Did the recent upgrade of freeradius2 add a ntlm_auth module? I'm now seeing Exec-Program output: Exec-Program: FAILED to execute /path/to/ntlm_auth: No such file or directory Exec-Program-Wait: plaintext: Exec-Program: FAILED to execute /path/to/ntlm_auth: No such file or directory Exec-Program: returned: 1 ++[ntlm_auth] returns reject Failed to authenticate the user. Login incorrect: [rsteeves] (from client 10.100.0.8 port 1 cli 10.20.31.17) I went and looked, and there's a ntlm_auth module now where I don't think there was one before. . . I had/have ntlm_auth defined in radiusd.conf exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth ntlm_auth --request-nt-key --domain=int.example.com --username=%{mschap:User-Name} --password=%{User-Password}" } Rick Rick Steeves http://www.sinister.net In reality nothing is more damaging to the adventurous spirit within a man than a secure future - Alexander Supertramp
On 01/21/2010 02:31 PM, freeradius@corwyn.net wrote:
Did the recent upgrade of freeradius2 add a ntlm_auth module?
Yes, 2.1.8 added ntlm_auth. Unfortunately doc/ChangeLog omitted this. -- John Dennis <jdennis@redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/
I think that breaks most of the current instructions out there, since the module seems to win out over what I have defined in radiusd.conf. Heck, it breaks my 2.1.7 ones, and the wiki .... If I just remove the exec from radiusd.conf ( and confiure the new ntlm_auth module) everything should be ok? Rick At 02:50 PM 1/21/2010, John Dennis wrote:
On 01/21/2010 02:31 PM, freeradius@corwyn.net wrote:
Did the recent upgrade of freeradius2 add a ntlm_auth module?
Yes, 2.1.8 added ntlm_auth.
Unfortunately doc/ChangeLog omitted this.
-- John Dennis <jdennis@redhat.com>
Looking to carve out IT costs? www.redhat.com/carveoutcosts/ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi,
If I just remove the exec from radiusd.conf ( and confiure the new ntlm_auth module) everything should be ok?
you should avoid just lurching your old configs across to new versions. best to start witha clean slate and then edit/add your logic as required (i've found that by keeping the old configs I've lost out on new features and options and then got undone by eg new logging methods - the same is very much true with ISC DHCPD and BIND) you'll, of course, want to edit the module so that /path/to/ntlm_auth actually points to your ntlm_auth binary too! (I'm surprised this hasnt been set in the distro package as surely you'd be running the distro version of samba - which is a required dependency. odd) alan
participants (3)
-
Alan Buxey -
freeradius@corwyn.net -
John Dennis