Problems with XPsp3 and FreeRADIUS
I have a strange problem where the initial 802.1X authentication is successful, but then fails subsequent auth attempts. This is using Windows XP sp3 PEAP/MS-Chapv2, FreeRADIUS 2.1.3, with Active Directory running on a Windows2003 server. I noticed the following discrepency in the RADIUS logs. The two auth attempts are identical until this part: Successful Info: Found Auth-type = EAP Info: +- entering group authenticate (...) Info: [eap] Request found,released from list Info: [eap] EAP/peap* *Info: [eap] processing type peap Info: [peap] processing EAP-TLS Info: [peap] eaptls_verify returned 7 Info: [peap] Done initial handshake Info: [peap] eaptls_process returned 7 Info: [peap] EAPTLS_OK Info: [peap] Session established. Decoding tunneled attributes. Info: [peap] Received EAP-TLV response. Info: [peap] Success Info: [peap] Using saved attributes from the original Access-Accept Unsuccessful Info: Found Auth-type = EAP Info: +- entering group authenticate (...) Info: [eap] Request found,released from list Info: [eap] EAP/mschapv2* *Info: [eap] processing type mschapv2 Info: [mschapv2] +-entering group MS-CHAP (...) Info: [mschap] No Cleartext-Password configured. Cannot create LM-Password. Info: [mschap] No Cleartext-Password configured. Cannot create NT-Password. Info: [mschap] Told to do MS-CHAPv2 for seth with NT-Password ... Info: Debug: Exec-Program output: Logon failure (0xxc000006d) Info: Debug: Exec-Program-Wait: plaintext: Logon failure (0xxc000006d) Info: Debug: Exec-Program: returned 1 Info: [mschap] External script failed. Info: [mschap] FAILED: MS-CHAP2-Response is incorrect Info: ++[mschap] returns reject Info: [eap] Freeing handler Info: ++[eap] returns reject Info: Failed to authenticate the user. Why is one auth request using the mschapv2 group and the other PEAP? Both are from the same client on the same switchport. Has anyone else run into this type of problem? Is there a configuration on the supplicant or Active Directory that could cause this? More information if necessary: from modules.conf eap { default_eap_type = md5 timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no tls { private_key_password = whatever private_key_file = ${raddbdir}/cert_privkey.key certificate_file = ${raddbdir}/cert_certificate. pem CA_file = ${raddbdir}/cert_ca_cert.pem dh_file = /etc/raddb/certs/dh random_file = /etc/raddb/certs/random fragment_size = 1024 include_length = yes check_crl = no check_cert_cn = %{Stripped-User-Name:-%{User-Name}} peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes } mschapv2 { } } Thanks, /Seth
hi, is the first one machine and the second a user? is the client set up correctly (and as you would expect)? alan
Alan, Both are user authentications. The first is after OS startup and the second is after a 15 minute re-authentication interval. I only see a machine domain auth when I logout as the user, and this is successful. I am using the native Windows supplicant configured with basically default settings, altho I unchecked to validate the server certificate (since its self-signed). Thanks for your help /Seth On Mon, Jan 11, 2010 at 10:27 AM, Alan Buxey <A.L.M.Buxey@lboro.ac.uk>wrote:
hi,
is the first one machine and the second a user? is the client set up correctly (and as you would expect)?
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Seth wrote:
I have a strange problem where the initial 802.1X authentication is successful, but then fails subsequent auth attempts. This is using Windows XP sp3 PEAP/MS-Chapv2, FreeRADIUS 2.1.3, with Active Directory running on a Windows2003 server.
I noticed the following discrepency in the RADIUS logs. The two auth attempts are identical until this part:
You are using ntlm_auth for authentication. This issue appears to be a bug in Samba. Downgrade Samba until you find a version that works. Alan DeKok.
Alan, We are currently using Samba 3.0.34... Do you know if there are release notes or a discussion regarding this issue you can point me to, I didnt see anything from a search. Thanks, /Seth On Thu, Jan 14, 2010 at 9:29 AM, Alan DeKok <aland@deployingradius.com>wrote:
Seth wrote:
I have a strange problem where the initial 802.1X authentication is successful, but then fails subsequent auth attempts. This is using Windows XP sp3 PEAP/MS-Chapv2, FreeRADIUS 2.1.3, with Active Directory running on a Windows2003 server.
I noticed the following discrepency in the RADIUS logs. The two auth attempts are identical until this part:
You are using ntlm_auth for authentication. This issue appears to be a bug in Samba. Downgrade Samba until you find a version that works.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi Seth, we authenticate WinXPsp3 supplicants via PEAP/MS-Chapv2 with FreeRADIUS against Win2k3 AD. We are using FreeRADIUS 2.1.6 and samba 3.2.7. This works fine for user authentication and for host authentication too. I suggest a test with these versions to eliminate possible configuration issues ... good luck Axel Seth schrieb:
Alan,
We are currently using Samba 3.0.34... Do you know if there are release notes or a discussion regarding this issue you can point me to, I didnt see anything from a search.
Thanks,
/Seth
On Thu, Jan 14, 2010 at 9:29 AM, Alan DeKok <aland@deployingradius.com>wrote:
Seth wrote:
I have a strange problem where the initial 802.1X authentication is successful, but then fails subsequent auth attempts. This is using Windows XP sp3 PEAP/MS-Chapv2, FreeRADIUS 2.1.3, with Active Directory running on a Windows2003 server.
I noticed the following discrepency in the RADIUS logs. The two auth attempts are identical until this part: You are using ntlm_auth for authentication. This issue appears to be a bug in Samba. Downgrade Samba until you find a version that works.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
------------------------------------------------------------------------
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Axel Vogel Network/Operations | Bundesamt fuer Kartographie und Geodaesie | Tel.: +49 341 5634 203 Aussenstelle Leipzig | Fax: +49 341 5634 1984 Karl-Rothe-Str. 10-14 | D-04105 Leipzig | 012deg 22' 26.75" E Federal Republic of Germany | 51deg 21' 14.50" N
participants (4)
-
Alan Buxey -
Alan DeKok -
Axel Vogel -
Seth