RE: Freeradius 2.1.12 Second LDAP Server
Hi, thanks for the Help. Actually im decided to create a new VM and reinstall the complete Server. I`m following the complete How-To, but i`m getting two different Errors. The First One is this: It`s under the first Point: Configuring Authentification with Active Directory I`m startet the Samba and Kerberos Services und used this Command: net join -U MyAdministrator
Worked. I`m getting this Message: Using short domain name -- MYDomain Joined 'UBUNTU' to realm 'MYDomain'
The next Step wbinfo -a user%password works too, but i`m getting this Error-Message: Could not authenticate user Username%Password with plaintext password challenge/response password authentication succeeded Is this normal? How can I fix it? The Response seems to work correctly. The Second One is this: It`s the last Point on this Page: Configuring FreeRadius to use ntml_auth for MS-CHAP In this Step, i must edit the following line with this text in the file: /etc/freeradius/modules/mschap ntlm_auth = "/path/to/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-MYDOMAIN} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" But my default commented ntml_auth looks like this: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}" In my default ntlm_auth, the option "--domain=%{%{mschap:NT-Domain}:-MYDOMAIN}" is missing. Should i add it? Actually i`m using my default uncommented ntlm_auth. So, i`m going to test the MS-CHAP authentification reuqest with this command: $ radtest -t mschap bob hello localhost 0 testing123 And i`m getting this Error-Message: Sending Access-Request of id 251 to 127.0.0.1 port 1812 User-Name = "bob" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 MS-CHAP-Challenge = 0x01774f129c72245c MS-CHAP-Response = 0x000100000000000000000000000000000000000000000000000024ff68dcea66e8348622a45aa91804201f2102e9ecc0add6 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=251, length=38 MS-CHAP-Error = "\000E=691 R /etc/freeradius/users First Line: bob Cleartext-Password := "hello" # # Please read the documentation file ../doc/processing_users_file, # or 'man 5 users' (after installing the server) for more information. # .... @Mathieu Is there a current RADIUS-book that you can recommend? -- BeliarsFire
Beliars Fire wrote:
The next Step wbinfo -a *user*%*password *works too, but i`m getting this Error-Message:
/Could not authenticate user Username%Password with plaintext password/ challenge/response password authentication succeeded
Is this normal? How can I fix it? The Response seems to work correctly.
It's a Samba issue. Ask the Samba people.
In my default ntlm_auth, the option "/--domain=%{%{mschap:NT-Domain}:-*MYDOMAIN*}" /is missing. Should i add it?
Sure. It's more needed if you use multiple domains.
Actually i`m using my default uncommented ntlm_auth. So, i`m going to test the MS-CHAP authentification reuqest with this command:
/$ radtest -t mschap bob hello localhost 0 testing123/ // /And i`m getting this Error-Message:/ // /Sending Access-Request of id 251 to 127.0.0.1 port 1812
<sigh> Run the server in debugging mode as suggested in the FAQ, "man" page, web pages, and daily on this list. Do NOT look at the client output. It's unimportant. Alan DeKok.
Hi,
Could not authenticate user Username%Password with plaintext password challenge/response password authentication succeeded
thats okay. means you couldnt do PAP and only MSCHAPv2 worked. expected for that command.
In this Step, i must edit the following line with this text in the file: /etc/freeradius/modules/mschap
ntlm_auth = "/path/to/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-MYDOMAIN} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"
But my default commented ntml_auth looks like this:
ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}"
the docs and default values have seperated over time.
In my default ntlm_auth, the option "--domain=%{%{mschap:NT-Domain}:-MYDOMAIN}" is missing. Should i add it?
depends on what you want to do and need to do. do you TRUST your clients to be sending the correct domain? I dont...so I've set the domain manually.
$ radtest -t mschap bob hello localhost 0 testing123
First Line: bob Cleartext-Password := "hello"
whats the users file got to do with anything? if you have clashing usernames you will have a few problems. i expect you are trying to test your AD? the radtest failed due to incorrect password.. ie the AD is not bob/hello I'd recommend using 'eapol_test' for better/advanced testing - its part of the wpa_supplicant package.
@Mathieu Is there a current RADIUS-book that you can recommend?
"FreeRADIUS for beginners" is a good current book alan
participants (3)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Beliars Fire