need help configuring ntlm_auth w/ freeradius 1.0.1
Alan as you suggested (thanks) I have commented out LDAP and I am now attempting to authenticate via ntlm_auth. I've configured and started Samba and windindd. I can authenticate via ntlm_auth outside of Freeradius, but not with it. I KNOW THE PROBLEM IS WITH MY CONFIGURATION AND NOT FREERADIUS! I'd appreciate help in locating / understanding what I have misconfigured? Also, my final goal is to authenticate clients to a Cisco Aironet 1200 via our Windows 2003 Active Directory usernames and passwords is ntlm_auth the correct method to use? [root@phllnxsrv01 raddb]# ntlm_auth --username="test ops" --password=xxxxxx --domain=usmisgnet --request-NT-key NT_STATUS_OK: Success (0x0) Below are the ntlm_auth section of radiusd.conf and the radtest string used and the debug output from the other window. ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --domain=%{mschap:NT-Domain} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } radtest "test ops" xxxxxx localhost 0 testing123 radiusd -xxyz -l stdout Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf [NORMAL OUTPUT SUPPRESSED] Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32784, id=232, length=60 --- Walking the entire request list --- Waking up in 31 seconds... Thread 1 got semaphore Thread 1 handling request 0, (1 handled so far) Threads: total/active/spare threads = 5/0/5 User-Name = "test ops" User-Password = "m1sg0ps" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_lowerpair: User-Name now 'test ops' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test ops", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_realm: No '\' in User-Name = "test ops", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [test ops] (from client localhost port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request Thread 1 waiting to be assigned a request rad_recv: Access-Request packet from host 127.0.0.1:32784, id=232, length=60 Sending Access-Reject of id 232 to 127.0.0.1:32784 --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 232 with timestamp 42d3e0ec Nothing to do. Sleeping until we see a request. Ken George Systems and Network Engineering Mi Services Group, Inc. +1 610-230-2500 x129
"Ken George" <Ken.George@mi-services.com> wrote:
Also, my final goal is to authenticate clients to a Cisco Aironet 1200 via our Windows 2003 Active Directory usernames and passwords is ntlm_auth the correct method to use?
Yes.
Below are the ntlm_auth section of radiusd.conf and the radtest string used and the debug output from the other window.
ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --domain=%{mschap:NT-Domain} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"
That looks fine.
radtest "test ops" xxxxxx localhost 0 testing123
That doesn't use MSCHAPv2, so the MSCHAP module won't run, and the ntlm_auth program won't run. If you want to pass *clear-text* passwords to ntlm_auth, you've got to do something different. The command-line example you posted works, because you're giving it a clear-text password. The mschap configuration you posted uses mschap, and doesn't send a clear-text password. So... the mschap configuration you posted won't work with clear-text passwords. The debug output you posted shows this. You use "radtest" to send a clear-text password, and the mschap module doesn't run. This shouldn't be a surprise. What you need to do is to configure a *different* ntlm_auth, only for clear-text passwords. The simplest way to do this is to use the "exec" module: modules { ... exec win_domain { wait = yes input_pairs = request output_pairs = reply program = "ntlm_auth --username=\"%{User-Name}\" --password=\"%{User-Password}\" --domain=usmisgne" } ... } Now list "win_domain" in the "authenticate" section, and add the following entry to the "users" file: DEFAULT Auth-Type = win_domain This will use "win_domain" for authentication UNLESS the mschap module has previously found MSCHAP in the request. Alan DeKok.
participants (2)
-
Alan DeKok -
Ken George