I followed the tutorial (http://deployingradius.com/documents/configuration/active_directory.html) and seemed to have mschap working. I had configured freeradius to use eap prior to setting up to work with AD, so not sure if anything I already configured is conflicting. Wanting to verify mschap was indeed working, I disabled the domain user account, and verified I could no longer authenticate via freeradius. I enabled the account again and can login from a LAN PC, but have not been able to authenticate through wireless via freeradius. Wbinfo, ntlm_auth, and radtest all work fine from the command line. and I have added "DEFAULT Auth-Type = ntlm_auth " to the user file Not sure how much to include from debug, but this seems to be the issue. Have read up on other posts about this and have seen a variety of reasons from a samba bug to running freeradius on 64bit. Hoping it is just a config option I missed. [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for raymond with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect
Raymond Norton wrote:
Wanting to verify mschap was indeed working, I disabled the domain user account, and verified I could no longer authenticate via freeradius. I enabled the account again and can login from a LAN PC, but have not been able to authenticate through wireless via freeradius. Wbinfo, ntlm_auth, and radtest all work fine from the command line. and I have added "DEFAULT Auth-Type = ntlm_auth " to the user file
See raddb/sites-available/inner-tunnel. In 2.1.10, you can test MS-CHAP directly to the inner-tunnel server. Follow the same instructions in "inner-tunnel" as you did for the "default" virtual server. Alan DeKok.
I configured both default and inner-tunnel during the tutorial. I will check into testing MS-CHAP. Just want to verify if this is how it should look in the enabled sites: Auth-Type NTLM_AUTH { ntlm_auth } On 02/18/2011 12:45 AM, Alan DeKok wrote:
Raymond Norton wrote:
Wanting to verify mschap was indeed working, I disabled the domain user account, and verified I could no longer authenticate via freeradius. I enabled the account again and can login from a LAN PC, but have not been able to authenticate through wireless via freeradius. Wbinfo, ntlm_auth, and radtest all work fine from the command line. and I have added "DEFAULT Auth-Type = ntlm_auth " to the user file See raddb/sites-available/inner-tunnel. In 2.1.10, you can test MS-CHAP directly to the inner-tunnel server.
Follow the same instructions in "inner-tunnel" as you did for the "default" virtual server.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Just curious if the hyphen is supposed to be in front of the domain name on this line: ntlm_auth = "*/path/to/ntlm_auth* --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-*MYDOMAIN*} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"
Raymond Norton wrote:
Just curious if the hyphen is supposed to be in front of the domain name on this line:
Yes. "man unlang". Look for ":-"
ntlm_auth = "*/path/to/ntlm_auth* --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-*MYDOMAIN*} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"
------------------------------------------------------------------------
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
hi, i would like to implement dhcp over radius! is there any mysql support? my dhcp config looks like this! === snip == shared-network XXXXX { if substring(option vendor-class-identifier, 0, 2) = "SN" { next-server X.X.X.X; filename = concat("/inalp/", option vendor-class-identifier, "_", binary-to-ascii (16, 8, "-", substring (hardware, 1, 6))); } if substring(option vendor-class-identifier, 0, 9) = "Mediatrix" { option vendor-encapsulated-options c9:4:c3:3a:a0:d9; } subnet X.X.X.X netmask 255.255.255.0 { option routers 172.28.96.1; option domain-name-servers X.X.X.X,X.X.X.X; pool { range X.X.X.X X.X.X.X; } } } === snap === is there any way that i can this implement in my radius servers? on cisco routers i configre "ip-helper <radius-server-ip-address>" thx. This e-mail is confidential and may well also be legally privileged. If you have received it in error, you are on notice of its status. Please notify us immediately by reply e-mail and then delete this message from your system. Please do not copy it or use it for any purposes, or disclose its contents to any other person: to do so could be a breach of confidence. Thank you for your cooperation. Information pursuant to paragraph 14 Austrian Companies Code: UPC Austria GmbH; Registered Office: Wolfganggasse 58-60, 1120 Vienna Company Register Number: FN 189858d at the Commercial Court of Vienna
Got things working...yeah!
started with fresh user, ntlm_auth and mschap files, edited according to
tutorial. I then got the following error:
winbind client not authorized to use winbindd_pam_auth_crap
I had already changed permissions yesterday, but did it again.
I was able to login using mschap after that.
Just curious, the tutorial shows the following:
ntlm_auth = "*/path/to/ntlm_auth* --request-nt-key
--username=%{mschap:User-Name:-None}
--domain=%{%{mschap:NT-Domain}:-*MYDOMAIN*}
--challenge=%{mschap:Challenge:-00}
--nt-response=%{mschap:NT-Response:-00}"
But, mschap shows:
ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key
--username=%{%{Stripped-User-Name}:-%{User-Name:-None}}
--challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"
}
I added the domain info, but wonder if we should just be doing a
copy/paste from the tutorial and edit the path and domain items.
On 02/18/2011 10:01 AM, Alan DeKok wrote:
> Raymond Norton wrote:
>> Just curious if the hyphen is supposed to be in front of the domain
>> name on this line:
> Yes. "man unlang". Look for ":-"
>
>> ntlm_auth = "*/path/to/ntlm_auth* --request-nt-key
>> --username=%{mschap:User-Name:-None}
>> --domain=%{%{mschap:NT-Domain}:-*MYDOMAIN*}
>> --challenge=%{mschap:Challenge:-00}
>> --nt-response=%{mschap:NT-Response:-00}"
>>
>>
>> ------------------------------------------------------------------------
>>
>> -
>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
>
participants (3)
-
Alan DeKok -
Ehart, Norbert -
Raymond Norton