Hi Pete,

look at the radiusd.conf file, there is a sample line for ntml_auth.

"man ntml_auth" will give you details on the parameters.

regards, Stéphane

Hi! Yes, that famous line! But I can't imagine that the configuration depends all on that single line. Here is my new state: I have configured Samba to join the Windows domain. This is working (with net rpc join..) Then I launched nmbd and winbindd. Winbind starts but gives the following errors: Kinit failed: Malformed representation of principal krb5_cc_get_principal failed (No credentials cache found) kerberos_kinit_password host /SMF-210-1@ failed: Malformed representation of principal As I do not use Kerberos I think that those errors can be ignored. wbinfo -g shows me the groups but wbinfo -u fails with "Error looking up domain users". When executing ntlm_auth --request-nt-key --domain=TESTDOMAIN --username=pete --nt-response I am prompted for the password and then I get NT_STATUS_OK: Success (0x0) So ntlm_auth seems to work. But even when checking the manual I can't figure out what hexadecimal string I have to put for testing --challenge from the command line. Back to freeradius. In the Users file I added MS-CHAP-USE-NTLM-Auth = 1 but I cannot see in the execution of ntlm_auth in the debug output. It should be logged at "radius_xlat:" or not? Here is the complete output that is generated: rad_recv: Access-Request packet from host 192.168.33.44:1812, id=123, length=108 NAS-IP-Address = 192.168.33.44 NAS-Port-Type = Async User-Name = "pete" Service-Type = Framed-User Framed-MTU = 1500 Calling-Station-Id = "00-11-43-5c-77-d6" EAP-Message = 0x0200000e0163736368776172747a Message-Authenticator = 0x25f38b75fa3cb4abe24e239a027fee0c Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "pete", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 14 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 159 users: Matched entry DEFAULT at line 178 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 123 to 192.168.33.44:1812 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010100160410b9e2efb64f157d1421f9078e7a3bea4c Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4ec2da2c4cfabac97ead6fe8e31653bf Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.33.44:1812, id=124, length=143 NAS-IP-Address = 192.168.33.44 NAS-Port-Type = Async User-Name = "pete" Service-Type = Framed-User Framed-MTU = 1500 Calling-Station-Id = "00-11-43-5c-77-d6" State = 0x4ec2da2c4cfabac97ead6fe8e31653bf EAP-Message = 0x0201001f04102f942aff5c15b303e8f9165af155871063736368776172747a Message-Authenticator = 0x2000b9a88b196b010901c1f9e01d3555 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "pete", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 31 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 159 users: Matched entry DEFAULT at line 178 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/md5 rlm_eap: processing type md5 rlm_eap_md5: User-Password is required for EAP-MD5 authentication rlm_eap: Handler failed in EAP/md5 rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 1 modcall: group authenticate returns invalid for request 1 auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.33.44:1812, id=124, length=143 Sending Access-Reject of id 124 to 192.168.33.44:1812 EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 123 with timestamp 429e8ebe Cleaning up request 1 ID 124 with timestamp 429e8ebe Nothing to do. Sleeping until we see a request. Regards, Pete _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/