Hi all, I am using freeradius 3.0.15. Samba version is 4.6.7. I compile both software on a Debian 9 machine. With nmbd and winbindd running flawlessly at the background, the domain user identification is working with using tools like wbinfo and id. However, when try to configure it with freeradius, it cannot authenticate. First of all, this configuration file: /usr/local/freeradius/etc/raddb/mods-enabled/mschap =============== winbind_username = “%{schap:User-Name}” winbind_domain = “SAMBADOM” #ntlm_auth = blahblahblah ============== Authentication was test using radtest =============== /usr/local/freeradius/bin/radtest -t mschap a_user thepassword 127.0.0.1 0 testing123 Sent Access-Request Id 191 from 0.0.0.0:39893 to 127.0.0.1:1812 length 129 User-Name = "a_user" MS-CHAP-Password = "thepassword" NAS-IP-Address = 192.168.107.7 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "thepassword" MS-CHAP-Challenge = 0xde5c70d1225f3f6c MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000e1a8009205e77b1fbbf020022ba3e20b70df576b57c71971 Sent Access-Request Id 191 from 0.0.0.0:39893 to 127.0.0.1:1812 length 129 User-Name = "a_user" MS-CHAP-Password = "thepassword" NAS-IP-Address = 192.168.107.7 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "thepassword" MS-CHAP-Challenge = 0xde5c70d1225f3f6c MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000e1a8009205e77b1fbbf020022ba3e20b70df576b57c71971 Sent Access-Request Id 191 from 0.0.0.0:39893 to 127.0.0.1:1812 length 129 User-Name = "a_user" MS-CHAP-Password = "thepassword" NAS-IP-Address = 192.168.107.7 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "thepassword" MS-CHAP-Challenge = 0xde5c70d1225f3f6c MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000e1a8009205e77b1fbbf020022ba3e20b70df576b57c71971 (0) No reply from server for ID 191 socket 3 =================== log.winbindd (in log level 10) =================== [2017/08/29 15:03:44.139816, 10, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:761(process_request) process_request: request fn INTERFACE_VERSION [2017/08/29 15:03:44.141735, 3, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_misc.c:395(winbindd_interface_version) [25579]: request interface version (version = 28) [2017/08/29 15:03:44.143656, 10, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:864(winbind_client_response_written) winbind_client_response_written[25579:INTERFACE_VERSION]: delivered response to client [2017/08/29 15:03:44.145639, 10, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:761(process_request) process_request: request fn WINBINDD_PRIV_PIPE_DIR [2017/08/29 15:03:44.147727, 3, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_misc.c:428(winbindd_priv_pipe_dir) [25579]: request location of privileged pipe [2017/08/29 15:03:44.150965, 10, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:864(winbind_client_response_written) winbind_client_response_written[25579:WINBINDD_PRIV_PIPE_DIR]: delivered response to client [2017/08/29 15:03:44.153161, 6, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:919(new_connection) accepted socket 27 [2017/08/29 15:03:44.155338, 6, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:968(winbind_client_request_read) closing socket 25, client exited [2017/08/29 15:03:44.157538, 10, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:734(process_request) process_request: Handling async request 25579:GETGROUPS [2017/08/29 15:03:44.159669, 3, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_getgroups.c:60(winbindd_getgroups_send) getgroups freerad [2017/08/29 15:03:44.162646, 1, pid=25544, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:468(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'SAMBADOM' name : * name : 'FREERAD' flags : 0x00000008 (8) [2017/08/29 15:03:44.171620, 1, pid=25544, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:468(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USE_NONE (0) sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2017/08/29 15:03:44.180970, 5, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_getgroups.c:235(winbindd_getgroups_recv) Could not convert sid S-0-0: NT_STATUS_NONE_MAPPED [2017/08/29 15:03:44.183154, 10, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:796(wb_request_done) wb_request_done[25579:GETGROUPS]: NT_STATUS_NONE_MAPPED [2017/08/29 15:03:44.192083, 10, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:864(winbind_client_response_written) winbind_client_response_written[25579:GETGROUPS]: delivered response to client ============== When I switch back using ntlm_auth instead, it is working flawlessly. Hope someone would help. Thanks for attending. Kinglok, Fong
On 29 August 2017 08:55:33 BST, Kinglok Fong <busywater@gmail.com> wrote:
First of all, this configuration file: /usr/local/freeradius/etc/raddb/mods-enabled/mschap =============== winbind_username = “%{schap:User-Name}”
That should be %{mschap:User-Name}
/usr/local/freeradius/bin/radtest -t mschap a_user thepassword
... What does the full debug output from freeradius -X show? -- Matthew
On 29 Aug 2017, at 4:12 PM, Matthew Newton <mcn@freeradius.org> wrote:
On 29 August 2017 08:55:33 BST, Kinglok Fong <busywater@gmail.com> wrote:
First of all, this configuration file: /usr/local/freeradius/etc/raddb/mods-enabled/mschap =============== winbind_username = “%{schap:User-Name}”
That should be %{mschap:User-Name}
Yes, my fault, just a typo. The configuration is correct.
/usr/local/freeradius/bin/radtest -t mschap a_user thepassword
...
What does the full debug output from freeradius -X show?
Ready to process requests (0) Received Access-Request Id 205 from 127.0.0.1:35445 to 127.0.0.1:1812 length 129 (0) User-Name = "a_user" (0) NAS-IP-Address = 192.168.107.7 (0) NAS-Port = 0 (0) Message-Authenticator = 0x06c949e75159bba6afd8641ad66b14ee (0) MS-CHAP-Challenge = 0xb65d59f6b9e382eb (0) MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000d3a53982f03084196c9b3de251ce1cfe35db04af1ebc447f (0) # Executing section authorize from file /usr/local/freeradius/etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /@\./) { (0) if (&User-Name =~ /@\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' (0) [mschap] = ok (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "a_user", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) Found Auth-Type = mschap (0) # Executing group from file /usr/local/freeradius/etc/raddb/sites-enabled/default (0) authenticate { (0) mschap: Client is using MS-CHAPv1 with NT-Password (0) mschap: EXPAND %{mschap:User-Name} (0) mschap: --> a_user rlm_mschap (mschap): Reserved connection (0) (0) mschap: sending authentication request user='a_user' domain='SAMBADOM' Segmentation fault
-- Matthew
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Tue, 2017-08-29 at 16:20 +0800, Kinglok Fong wrote:
(0) Found Auth-Type = mschap (0) # Executing group from file /usr/local/freeradius/etc/raddb/sites-enabled/default (0) authenticate { (0) mschap: Client is using MS-CHAPv1 with NT-Password (0) mschap: EXPAND %{mschap:User-Name} (0) mschap: --> a_user rlm_mschap (mschap): Reserved connection (0) (0) mschap: sending authentication request user='a_user' domain='SAMBADOM' Segmentation fault
OK that's not good. Can you try and get a backtrace with debugging symbols - instructions are at https://github.com/FreeRADIUS/freeradius-server/blob/v4.0.x/doc/ bugs.md Thanks, -- Matthew
On 29 Aug 2017, at 6:31 PM, Matthew Newton <mcn@freeradius.org> wrote:
On Tue, 2017-08-29 at 16:20 +0800, Kinglok Fong wrote:
(0) Found Auth-Type = mschap (0) # Executing group from file /usr/local/freeradius/etc/raddb/sites-enabled/default (0) authenticate { (0) mschap: Client is using MS-CHAPv1 with NT-Password (0) mschap: EXPAND %{mschap:User-Name} (0) mschap: --> a_user rlm_mschap (mschap): Reserved connection (0) (0) mschap: sending authentication request user='a_user' domain='SAMBADOM' Segmentation fault
OK that's not good.
Can you try and get a backtrace with debugging symbols - instructions are at https://github.com/FreeRADIUS/freeradius-server/blob/v4.0.x/doc/ bugs.md
Thanks,
I have attached the gdb log through this reply. Hope that the file will not be truncated.
-- Matthew
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Kinglok, Fong
On Aug 29, 2017, at 4:29 PM, Kinglok Fong <busywater@gmail.com> wrote:
I have attached the gdb log through this reply. Hope that the file will not be truncated.
The error is deep inside of Samba code. My guess is you're using a version of Samba which isn't compatible with rlm_winbind. Alan DeKok.
On 30 Aug 2017, at 4:39 AM, Alan DeKok <aland@deployingradius.com> wrote:
On Aug 29, 2017, at 4:29 PM, Kinglok Fong <busywater@gmail.com> wrote:
I have attached the gdb log through this reply. Hope that the file will not be truncated.
The error is deep inside of Samba code.
My guess is you're using a version of Samba which isn't compatible with rlm_winbind.
Alan DeKok.
I am using the latest stable version of Samba 4.6.7. Please advise which version of Samba that freeradius will be compatible with. Thank you. Kinglok, Fong
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Aug 29, 2017, at 4:41 PM, Kinglok Fong <busywater@gmail.com> wrote:
I am using the latest stable version of Samba 4.6.7. Please advise which version of Samba that freeradius will be compatible with.
Hmm.. it should work. Maybe Samba changed their API without telling us. Alan DeKok.
On 29 August 2017 21:57:20 BST, Alan DeKok <aland@deployingradius.com> wrote:
On Aug 29, 2017, at 4:41 PM, Kinglok Fong <busywater@gmail.com> wrote:
I am using the latest stable version of Samba 4.6.7. Please advise
which version of Samba that freeradius will be compatible with.
Hmm.. it should work. Maybe Samba changed their API without telling us.
If I get a chance I'll try and have a look and see what's up. Unlikely to be for a few days though. -- Matthew
On Wed, Aug 30, 2017 at 3:41 AM, Kinglok Fong <busywater@gmail.com> wrote:
On 30 Aug 2017, at 4:39 AM, Alan DeKok <aland@deployingradius.com> wrote:
On Aug 29, 2017, at 4:29 PM, Kinglok Fong <busywater@gmail.com> wrote:
I have attached the gdb log through this reply. Hope that the file will not be truncated.
The error is deep inside of Samba code.
My guess is you're using a version of Samba which isn't compatible with rlm_winbind.
Alan DeKok.
I am using the latest stable version of Samba 4.6.7. Please advise which version of Samba that freeradius will be compatible with.
Can you try ubuntu xenial and use the samba package on its repo (4.3.11)? If it works, it should help narrow down the problem. You can also use my ppa (https://launchpad.net/~freeradius/+archive/ubuntu/stable-3.0) to install FR-3.0.15, so the test shouldn't need any compiling/manual package building. -- Fajar
On 30 Aug 2017, at 6:18 AM, Fajar A. Nugraha <list@fajar.net> wrote:
On Wed, Aug 30, 2017 at 3:41 AM, Kinglok Fong <busywater@gmail.com> wrote:
On 30 Aug 2017, at 4:39 AM, Alan DeKok <aland@deployingradius.com> wrote:
On Aug 29, 2017, at 4:29 PM, Kinglok Fong <busywater@gmail.com> wrote:
I have attached the gdb log through this reply. Hope that the file will not be truncated.
The error is deep inside of Samba code.
My guess is you're using a version of Samba which isn't compatible with rlm_winbind.
Alan DeKok.
I am using the latest stable version of Samba 4.6.7. Please advise which version of Samba that freeradius will be compatible with.
Can you try ubuntu xenial and use the samba package on its repo (4.3.11)? If it works, it should help narrow down the problem.
You can also use my ppa (https://launchpad.net/~freeradius/+archive/ubuntu/stable-3.0) to install FR-3.0.15, so the test shouldn't need any compiling/manual package building.
-- Fajar - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Okay, I have used another machine to compile from source, Samba 4.5.11 and freeradius 3.0.15. The use of winbind is successful. Surely, it involves Samba 4.6.7 changes from Samba 4.5.11. I am not sure if the winbind API is changed or not. But the libtalloc library of both samba versions are different also. Kinglok, Fong
participants (4)
-
Alan DeKok -
Fajar A. Nugraha -
Kinglok Fong -
Matthew Newton