configuring freeradius to use Ntlm_auth
Hi , I am following the link http://deployingradius.com/documents/configuration/active_directory.html to integrate AD with freeradius I have done configuration changes as per the attached files Now when i run the radtest radtest user password localhost 0 testing123 I get Accept reject. I have attached my debug output as well Any thoughts?
hi, if you take the default FreeRADIUS 2.x config and just follow that active directory guide, then it just works - you dont need to use exec ntlm_auth or anything...just configure the mschap module (which has an ntlm_auth line to be configured) alan
Well, even if I follow that guide it says to do a lot of things like as follows: "Create a file raddb/modules/ntlm_auth, and put the following text in it: exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" }" "You will also have to list ntlm_auth in the authenticate sections of each the raddb/sites-enabled/default file, and of the raddb/sites-enabled/inner-tunnel file"
Date: Sat, 26 Mar 2011 13:51:51 +0000 From: A.L.M.Buxey@lboro.ac.uk To: freeradius-users@lists.freeradius.org Subject: Re: configuring freeradius to use Ntlm_auth
hi,
if you take the default FreeRADIUS 2.x config and just follow that active directory guide, then it just works - you dont need to use exec ntlm_auth or anything...just configure the mschap module (which has an ntlm_auth line to be configured)
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Mon, Mar 28, 2011 at 1:01 PM, Raheel Itrat <raheel082@hotmail.com> wrote:
Well, even if I follow that guide it says to do a lot of things like as follows:
"Create a file raddb/modules/ntlm_auth, and put the following text in it:
exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" }"
"You will also have to list ntlm_auth in the authenticate sections of each the raddb/sites-enabled/default file, and of the raddb/sites-enabled/inner-tunnel file"
AFAIK that guide was written with some assumption in mind, like: - users already now what AD is, know how to join new machines to the domain, and have sufficient access right to do so - users aready know what samba is, and know how to integrate samba to an exisisting windows domain - users are familiar enough with freeradius to create a basic working configuration (e.g. with users in /etc/raddb/users, authentication using PAP) using freeradius 2.1.x.
From a quick glance, I can't even tell what FR version you use (did you run "freeradius -X", as suggested in the FAQ http://wiki.freeradius.org/index.php/FAQ)
Also, your config file has something like this program = "/etc/freeradius/modules/ntlm_auth Which is definitely wrong. For example, in ubuntu, the ntml_auth prog is /usr/bin/ntlm_auth, path of winbind/winbind4 package. So back to your problem, I suggest do some checks first and make sure you have all three above assumptions covered. If not, learn about them first. After that (and correcting some obvious problems), start with using "freeradius -X" to get the debug log. -- Fajar
participants (3)
-
Alan Buxey -
Fajar A. Nugraha -
Raheel Itrat