Have a radius box setup and am using ntlm_auth to authenticate peapv0 with mschapv2 in the inner tunnel off a samba pdc. All normal users authenticate fine. When I try to authenticate using the machine account I get this: eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for host/cc20000 with NT-Password [mschap] expand: --username=%{mschap:User-Name:-None} -> --username=cc20000$ [mschap] setting NT-Domain to same as machine name [mschap] expand: --domain=%{mschap:NT-Domain:-ISD} -> --domain=cc20000 [mschap] mschap2: bc [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=857e792244c9e024 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=0e44e0288f3f64004f58718f93e09c629670ab97d1e997bf Exec-Program output: Must change password (0xc0000224) Exec-Program-Wait: plaintext: Must change password (0xc0000224) Exec-Program: returned: 1 [mschap] External script failed. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. Login incorrect: [host/cc20000] (from client CCISD-REMC-Radius port 0 via TLS tunnel) } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 71 to 172.17.10.108 port 1033 EAP-Message = 0x010900261900170301001b34bc45f7fbc2e102f7ec6da756ce808f27d99f1074294fb3b5b69c Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb410f68ebc19efa88b187555f468f0ff Finished request 18. I do see the "Exec-Program output: Must change password (0xc0000224)" which to me means the computer account password has expired? I tried removing and re-adding the computer to the domain but get the same error. Any ideas? Anyone else successfully doing peapv0 auth with machine accounts and ntlm_auth? Thanks for any help.
Hi,
I do see the "Exec-Program output: Must change password (0xc0000224)" which to me means the computer account password has expired? I tried removing and re-adding the computer to the domain but get the same error.
you are right - the password needs changing - this is MS proprietary code so what you need to do it let this client talk to the AD/doamin - ie put it on normal network and let it do its thing. once the clientand domain are in sync, this will work.
Any ideas? Anyone else successfully doing peapv0 auth with machine accounts and ntlm_auth?
yes, thanks - it works fine. alan
A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
I do see the "Exec-Program output: Must change password (0xc0000224)" which to me means the computer account password has expired? I tried removing and re-adding the computer to the domain but get the same error.
you are right - the password needs changing - this is MS proprietary code so what you need to do it let this client talk to the AD/doamin - ie put it on normal network and let it do its thing. once the clientand domain
are in sync, this will work.
I have done this, I even took a fresh laptop and joined it to the domain. Moved it to wireless and get the same results =(. Just wondering if anyone had any ideas or has run into this before? I have a samba PDC. Is that what you have too? Thanks!
Any ideas? Anyone else successfully doing peapv0 auth with machine accounts and ntlm_auth?
yes, thanks - it works fine.
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
A.L.M.Buxey＠lboro.ac.uk -
Josh Hiner