Hi all, passchange works very fine, but in windows 7, if the user inserts an incorrect password it will promped the message "password incorrect". At this point if the user insert the correct password, in the radius log i've always this error: 9) mschap : Program returned code (1): Logon failure (0xc000006d) (9) mschap : External script failed (9) ERROR: mschap : External script says: Logon failure (0xc000006d) (9) mschap : FAILED: MS-CHAP2-Response is incorrect (9) [mschap] = reject (9) } # Auth-Type MS-CHAP = reject (9) MSCHAP-Error: �E=691 R=1j? Could not parse new challenge from MS-CHAP-Error: 2 MSCHAP Failure -- *Davide Garofalo*
On 11/05/2013 10:13 AM, Davide Garofalo wrote:
Hi all,
passchange works very fine, but in windows 7, if the user inserts an incorrect password it will promped the message "password incorrect". At this point if the user insert the correct password, in the radius log i've always this error:
I'm not sure I follow you - inserts an incorrect password where, and inserts a correct password where? In the "old password" box? A full debug would be helpful here; it might simply be an issue of regenerating the challenge again (i.e. a minor source code patch)
Ok, here is when i insert incorrect password https://dl.dropboxusercontent.com/u/15956439/20131105_133800.jpg and here the debug https://dl.dropboxusercontent.com/u/15956439/Debug_firstLogin After unsuccessfully login, windows show me this screen https://dl.dropboxusercontent.com/u/15956439/20131105_133954.jpg and if i insert the correct password this screen conitinues to appear. Here the debug file https://dl.dropboxusercontent.com/u/15956439/Debug_secondLogin To solve i've to press cancel button in the second screen, and wait that the first screen re-appear. I hope I explained the problem. 2013/11/5 Phil Mayers <p.mayers@imperial.ac.uk>
On 11/05/2013 10:13 AM, Davide Garofalo wrote:
Hi all,
passchange works very fine, but in windows 7, if the user inserts an incorrect password it will promped the message "password incorrect". At this point if the user insert the correct password, in the radius log i've always this error:
I'm not sure I follow you - inserts an incorrect password where, and inserts a correct password where? In the "old password" box?
A full debug would be helpful here; it might simply be an issue of regenerating the challenge again (i.e. a minor source code patch) - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
-- *Davide Garofalo*
On 05/11/13 12:45, Davide Garofalo wrote:
and here the debug https://dl.dropboxusercontent.com/u/15956439/Debug_firstLogin
That debug looks incomplete - only 3 packets are in there, and the EAP tunnel never gets established.
Here the debug file https://dl.dropboxusercontent.com/u/15956439/Debug_secondLogin
Likewise, debug incomplete.
Sorry, here the full debug file with first and second login. https://dl.dropboxusercontent.com/u/15956439/FullDebug Thank you for the support 2013/11/5 Phil Mayers <p.mayers@imperial.ac.uk>
On 05/11/13 12:45, Davide Garofalo wrote:
and here the debug
https://dl.dropboxusercontent.com/u/15956439/Debug_firstLogin
That debug looks incomplete - only 3 packets are in there, and the EAP tunnel never gets established.
Here the debug file
https://dl.dropboxusercontent.com/u/15956439/Debug_secondLogin
Likewise, debug incomplete.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
-- *Davide Garofalo*
Davide Garofalo wrote:
Sorry, here the full debug file with first and second login.
Please use a txt file next time. The output is text. Also, use "radiusd -X", not "radiusd -Xx". It simplifies the output. What I see is ntlm_auth returning login failure. Then, the server sends a challenge, and nothing else happens. There's no Microsoft change password attribute in the debug output, either. So... it's impossible to help you. In order to debug password change issues, we need to see debug output with password changes in them. I would suggest that *you* read the debug output, too. Look for password change requests. It isn't hard. Then, post those. You keep posting useless debug output, or tiny pieces of the debug output. This tells us that you're not interested in doing work yourself to solve the problem. If that's true, then we're not interested in working on it, either. Alan DeKok.
I used "radiusd -Xx" to display the datetime and figure out what the first and what the second login. I posted the full debug because Phil asks me. The problem I am having is probably related to the mschap module. "You keep posting useless debug output, or tiny pieces of the debug output"... this is your opinion, with the ldap module my debug output has been useful for you !! As regards the current problem, I'll manage to find a solution. Thanks for the help 2013/11/6 Alan DeKok <aland@deployingradius.com>
Davide Garofalo wrote:
Sorry, here the full debug file with first and second login.
Please use a txt file next time. The output is text. Also, use "radiusd -X", not "radiusd -Xx". It simplifies the output.
What I see is ntlm_auth returning login failure. Then, the server sends a challenge, and nothing else happens.
There's no Microsoft change password attribute in the debug output, either.
So... it's impossible to help you. In order to debug password change issues, we need to see debug output with password changes in them.
I would suggest that *you* read the debug output, too. Look for password change requests. It isn't hard. Then, post those.
You keep posting useless debug output, or tiny pieces of the debug output. This tells us that you're not interested in doing work yourself to solve the problem. If that's true, then we're not interested in working on it, either.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- *Davide Garofalo*
Davide Garofalo wrote:
"You keep posting useless debug output, or tiny pieces of the debug output"... this is your opinion, with the ldap module my debug output has been useful for you !!
You asked for help. We told you what we needed, so that we can help you. You then tell us we're wrong. Good luck solving the problem. You've made it clear you're not willing to accept our help. Alan DeKok.
participants (3)
-
Alan DeKok -
Davide Garofalo -
Phil Mayers