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] expand: --username=%{Stripped-User-Name:-%{User-Name:-None}} -> --username=BAS [mschap] mschap2: bb [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=205180e1818e1214 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=0a9b4e0053367b750904915b08aa65b792be3274e312aa78 Exec-Program output: NT_KEY: A9B342EC3E218E54A330556C468415CD Exec-Program-Wait: plaintext: NT_KEY: A9B342EC3E218E54A330556C468415CD Exec-Program: returned: 0 [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok
ntlm_auth comands is the same on both hosts.
The difference is "Exec-Program output:"
Why?
your previous emails only listed the mschap module and radiusd.conf - but not the sites-enabled/default or sites-enabled/inner-tunnel files.....
alan -
participants (4)
-
Alan Buxey -
Alan DeKok -
Anton Brinyov -
Garber, Neal