Hello, I installed Freeradius version 3 on CentOS 6.5 this morning and I am having trouble authenticating against my domain controllers. The following tests work: -------------------------- [root@cshq]# wbinfo -a chicken%password plaintext password authentication failed Could not authenticate user chicken%password with plaintext password challenge/response password authentication succeeded ----------------------------------- --------------------------------- [root@cshq]# ntlm_auth --request-nt-key --domain=domain.net --username=chicken password: NT_STATUS_OK: Success (0x0) --------------------------------- I can successfully authenticate using the radtest command with the -t mschap flag enabled, but when I remove the -t mschap flag, it fails. I have attached the two different debug outputs for each result. Any help would be greatly appreciated. ------------------------------------ [root@cshq]# radtest chicken <password> 127.0.0.1 0 testing123 Sent Access-Request Id 126 from 0.0.0.0:54228 to 127.0.0.1:1812 length 80 User-Name = "chicken" User-Password = "<password>" NAS-IP-Address = 172.16.50.40 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "<password>" Received Access-Reject Id 126 from 127.0.0.1:1812 to 0.0.0.0:0 length 20 (0) -: Expected Access-Accept got Access-Reject ------------------------------ [root@cshq]# radtest -t mschap chicken <password> 127.0.0.1 0 testing123 Sent Access-Request Id 232 from 0.0.0.0:45738 to 127.0.0.1:1812 length 136 User-Name = "chicken" MS-CHAP-Password = "<password>" NAS-IP-Address = 172.16.50.40 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "<password>" MS-CHAP-Challenge = 0x27572b879bc37cd5 MS-CHAP-Response = 0x00010000000000000000000000000000000000000000000000003446fe427512934fce4d2bed4172dfb37fa43ab483323a01 Received Access-Accept Id 232 from 127.0.0.1:1812 to 0.0.0.0:0 length 84 MS-CHAP-MPPE-Keys = 0x0000000000000000b598b791 MS-MPPE-Encryption-Policy = Encryption-Required MS-MPPE-Encryption-Types = 4
Hi, read the output of radiusd -X , look at the error meesages eg: ntlm_auth: ERROR: Program returned code (1) and output 'NT_STATUS_NO_SUCH_USER: No such user (0xc0000064)' no such user. quite clear? also, you need to fix your entry in clients.conf - server is telling you to. alan
On Sun, Oct 18, 2015 at 06:09:42AM -0400, Michael Price wrote:
program = "/usr/bin/ntlm_auth --request-nt-key --domain=domain.netN --username=%{mschap:User-Name} --password=%{User-Password}" ... (0) ntlm_auth: Executing: /usr/bin/ntlm_auth --request-nt-key --domain=domain.netN --username=%{mschap:User-Name} --password=%{User-Password}:
--domain=domain.netN - typo
(0) ntlm_auth: EXPAND --username=%{mschap:User-Name} (0) ntlm_auth: --> --username=chicken (0) ntlm_auth: EXPAND --password=%{User-Password} (0) ntlm_auth: --> --password=2Number9!
[change your password]
(0) ntlm_auth: ERROR: Program returned code (1) and output 'NT_STATUS_NO_SUCH_USER: No such user (0xc0000064)'
fails.
ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-domain.net} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"
domain.net - no typo
program = "/usr/bin/ntlm_auth --request-nt-key --domain=domain.netN --username=%{mschap:User-Name} --password=%{User-Password}"
(0) mschap: Client is using MS-CHAPv1 with NT-Password (0) mschap: Executing: /usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-domain.net} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}: (0) mschap: EXPAND --username=%{mschap:User-Name:-None} (0) mschap: --> --username=chicken (0) mschap: ERROR: No NT-Domain was found in the User-Name (0) mschap: EXPAND --domain=%{%{mschap:NT-Domain}:-domain.net} (0) mschap: --> --domain=domain.net (0) mschap: mschap1: 27 (0) mschap: EXPAND --challenge=%{mschap:Challenge:-00} (0) mschap: --> --challenge=27572b879bc37cd5 (0) mschap: EXPAND --nt-response=%{mschap:NT-Response:-00} (0) mschap: --> --nt-response=3446fe427512934fce4d2bed4172dfb37fa43ab483323a01 (0) mschap: Program returned code (0) and output 'NT_KEY: B598B7914410495012BA70A8F02E4DA5'
works. Fix up the domain in mods-enabled/ntlm_auth. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
You guys rock. Thanks for finding my errors. The command: #radtest chicken <password> 127.0.0.1 0 testing123 is working now :-) . And yes, I did change my test password. My switches are authenticating successfully now :-) . thanks, michael On Sun, Oct 18, 2015 at 7:41 PM, Matthew Newton <mcn4@leicester.ac.uk> wrote:
On Sun, Oct 18, 2015 at 06:09:42AM -0400, Michael Price wrote:
program = "/usr/bin/ntlm_auth --request-nt-key
--domain=domain.netN --username=%{mschap:User-Name} --password=%{User-Password}" ...
(0) ntlm_auth: Executing: /usr/bin/ntlm_auth --request-nt-key --domain=domain.netN --username=%{mschap:User-Name} --password=%{User-Password}:
--domain=domain.netN - typo
(0) ntlm_auth: EXPAND --username=%{mschap:User-Name} (0) ntlm_auth: --> --username=chicken (0) ntlm_auth: EXPAND --password=%{User-Password} (0) ntlm_auth: --> --password=2Number9!
[change your password]
(0) ntlm_auth: ERROR: Program returned code (1) and output 'NT_STATUS_NO_SUCH_USER: No such user (0xc0000064)'
fails.
ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key
--username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:- domain.net} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"
domain.net - no typo
program = "/usr/bin/ntlm_auth --request-nt-key
--domain=domain.netN --username=%{mschap:User-Name} --password=%{User-Password}"
(0) mschap: Client is using MS-CHAPv1 with NT-Password (0) mschap: Executing: /usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:- domain.net} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}: (0) mschap: EXPAND --username=%{mschap:User-Name:-None} (0) mschap: --> --username=chicken (0) mschap: ERROR: No NT-Domain was found in the User-Name (0) mschap: EXPAND --domain=%{%{mschap:NT-Domain}:-domain.net} (0) mschap: --> --domain=domain.net (0) mschap: mschap1: 27 (0) mschap: EXPAND --challenge=%{mschap:Challenge:-00} (0) mschap: --> --challenge=27572b879bc37cd5 (0) mschap: EXPAND --nt-response=%{mschap:NT-Response:-00} (0) mschap: --> --nt-response=3446fe427512934fce4d2bed4172dfb37fa43ab483323a01 (0) mschap: Program returned code (0) and output 'NT_KEY: B598B7914410495012BA70A8F02E4DA5'
works.
Fix up the domain in mods-enabled/ntlm_auth.
Matthew
-- Matthew Newton, Ph.D. <mcn4@le.ac.uk>
Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom
For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
A.L.M.Buxey＠lboro.ac.uk -
Matthew Newton -
Michael Price