Hello out there, I'm testing the FreeRADIUS Version 2.1.12 Modul with AD Integration following the deployingradius.com Guide. Installed winbind and samba Version 3.6.3 and ntlm_auth tests are fine. Now i'm testing with radtest while running radius in Debug mod. The following line has been added to users: DEFAULT Auth-Type = mschap This is the output from radtest: radtest -t mschap User001 USERPW localhost 0 s3cr3t Sending Access-Request of id 61 to 127.0.0.1 port 1812 User-Name = "User001" NAS-IP-Address = 172.16.28.168 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 MS-CHAP-Challenge = 0x7e9462ca7fbf5d20 MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000a42d3b5b243dede8b6 dc20fc78f0fdad458a494f649cca2b rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=61, length=38 MS-CHAP-Error = "\000E=691 R=1" And this from radiusd -X: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 48471, id=105, length=133 User-Name = "User001" NAS-IP-Address = 172.16.28.168 NAS-Port = 0 Message-Authenticator = 0x5d1a20d2d2c7897d376d003f73153552 MS-CHAP-Challenge = 0x28d302e62ccf7399 MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000f7b8cd66af90b5791f b4b09421dbbf2cbed180e7e72304b5 server packetfence { # Executing section authorize from file /etc/raddb/sites-enabled/packetfence +- entering group authorize {...} [suffix] No '@' in User-Name = "User001", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[preprocess] returns ok [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_perl: Added pair User-Name = User001 rlm_perl: Added pair MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000f7b8cd66af90b5791f b4b09421dbbf2cbed180e7e72304b5 rlm_perl: Added pair NAS-Port = 0 rlm_perl: Added pair NAS-IP-Address = 172.16.28.168 rlm_perl: Added pair MS-CHAP-Challenge = 0x28d302e62ccf7399 rlm_perl: Added pair Message-Authenticator = 0x5d1a20d2d2c7897d376d003f73153552 rlm_perl: Added pair Auth-Type = MSCHAP ++[packetfence] returns noop Found Auth-Type = MSCHAP # Executing group from file /etc/raddb/sites-enabled/packetfence +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv1 with NT-Password [mschap] expand: %{Stripped-User-Name} -> [mschap] ... expanding second conditional [mschap] expand: %{mschap:User-Name:-None} -> User001 [mschap] expand: --username=%{%{Stripped-User-Name}:-%{mschap:User-Name:-None}} -> --username=User001 [mschap] mschap1: 28 [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=28d302e62ccf7399 [mschap] expand: #ntresponse=%{mschap:NT-Response:-00} -> #ntresponse=f7b8cd66af90b5791fb4b09421dbbf2cbed180e7e72304b5 Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 [mschap] External script failed. [mschap] MS-CHAP-Response is incorrect. ++[mschap] returns reject Failed to authenticate the user. Login incorrect (mschap: External script says Logon failure (0xc000006d)): [User001] (from client 127.0.0.1 port 0) The ntlm_auth is well configured in mschap module (--ntresponse)! Thanks for helping.
# Executing group from file /etc/raddb/sites-enabled/packetfence +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv1 with NT-Password [mschap] expand: %{Stripped-User-Name} -> [mschap] ... expanding second conditional [mschap] expand: %{mschap:User-Name:-None} -> User001 [mschap] expand: --username=%{%{Stripped-User-Name}:-%{mschap:User-Name:-None}} -> --username=User001 [mschap] mschap1: 28 [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=28d302e62ccf7399 [mschap] expand: #ntresponse=%{mschap:NT-Response:-00} -> #ntresponse=f7b8cd66af90b5791fb4b09421dbbf2cbed180e7e72304b5 Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 [mschap] External script failed. [mschap] MS-CHAP-Response is incorrect. ++[mschap] returns reject Failed to authenticate the user. Login incorrect (mschap: External script says Logon failure (0xc000006d)): [User001] (from client 127.0.0.1 port 0) I would say, ntlm_auth is missing domain here. Where do you supply domain? In configaration or with user name? Whitch form, user@domain or domain\user? I would check those. A.
Tested both at radtest USER@DOMAIN and DOMAIN\\USER, nothing worked. Configured krb5.conf and smb.conf with domain and local ntlm_auth works fine on the machine. And in mschap module this line has beed added: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-SWMNT} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" -----Ursprüngliche Nachricht----- Von: freeradius-users-bounces+felix.weber=swmr.de@lists.freeradius.org [mailto:freeradius-users-bounces+felix.weber=swmr.de@lists.freeradius.org] Im Auftrag von Andres Septer Gesendet: Mittwoch, 4. April 2012 14:14 An: FreeRadius users mailing list Betreff: RE: MSCHAP Auth fails # Executing group from file /etc/raddb/sites-enabled/packetfence +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv1 with NT-Password [mschap] expand: %{Stripped-User-Name} -> [mschap] ... expanding second conditional [mschap] expand: %{mschap:User-Name:-None} -> User001 [mschap] expand: --username=%{%{Stripped-User-Name}:-%{mschap:User-Name:-None}} -> --username=User001 [mschap] mschap1: 28 [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=28d302e62ccf7399 [mschap] expand: #ntresponse=%{mschap:NT-Response:-00} -> #ntresponse=f7b8cd66af90b5791fb4b09421dbbf2cbed180e7e72304b5 Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 [mschap] External script failed. [mschap] MS-CHAP-Response is incorrect. ++[mschap] returns reject Failed to authenticate the user. Login incorrect (mschap: External script says Logon failure (0xc000006d)): [User001] (from client 127.0.0.1 port 0) I would say, ntlm_auth is missing domain here. Where do you supply domain? In configaration or with user name? Whitch form, user@domain or domain\user? I would check those. A. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Just looked at this line in my config there is a "--ntresponse" instead of "#ntresponse" [mschap] expand: #ntresponse=%{mschap:NT-Response:-00} -> #ntresponse=f7b8cd66af90b5791fb4b09421dbbf2cbed180e7e72304b5 Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Tested on command line and getting this: ntlm_auth --request-nt-key --username=User001 --domain=SWMNT --challenge=6e374178999f1bb7 --nt-response=b1f6e77179f80d6cd0b9edf43747e08daa1e32bf732df419 NT_KEY: D939DA6BBE72DDD138696ECFCA691648 With # getting the same error like in the radtest: ntlm_auth --request-nt-key --username=User001 --domain=SWMNT --challenge=6e374178999f1bb7 #ntresponse=b1f6e77179f80d6cd0b9edf43747e08daa1e32bf732df419 Logon failure (0xc000006d) In my mschap module the ntresponse parameter is written with "--", so why is radtest interpreting it with an "#" ??
Weber, Felix wrote:
Just looked at this line in my config there is a "--ntresponse" instead of "#ntresponse"
That's bad.
In my mschap module the ntresponse parameter is written with "--", so why is radtest interpreting it with an "#" ??
Because it's written with a '#' in the mschap module. Go back and ensure that there is only ONE mschap module in the "modules" directory. Alan DeKok.
Deleted my mschap.bak and rpmfiles in the modules directory and now it works! Thanks for that hint! -----Ursprüngliche Nachricht----- Von: freeradius-users-bounces+felix.weber=swmr.de@lists.freeradius.org [mailto:freeradius-users-bounces+felix.weber=swmr.de@lists.freeradius.org] Im Auftrag von Alan DeKok Gesendet: Mittwoch, 4. April 2012 18:43 An: FreeRadius users mailing list Betreff: Re: AW: MSCHAP Auth fails Go back and ensure that there is only ONE mschap module in the "modules" directory.
participants (3)
-
Alan DeKok -
Andres Septer -
Weber, Felix