Hi all, I understand my issue is not unique. I have a Samba DC running samba 4.6.7 on Ubuntu 16.04. I'm now trying to set up FreeRADIUS 3 (3.0.16) with SMB 4.7.6 on Ubuntu 18.04 to authenticate against the Samba DC. Running "radtest aduser password localhost:18120 0 testing123" works. Running "radtest -t mschap aduser password localhost:18120 0 testing123" does not work. I have added this into the smb.conf on both servers:    ntlm auth = yes I have been basically following these tutorials: * https://blog.svedr.in/posts/freeradius-peapv0+mschapv2-howto/ * http://deployingradius.com/documents/configuration/active_directory.html * https://wiki.samba.org/index.php/Authenticating_Freeradius_against_Active_Di... I would also like to add a comment on the fact that I cannot restart smbd on the DC if I put the following line (nothing in the Samba log nor syslog): ntlm auth = mschapv2-and-ntlmv2-only I have also tried to set up a Microsoft Radius server (join it to the same domain), but got the same results ("wrong password"), so I actually suspect there might be something wrong with the Samba DC. Unfortunately, I couldn't find so much information on how the DC should be. Here's my full debug: main {  security {         user = "freerad"         group = "freerad"         allow_core_dumps = no  }         name = "freeradius"         prefix = "/usr"         localstatedir = "/var"         logdir = "/var/log/freeradius"         run_dir = "/var/run/freeradius" } main {         name = "freeradius"         prefix = "/usr"         localstatedir = "/var"         sbindir = "/usr/sbin"         logdir = "/var/log/freeradius"         run_dir = "/var/run/freeradius"         libdir = "/usr/lib/freeradius"         radacctdir = "/var/log/freeradius/radacct"         hostname_lookups = no         max_request_time = 30         cleanup_delay = 5         max_requests = 16384         pidfile = "/var/run/freeradius/freeradius.pid"         checkrad = "/usr/sbin/checkrad"         debug_level = 0         proxy_requests = yes  log {         stripped_names = no         auth = no         auth_badpass = no         auth_goodpass = no         colourise = yes         msg_denied = "You are already logged in - access denied"  }  resources {  }  security {         max_attributes = 200         reject_delay = 1.000000         status_server = yes  } } radiusd: #### Loading Realms and Home Servers ####  proxy server {         retry_delay = 5         retry_count = 3         default_fallback = no         dead_time = 120         wake_all_if_all_dead = no  }  home_server localhost {         ipaddr = 127.0.0.1         port = 1812         type = "auth"         secret = <<< secret >>>         response_window = 20.000000         response_timeouts = 1         max_outstanding = 65536         zombie_period = 40         status_check = "status-server"         ping_interval = 30         check_interval = 30         check_timeout = 4         num_answers_to_alive = 3         revive_interval = 120   limit {         max_connections = 16         max_requests = 0         lifetime = 0         idle_timeout = 0   }   coa {         irt = 2         mrt = 16         mrc = 5         mrd = 30   }  }  home_server_pool my_auth_failover {         type = fail-over         home_server = localhost  }  realm example.com {         auth_pool = my_auth_failover  }  realm LOCAL {  } radiusd: #### Loading Clients ####  client localhost {         ipaddr = 127.0.0.1         require_message_authenticator = no         secret = <<< secret >>>         nas_type = "other"         proto = "*"   limit {         max_connections = 16         lifetime = 0         idle_timeout = 30   }  }  client localhost_ipv6 {         ipv6addr = ::1         require_message_authenticator = no         secret = <<< secret >>>   limit {         max_connections = 16         lifetime = 0         idle_timeout = 30   }  } Debugger not attached  # Creating Auth-Type = ntlm_auth  # Creating Auth-Type = eap  # Creating Auth-Type = PAP  # Creating Auth-Type = CHAP  # Creating Auth-Type = MS-CHAP radiusd: #### Instantiating modules ####  modules {   # Loaded module rlm_linelog   # Loading module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog   linelog {         filename = "/var/log/freeradius/linelog"         escape_filenames = no         syslog_severity = "info"         permissions = 384         format = "This is a log message for %{User-Name}"         reference = "messages.%{%{reply:Packet-Type}:-default}"   }   # Loading module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog   linelog log_accounting {         filename = "/var/log/freeradius/linelog-accounting"         escape_filenames = no         syslog_severity = "info"         permissions = 384         format = ""         reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}"   }   # Loaded module rlm_radutmp   # Loading module "sradutmp" from file /etc/freeradius/3.0/mods-enabled/sradutmp   radutmp sradutmp {         filename = "/var/log/freeradius/sradutmp"         username = "%{User-Name}"         case_sensitive = yes         check_with_nas = yes         permissions = 420         caller_id = no   }   # Loaded module rlm_exec   # Loading module "echo" from file /etc/freeradius/3.0/mods-enabled/echo   exec echo {         wait = yes         program = "/bin/echo %{User-Name}"         input_pairs = "request"         output_pairs = "reply"         shell_escape = yes   }   # Loading module "radutmp" from file /etc/freeradius/3.0/mods-enabled/radutmp   radutmp {         filename = "/var/log/freeradius/radutmp"         username = "%{User-Name}"         case_sensitive = yes         check_with_nas = yes         permissions = 384         caller_id = yes   }   # Loaded module rlm_always   # Loading module "reject" from file /etc/freeradius/3.0/mods-enabled/always   always reject {         rcode = "reject"         simulcount = 0         mpp = no   }   # Loading module "fail" from file /etc/freeradius/3.0/mods-enabled/always   always fail {         rcode = "fail"         simulcount = 0         mpp = no   }   # Loading module "ok" from file /etc/freeradius/3.0/mods-enabled/always   always ok {         rcode = "ok"         simulcount = 0         mpp = no   }   # Loading module "handled" from file /etc/freeradius/3.0/mods-enabled/always   always handled {         rcode = "handled"         simulcount = 0         mpp = no   }   # Loading module "invalid" from file /etc/freeradius/3.0/mods-enabled/always   always invalid {         rcode = "invalid"         simulcount = 0         mpp = no   }   # Loading module "userlock" from file /etc/freeradius/3.0/mods-enabled/always   always userlock {         rcode = "userlock"         simulcount = 0         mpp = no   }   # Loading module "notfound" from file /etc/freeradius/3.0/mods-enabled/always   always notfound {         rcode = "notfound"         simulcount = 0         mpp = no   }   # Loading module "noop" from file /etc/freeradius/3.0/mods-enabled/always   always noop {         rcode = "noop"         simulcount = 0         mpp = no   }   # Loading module "updated" from file /etc/freeradius/3.0/mods-enabled/always   always updated {         rcode = "updated"         simulcount = 0         mpp = no   }   # Loaded module rlm_dynamic_clients   # Loading module "dynamic_clients" from file /etc/freeradius/3.0/mods-enabled/dynamic_clients   # Loaded module rlm_passwd   # Loading module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd   passwd etc_passwd {         filename = "/etc/passwd"         format = "*User-Name:Crypt-Password:"         delimiter = ":"         ignore_nislike = no         ignore_empty = yes         allow_multiple_keys = no         hash_size = 100   }   # Loaded module rlm_cache   # Loading module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap   cache cache_eap {         driver = "rlm_cache_rbtree"         key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}"         ttl = 15         max_entries = 0         epoch = 0         add_stats = no   }   # Loaded module rlm_attr_filter   # Loading module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter   attr_filter attr_filter.post-proxy {         filename = "/etc/freeradius/3.0/mods-config/attr_filter/post-proxy"         key = "%{Realm}"         relaxed = no   }   # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter   attr_filter attr_filter.pre-proxy {         filename = "/etc/freeradius/3.0/mods-config/attr_filter/pre-proxy"         key = "%{Realm}"         relaxed = no   }   # Loading module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter   attr_filter attr_filter.access_reject {         filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_reject"         key = "%{User-Name}"         relaxed = no   }   # Loading module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter   attr_filter attr_filter.access_challenge {         filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_challenge"         key = "%{User-Name}"         relaxed = no   }   # Loading module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter   attr_filter attr_filter.accounting_response {         filename = "/etc/freeradius/3.0/mods-config/attr_filter/accounting_response"         key = "%{User-Name}"         relaxed = no   }   # Loaded module rlm_files   # Loading module "files" from file /etc/freeradius/3.0/mods-enabled/files   files {         filename = "/etc/freeradius/3.0/mods-config/files/authorize"         acctusersfile = "/etc/freeradius/3.0/mods-config/files/accounting"         preproxy_usersfile = "/etc/freeradius/3.0/mods-config/files/pre-proxy"   }   # Loaded module rlm_realm   # Loading module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm   realm IPASS {         format = "prefix"         delimiter = "/"         ignore_default = no         ignore_null = no   }   # Loading module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm   realm suffix {         format = "suffix"         delimiter = "@"         ignore_default = no         ignore_null = no   }   # Loading module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm   realm realmpercent {         format = "suffix"         delimiter = "%"         ignore_default = no         ignore_null = no   }   # Loading module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm   realm ntdomain {         format = "prefix"         delimiter = "\\"         ignore_default = no         ignore_null = no   }   # Loaded module rlm_pap   # Loading module "pap" from file /etc/freeradius/3.0/mods-enabled/pap   pap {         normalise = yes   }   # Loaded module rlm_eap   # Loading module "eap" from file /etc/freeradius/3.0/mods-enabled/eap   eap {         default_eap_type = "md5"         timer_expire = 60         ignore_unknown_eap_types = no         cisco_accounting_username_bug = no         max_sessions = 16384   }   # Loading module "ntlm_auth" from file /etc/freeradius/3.0/mods-enabled/ntlm_auth   exec ntlm_auth {         wait = yes         program = "/usr/bin/ntlm_auth --request-nt-key --domain=MY.DOMAIN.COM --username=%{mschap:User-Name} --password=%{User-Password}"         shell_escape = yes   }   # Loaded module rlm_utf8   # Loading module "utf8" from file /etc/freeradius/3.0/mods-enabled/utf8   # Loaded module rlm_logintime   # Loading module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime   logintime {         minimum_timeout = 60   }   # Loaded module rlm_expr   # Loading module "expr" from file /etc/freeradius/3.0/mods-enabled/expr   expr {         safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ"   }   # Loaded module rlm_chap   # Loading module "chap" from file /etc/freeradius/3.0/mods-enabled/chap   # Loaded module rlm_detail   # Loading module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log   detail auth_log {         filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d"         header = "%t"         permissions = 384         locking = no         escape_filenames = no         log_packet_header = no   }   # Loading module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log   detail reply_log {         filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d"         header = "%t"         permissions = 384         locking = no         escape_filenames = no         log_packet_header = no   }   # Loading module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log   detail pre_proxy_log {         filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d"         header = "%t"         permissions = 384         locking = no         escape_filenames = no         log_packet_header = no   }   # Loading module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log   detail post_proxy_log {         filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d"         header = "%t"         permissions = 384         locking = no         escape_filenames = no         log_packet_header = no   }   # Loaded module rlm_unpack   # Loading module "unpack" from file /etc/freeradius/3.0/mods-enabled/unpack   # Loaded module rlm_mschap   # Loading module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap   mschap {         use_mppe = yes         require_encryption = no         require_strong = no         with_ntdomain_hack = yes         ntlm_auth = "/usr/bin/ntlm_auth --allow-mschapv2 --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-MY.DOMAIN.COM} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"    passchange {    }         allow_retry = yes         winbind_retry_with_normalised_username = no   }   # Loading module "detail" from file /etc/freeradius/3.0/mods-enabled/detail   detail {         filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"         header = "%t"         permissions = 384         locking = no         escape_filenames = no         log_packet_header = no   }   # Loaded module rlm_expiration   # Loading module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration   # Loaded module rlm_soh   # Loading module "soh" from file /etc/freeradius/3.0/mods-enabled/soh   soh {         dhcp = yes   }   # Loaded module rlm_replicate   # Loading module "replicate" from file /etc/freeradius/3.0/mods-enabled/replicate   # Loaded module rlm_digest   # Loading module "digest" from file /etc/freeradius/3.0/mods-enabled/digest   # Loading module "exec" from file /etc/freeradius/3.0/mods-enabled/exec   exec {         wait = no         input_pairs = "request"         shell_escape = yes         timeout = 10   }   # Loaded module rlm_unix   # Loading module "unix" from file /etc/freeradius/3.0/mods-enabled/unix   unix {         radwtmp = "/var/log/freeradius/radwtmp"   } Creating attribute Unix-Group   # Loaded module rlm_preprocess   # Loading module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess   preprocess {         huntgroups = "/etc/freeradius/3.0/mods-config/preprocess/huntgroups"         hints = "/etc/freeradius/3.0/mods-config/preprocess/hints"         with_ascend_hack = no         ascend_channels_per_line = 23         with_ntdomain_hack = no         with_specialix_jetstream_hack = no         with_cisco_vsa_hack = no         with_alvarion_vsa_hack = no   }   instantiate {   }   # Instantiating module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog   # Instantiating module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog   # Instantiating module "reject" from file /etc/freeradius/3.0/mods-enabled/always   # Instantiating module "fail" from file /etc/freeradius/3.0/mods-enabled/always   # Instantiating module "ok" from file /etc/freeradius/3.0/mods-enabled/always   # Instantiating module "handled" from file /etc/freeradius/3.0/mods-enabled/always   # Instantiating module "invalid" from file /etc/freeradius/3.0/mods-enabled/always   # Instantiating module "userlock" from file /etc/freeradius/3.0/mods-enabled/always   # Instantiating module "notfound" from file /etc/freeradius/3.0/mods-enabled/always   # Instantiating module "noop" from file /etc/freeradius/3.0/mods-enabled/always   # Instantiating module "updated" from file /etc/freeradius/3.0/mods-enabled/always   # Instantiating module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no   # Instantiating module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked   # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/post-proxy   # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/pre-proxy   # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_reject [/etc/freeradius/3.0/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay"   found in filter list for realm "DEFAULT". [/etc/freeradius/3.0/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec"      found in filter list for realm "DEFAULT".   # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_challenge   # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/accounting_response   # Instantiating module "files" from file /etc/freeradius/3.0/mods-enabled/files reading pairlist file /etc/freeradius/3.0/mods-config/files/authorize reading pairlist file /etc/freeradius/3.0/mods-config/files/accounting reading pairlist file /etc/freeradius/3.0/mods-config/files/pre-proxy   # Instantiating module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm   # Instantiating module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm   # Instantiating module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm   # Instantiating module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm   # Instantiating module "pap" from file /etc/freeradius/3.0/mods-enabled/pap   # Instantiating module "eap" from file /etc/freeradius/3.0/mods-enabled/eap    # Linked to sub-module rlm_eap_md5    # Linked to sub-module rlm_eap_leap    # Linked to sub-module rlm_eap_gtc    gtc {         challenge = "Password: "         auth_type = "PAP"    }    # Linked to sub-module rlm_eap_tls    tls {         tls = "tls-common"    }    tls-config tls-common {         verify_depth = 0         ca_path = "/etc/freeradius/3.0/certs"         pem_file_type = yes         private_key_file = "/etc/ssl/private/ssl-cert-snakeoil.key"         certificate_file = "/etc/ssl/certs/ssl-cert-snakeoil.pem"         ca_file = "/etc/ssl/certs/ca-certificates.crt"         private_key_password = <<< secret >>>         dh_file = "/etc/freeradius/3.0/certs/dh"         fragment_size = 1024         include_length = yes         auto_chain = yes         check_crl = no         check_all_crl = no         cipher_list = "DEFAULT"         cipher_server_preference = no         ecdh_curve = "prime256v1"         tls_max_version = ""         tls_min_version = "1.0"     cache {         enable = no         lifetime = 24         max_entries = 255     }     verify {         skip_if_ocsp_ok = no     }     ocsp {         enable = no         override_cert_url = yes         url = "http://127.0.0.1/ocsp/"         use_nonce = yes         timeout = 0         softfail = no     }    }    # Linked to sub-module rlm_eap_ttls    ttls {         tls = "tls-common"         default_eap_type = "md5"         copy_request_to_tunnel = no         use_tunneled_reply = no         virtual_server = "inner-tunnel"         include_length = yes         require_client_cert = no    } tls: Using cached TLS configuration from previous invocation    # Linked to sub-module rlm_eap_peap    peap {         tls = "tls-common"         default_eap_type = "mschapv2"         copy_request_to_tunnel = no         use_tunneled_reply = no         proxy_tunneled_request_as_eap = yes         virtual_server = "inner-tunnel"         soh = no         require_client_cert = no    } tls: Using cached TLS configuration from previous invocation    # Linked to sub-module rlm_eap_mschapv2    mschapv2 {         with_ntdomain_hack = no         send_error = no    }   # Instantiating module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime   # Instantiating module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output   # Instantiating module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log   # Instantiating module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log   # Instantiating module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log   # Instantiating module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap rlm_mschap (mschap): authenticating by calling 'ntlm_auth'   # Instantiating module "detail" from file /etc/freeradius/3.0/mods-enabled/detail   # Instantiating module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration   # Instantiating module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/huntgroups reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/hints  } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/3.0/radiusd.conf } # server server inner-tunnel { # from file /etc/freeradius/3.0/sites-enabled/inner-tunnel  # Loading authenticate {...}  # Loading authorize {...}  # Loading session {...}  # Loading post-proxy {...}  # Loading post-auth {...} } # server inner-tunnel radiusd: #### Opening IP addresses and Ports #### listen {         type = "auth"         ipaddr = 127.0.0.1         port = 18120 } Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on proxy address * port 57211 Ready to process requests (0) Received Access-Request Id 49 from 127.0.0.1:46133 to 127.0.0.1:18120 length 77 (0)   User-Name = "myusername" (0)   User-Password = "Mcm6jT2UJvjAjJ" (0)   NAS-IP-Address = 10.84.55.38 (0)   NAS-Port = 0 (0)   Message-Authenticator = 0x17ea111ceca2d0d953d674a38ba4005a (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (0)   authorize { (0)     [chap] = noop (0)     [mschap] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "myusername", looking up realm NULL (0) suffix: No such realm "NULL" (0)     [suffix] = noop (0)     update control { (0)       Proxy-To-Realm := LOCAL (0)     } # update control = noop (0) eap: No EAP-Message, not doing EAP (0)     [eap] = noop (0) files: users: Matched entry DEFAULT at line 1 (0)     [files] = ok (0)     [expiration] = noop (0)     [logintime] = noop (0)     [pap] = noop (0)   } # authorize = ok (0) Found Auth-Type = ntlm_auth (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (0)   authenticate { (0) ntlm_auth: Executing: /usr/bin/ntlm_auth --request-nt-key --domain=MY.DOMAIN.COM --username=%{mschap:User-Name} --password=%{User-Password}: (0) ntlm_auth: EXPAND --username=%{mschap:User-Name} (0) ntlm_auth:    --> --username=myusername (0) ntlm_auth: EXPAND --password=%{User-Password} (0) ntlm_auth:    --> --password=Mcm6jT2UJvjAjJ (0) ntlm_auth: Program returned code (0) and output 'NT_STATUS_OK: The operation completed successfully. (0x0)' (0) ntlm_auth: Program executed successfully (0)     [ntlm_auth] = ok (0)   } # authenticate = ok (0) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (0) Sent Access-Accept Id 49 from 127.0.0.1:18120 to 127.0.0.1:46133 length 0 (0) Finished request Waking up in 4.9 seconds. (1) Received Access-Request Id 15 from 127.0.0.1:52276 to 127.0.0.1:18120 length 133 (1)   User-Name = "myusername" (1)   NAS-IP-Address = 10.84.55.38 (1)   NAS-Port = 0 (1)   Message-Authenticator = 0x7cab8514fdd0be90fbade3e2c6dfe9fe (1)   MS-CHAP-Challenge = 0xf41573e4ef540d65 (1)   MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000f9f84187630f12e1a1b2fd622925f23d6af05b8dd8e5ebb5 (1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (1)   authorize { (1)     [chap] = noop (1) mschap: Found MS-CHAP attributes.  Setting 'Auth-Type  = mschap' (1)     [mschap] = ok (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "myusername", looking up realm NULL (1) suffix: No such realm "NULL" (1)     [suffix] = noop (1)     update control { (1)       Proxy-To-Realm := LOCAL (1)     } # update control = noop (1) eap: No EAP-Message, not doing EAP (1)     [eap] = noop (1) files: users: Matched entry DEFAULT at line 1 (1)     [files] = ok (1)     [expiration] = noop (1)     [logintime] = noop (1)     [pap] = noop (1)   } # authorize = ok (1) Found Auth-Type = MS-CHAP (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (1)   Auth-Type MS-CHAP { (1) mschap: Client is using MS-CHAPv1 with NT-Password (1) mschap: Executing: /usr/bin/ntlm_auth --allow-mschapv2 --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-MY.DOMAIN.COM} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}: (1) mschap: EXPAND --username=%{mschap:User-Name:-None} (1) mschap:    --> --username=myusername (1) mschap: ERROR: No NT-Domain was found in the User-Name (1) mschap: EXPAND --domain=%{%{mschap:NT-Domain}:-MY.DOMAIN.COM} (1) mschap:    --> --domain=MY.DOMAIN.COM (1) mschap: mschap1: f4 (1) mschap: EXPAND --challenge=%{mschap:Challenge:-00} (1) mschap:    --> --challenge=f41573e4ef540d65 (1) mschap: EXPAND --nt-response=%{mschap:NT-Response:-00} (1) mschap:    --> --nt-response=f9f84187630f12e1a1b2fd622925f23d6af05b8dd8e5ebb5 (1) mschap: ERROR: Program returned code (1) and output 'The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d)' (1) mschap: External script failed (1) mschap: ERROR: External script says: The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d) (1) mschap: ERROR: MS-CHAP2-Response is incorrect (1)     [mschap] = reject (1)   } # Auth-Type MS-CHAP = reject (1) Failed to authenticate the user (1) Using Post-Auth-Type Reject (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (1)   Post-Auth-Type REJECT { (1) attr_filter.access_reject: EXPAND %{User-Name} (1) attr_filter.access_reject:    --> myusername (1) attr_filter.access_reject: Matched entry DEFAULT at line 11 (1)     [attr_filter.access_reject] = updated (1)   } # Post-Auth-Type REJECT = updated (1) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (1) Sending delayed response (1) Sent Access-Reject Id 15 from 127.0.0.1:18120 to 127.0.0.1:52276 length 61 (1)   MS-CHAP-Error = "\000E=691 R=1 C=ec6840b4c19cf4a4 V=2" Waking up in 1.4 seconds. (0) Cleaning up request packet ID 49 with timestamp +6 Waking up in 2.5 seconds. (1) Cleaning up request packet ID 15 with timestamp +9 Ready to process requests Thanks a lot in advance. Oleg