MSCHAPV2 NTLM Auth and Smbv2/3
Hi all, This has probably been discussed before is their anyway to not break ntlm_auth and still disable smbv1. There is tremendous amount of paranoia with smbv1 since the wannacry outbreak. What others options are available for peap mschap? Many Thanks Arnab
On Thu, Jun 08, 2017 at 02:44:55PM +0100, Arnab Roy wrote:
There is tremendous amount of paranoia with smbv1 since the wannacry outbreak.
Patch your systems? Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
If only people understood security! Just because they have read somewhere it needs to be disabled without realising how why.. joys!
On 08-06-17 15:44, Arnab Roy wrote:
Hi all, This has probably been discussed before is their anyway to not break ntlm_auth and still disable smbv1. There is tremendous amount of paranoia with smbv1 since the wannacry outbreak. What others options are available for peap mschap? Many Thanks Arnab
This sounds like a Samba-question to me, not FreeRADIUS (even though FreeRADIUS can use ntml_auth) -- Herwin Weststrate
Just been sent back from the samba lists to here...:))) they are saying to use ldaps instead?
On Jun 8, 2017, at 10:01 AM, Arnab Roy <arnabroy@mail.com> wrote:
Just been sent back from the samba lists to here...:))) they are saying to use ldaps instead?
You didn't ask the right question. Active Directory does not allow FreeRADIUS to query the user's password via LDAP, or LDAPS. FreeRADIUS has MS-CHAP authentication data, and needs to be able to ask Active Directory "is this OK?" The ONLY way to do this is via ntlm_auth. Alan DeKok.
Hi Alan, I asked right question but the person replying didn't understand how freeradius does mschap auth... Instead of arguing with anyone it's better if we start to work together so between samba and freeradius a solution could be achieved as the AD admin will not care about our headaches and simply tell to use nps instead!. Many Thanks Arnab
On Jun 8, 2017, at 10:18 AM, Arnab Roy <arnabroy@mail.com> wrote:
I asked right question but the person replying didn't understand how freeradius does mschap auth...
Then it's your responsibility to communicate with him, instead of coming back here and making it our problem.
Instead of arguing with anyone it's better if we start to work together so between samba and freeradius a solution could be achieved as the AD admin will not care about our headaches and simply tell to use nps instead!.
We can't fix the problem. So there's no point in talking about it here. We don't implement ntlm_auth. Samba does. Samba doesn't control the AD security settings. Your local AD administrator does. Samba doesn't control how ntlm_works. Microsoft does. The only person here who has a choice is your local AD administrator. Convince him to help you, and it will work. Asking people to "work together" is just you trying to make us responsible for the mistakes of your AD administrator. No amount of poking FreeRADIUS or Samba will work around these limitations. There are 100% outside of our control. Tell your AD administrator to fix the security settings. It's 2017. It shouldn't be difficult. Alan DeKok.
I am not blaming anyone or trying to make this anyone's problem. Before I leave everyone in peace what about when we don't use ntlm_auth but directly use winbind pipe ? Again apologies if this question should not be asked. Many Thanks Arnab
On Jun 8, 2017, at 10:41 AM, Arnab Roy <arnabroy@mail.com> wrote:
I am not blaming anyone or trying to make this anyone's problem.
Asking us to solve a problem which can only be solved by your AD administrator is making it our problem.
Before I leave everyone in peace what about when we don't use ntlm_auth but directly use winbind pipe ?
That still ends up using ntlm. When I said the only solution was to talk to your AD administrator, that's what I meant. Now go convince your AD administrator to fix the problem. There is nothing that FreeRADIUS or Samba can do to fix the problem. I've already said that, and I won't say it again. Alan DeKok.
participants (4)
-
Alan DeKok -
Arnab Roy -
Herwin Weststrate -
Matthew Newton