FreeRADIUS 3.0 : mschap module fails to execute ntlm_auth
Hi list, I just tried to upgrade FreeRADIUS to the latest version from git. My goal is to get the passchange feature working in the mschap module. I am unable to get ntlm_auth to work in mschap. debug output, --- Debug: (0) mschap : expand: '--nt-response=%{%{mschap:NT-Response}:-00}' -> '--nt-response=4dc04bcfba6029f88cf3131d47ca2587132782979dcb7dc7' Debug: (0) mschap : executing cmd /usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00} Debug: (0) mschap : [0] /usr/bin/ntlm_auth Debug: (0) mschap : [1] --request-nt-key Debug: (0) mschap : [2] --username=vpntest Debug: (0) mschap : [3] --challenge=2546448021444870 Debug: (0) mschap : [4] --nt-response=4dc04bcfba6029f88cf3131d47ca2587132782979dcb7dc7 Debug: (0) mschap : Program output is ERROR: (0) ERROR: mschap : Abnormal child exit: No such file or directory Debug: (0) mschap : External script failed. ERROR: (0) ERROR: mschap : External script says: Debug: (0) mschap : FAILED: MS-CHAP2-Response is incorrect Debug: (0) modsingle[authenticate]: returned from mschap (rlm_mschap) for request 0 Debug: (0) [mschap] = reject Debug: (0) Failed to authenticate the user. Debug: (0) Using Post-Auth-Type Reject --- If i try a second time i get this, --- Debug: (1) mschap : expand: '--nt-response=%{%{mschap:NT-Response}:-00}' -> '--nt-response=090bacad01a113dd74007ed5845d5b0c7c8017bac80821dd' Debug: (1) mschap : executing cmd /usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00} Debug: (1) mschap : [0] /usr/bin/ntlm_auth Debug: (1) mschap : [1] --request-nt-key Debug: (1) mschap : [2] --username=vpntest Debug: (1) mschap : [3] --challenge=d9a8b4d1c188ae1b Debug: (1) mschap : [4] --nt-response=090bacad01a113dd74007ed5845d5b0c7c8017bac80821dd Debug: (1) mschap : Program output is ERROR: (1) ERROR: mschap : Abnormal child exit: No child processes Debug: (1) mschap : External script failed. ERROR: (1) ERROR: mschap : External script says: Debug: (1) mschap : FAILED: MS-CHAP2-Response is incorrect Debug: (1) modsingle[authenticate]: returned from mschap (rlm_mschap) for request 1 Debug: (1) [mschap] = reject Debug: (1) Failed to authenticate the user. Debug: (1) Using Post-Auth-Type Reject --- I am sure that the ntlm_auth file is at /usr/bin/ntlm_auth and if i run it manually with the expanded attributes i get the NT_KEY. root@freelab:/#/usr/bin/ntlm_auth --request-nt-key --username=vpntest --challenge=d9a8b4d1c188ae1b --nt-response=090bacad01a113dd74007ed5845d5b0c7c8017bac80821dd NT_KEY: 2066656E05C22F3A995AD9ECFED913D6 Any ideas? Kind Regards Bjarni
On 06/07/2013 10:46 AM, Bjarni Hardarson wrote:
I am sure that the ntlm_auth file is at /usr/bin/ntlm_auth and if i run it manually with the expanded attributes i get the NT_KEY.
root@freelab:/#/usr/bin/ntlm_auth --request-nt-key --username=vpntest --challenge=d9a8b4d1c188ae1b --nt-response=090bacad01a113dd74007ed5845d5b0c7c8017bac80821dd NT_KEY: 2066656E05C22F3A995AD9ECFED913D6
Any ideas?
Please don't send more that one email, we heard you the first time. This sounds like a permission problem. Make sure when you run your test manually you do so as the same user and group radiusd is running as, you'll find those values in your radiusd.cong file. Also if your system is running SELinux check for the presence of AVC's
On 8 Jun 2013, at 10:30, nicolas.clo@ricoh-industrie.fr wrote:
I have the same problem after upgrade Freeradius to version 3. Before, ntlm worked very well but it seems that the new version used the ntlm module differently.
Thanks for flagging your email appropriately. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
On 7 jun 2013 17:01 "John Dennis" <jdennis@redhat.com> wrote:
Please don't send more that one email, we heard you the first time.
Sorry about that, i had some trouble with my e-mail client and thought i failed to send it the first time.
This sounds like a permission problem. Make sure when you run your test manually you do so as the same user and group radiusd is running as, you'll find those values in your radiusd.cong file.
Also if your system is running SELinux check for the presence of AVC's
I am pretty sure that permissions are not the problem. While testing i am running FreeRADIUS as root and i am not running SELinux. The OS is Ubuntu 12.04. I tried building deb packages with the debian rules but that creates a broken installation. I guess the rules need some work. :) I thought my OS might be broken so i reinstalled Ubuntu and build the server with. apt-get build-dep freeradius apt-get install libssl-dev ./configure && make && make install The result is the same. The first time i try to authenticate the mschap module says "ERROR: (0) ERROR: mschap : Abnormal child exit: No such file or directory". The second time it says " ERROR: (1) ERROR: mschap : External script says: ?[1m?[33mSun Jun 9 01:11:39 2013 : WARNING: (21) WARNING: mschap : Failed to execute /usr/bin/ntlm_auth: Bad address?[0m". I guess i will wait for a 3.0 build on launchpad. Bjarni
participants (4)
-
Arran Cudbard-Bell -
Bjarni Hardarson -
John Dennis -
nicolas.clo＠ricoh-industrie.fr