freeRADIUS -> AD Auth
Hi again. I have one last Problem. I hope i don´t bug you. The mschapv2 challange fails. --domain=%{mschap:NT-Domain} doesn´t change the result. [mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] Creating challenge hash with username: hausmeister@oblan [mschap] Told to do MS-CHAPv2 for hausmeister@oblan with NT-Password [mschap] expand: %{Stripped-User-Name} -> hausmeister [mschap] expand: --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} -> --username=hausmeister [mschap] Creating challenge hash with username: hausmeister@oblan [mschap] expand: %{mschap:Challenge} -> fffc6d74f50463ee [mschap] expand: --challenge=%{%{mschap:Challenge}:-00} -> --challenge=fffc6d74f50463ee [mschap] expand: %{mschap:NT-Response} -> 46ced655ef1738b05dad84aaa9fea60fc7cfa22f9c6c563b [mschap] expand: --nt-response=%{%{mschap:NT-Response}:-00} -> --nt-response=46ced655ef1738b05dad84aaa9fea60fc7cfa22f9c6c563b Exec-Program output: Reading winbind reply failed! (0xc0000001) Exec-Program-Wait: plaintext: Reading winbind reply failed! (0xc0000001) Exec-Program: returned: 1 [mschap] External script failed. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject NTLM_AUTH works: haus-meister@KRATOS:~$ ntlm_auth --request-nt-key --username=hausmeister --domain=OBLAN Password: NT_STATUS_OK: Success (0x0) Winbind gives me a list of all AD Users with wbinfo -u. So im pretty sure i still have a mistake in the modules/mschap i´ve tried a couple of things but nothing worked... Also i have another question: Is there a way to tell the clients (especially iOS/Android) that they have to use a Proxy-Server (e.g 192.168.1.254:3128) so that the Useres must not do that? Thanks again! -- Mit freundlichem Gruß Nicolas Fischer email: nfischer@hush.com jabber: jagger@jabber.ccc.de tel: 01573-0420888 Skype: jagger64 TOX: Just ask me :) PGP-Key: http://keyserver.ubuntu.com/pks/lookup?op=vindex&fingerprint=on&search=0xCF5... If you sent me a PGP Crypted Mail I´ll be happy and will give you a free cookie :)
nfischer@hush.com wrote:
The mschapv2 challange fails. --domain=%{mschap:NT-Domain} doesn´t change the result.
You need to add "--request-nt-key " to the parameters for ntlm_auth. It is there in the default configuration. You edited the configuration and broke it. Don't do that.
Also i have another question: Is there a way to tell the clients (especially iOS/Android) that they have to use a Proxy-Server (e.g 192.168.1.254:3128) so that the Useres must not do that?
That's a web proxy. You can't configure that with RADIUS. Alan DeKok.
Its a rights problem. Can someone plz give me the ls -all from /etc/freeradius/ /etc/freeradius/modules /etc/freeradius/certs /etc/feeradius/sites-available /etc/feeradius/sites-enabled and /var/run/samba So that I can check the pemissions... Thanks -- Mit freundlichem Gruß Nicolas Fischer On 15.8.2014 at 1:19 PM, "Alan DeKok" wrote:nfischer@hush.com wrote:
The mschapv2 challange fails. --domain=%{mschap:NT-Domain} doesn´t change the result.
You need to add "--request-nt-key " to the parameters for ntlm_auth. It is there in the default configuration. You edited the configuration and broke it. Don't do that.
Also i have another question: Is there a way to tell the clients (especially iOS/Android) that they have to use a Proxy-Server (e.g 192.168.1.254:3128) so that the Useres must not do that?
That's a web proxy. You can't configure that with RADIUS. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi, look at what the server is running...
[mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] Creating challenge hash with username: hausmeister@oblan [mschap] Told to do MS-CHAPv2 for hausmeister@oblan with NT-Password [mschap] expand: %{Stripped-User-Name} -> hausmeister [mschap] expand: --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} -> --username=hausmeister [mschap] Creating challenge hash with username: hausmeister@oblan [mschap] expand: %{mschap:Challenge} -> fffc6d74f50463ee [mschap] expand: --challenge=%{%{mschap:Challenge}:-00} -> --challenge=fffc6d74f50463ee [mschap] expand: %{mschap:NT-Response} -> 46ced655ef1738b05dad84aaa9fea60fc7cfa22f9c6c563b [mschap] expand: --nt-response=%{%{mschap:NT-Response}:-00} -> --nt-response=46ced655ef1738b05dad84aaa9fea60fc7cfa22f9c6c563b Exec-Program output: Reading winbind reply failed! (0xc0000001) Exec-Program-Wait: plaintext: Reading winbind reply failed! (0xc0000001) Exec-Program: returned: 1 [mschap] External script failed. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject
compared to what ou run
NTLM_AUTH works: haus-meister@KRATOS:~$ ntlm_auth --request-nt-key --username=hausmeister --domain=OBLAN Password: NT_STATUS_OK: Success (0x0)
theres a 'domain' in your hand-run stuff - you havent configured the server to use a --domain=OBLAN theres also a request NT key argument which you dont have. as for permissions...we run radiusd process as 'radiusd' user, so permissions are radiusd:radiusd for all of the raddb directory, shares, log dirs etc...and radiusd is in the winbind group so the winbind_privileged directory is okay alan
as for permissions...we run radiusd process as 'radiusd' user, so permissions are radiusd:radiusd for all of the raddb directory, shares, log dirs etc...and radiusd is in the winbind group so the winbind_privileged directory is okay
Just FYI - radiusd is not automatically in the winbind (or rather, wbpriv) group, so you can add radiusd to the group with: usermod -a -G wbpriv (or winbind, depending on which group you have). :-) Stefan Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238
Hi,
as for permissions...we run radiusd process as 'radiusd' user, so permissions are radiusd:radiusd for all of the raddb directory, shares, log dirs etc...and radiusd is in the winbind group so the winbind_privileged directory is okay
Just FYI - radiusd is not automatically in the winbind (or rather, wbpriv) group, so you can add radiusd to the group with: usermod -a -G wbpriv (or winbind, depending on which group you have).
and why do this? well, the alternative is change permissions on the winbind_privileged directory to be that of the radiusd group..... which works fine.... until you update SAMBA - at which point the directory permissions get blatted and your auths all then fail ;-) alan
and why do this? well, the alternative is change permissions on the winbind_privileged directory to be that of the radiusd group..... which works fine.... until you update SAMBA - at which point the directory permissions get blatted and your auths all then fail ;-)
Exactly. That's the point of groups after all ;-) Stefan Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238
participants (4)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
nfischer＠hush.com -
Stefan Paetow