FreeRADIUS using Active Directory integration broken without any traces
Hello guys, I've a FreeBSD 10.0 server running FreeRADIUS 3 and things got broken without any apparent reason. I'm using Winbind from Samba4 to authenticate with ntlm_auth. I've done some debug to solve the problem, but I was unable to find where is the problem. ntlm_auth is working: # ntlm_auth --username=ferrao --request-nt-key # Password: # NT_STATUS_OK: Success (0x0) But RADIUS fails when doing EAP-PEAP authentication, and running FreeRADIUS in debug mode this is the error message: # (9) mschap : Executing: /usr/local/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%#{mschap:NT-Response}:-00} # (9) mschap : EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} # (9) mschap : --> --username=ferrao # (9) mschap : Creating challenge hash with username: ferrao # (9) mschap : EXPAND --challenge=%{%{mschap:Challenge}:-00} # (9) mschap : --> --challenge=082e8ba7b848aaae # (9) mschap : EXPAND --nt-response=%{%{mschap:NT-Response}:-00} # (9) mschap : --> --nt-response=27b40a6d1dba1b4acfd33aff5c710a43e70d050269087bf1 # (9) ERROR: mschap : Program returned code (1) and output 'Reading winbind reply failed! (0xc0000001)' # (9) mschap : External script failed. # (9) ERROR: mschap : External script says: Reading winbind reply failed! (0xc0000001) # (9) ERROR: mschap : MS-CHAP2-Response is incorrect # (9) [mschap] = reject # (9) } # Auth-Type MS-CHAP = reject # (9) eap : Freeing handler # (9) [eap] = reject # (9) } # authenticate = reject # (9) Failed to authenticate the user. # (9) Login incorrect (mschap: Program returned code (1) and output 'Reading winbind reply failed! (0xc0000001)'): [ferrao/<via Auth-Type = EAP>] (from client 192.168.0.0/26 port 0 via TLS tunnel) So something is wrong with Winbind and FreeRADIUS, and I don't know what. Thanks in advance,
On 26 Sep 2014, at 15:54, Vinícius Ferrão <ferrao@if.ufrj.br> wrote:
Hello guys,
I've a FreeBSD 10.0 server running FreeRADIUS 3 and things got broken without any apparent reason.
I'm using Winbind from Samba4 to authenticate with ntlm_auth. I've done some debug to solve the problem, but I was unable to find where is the problem.
ntlm_auth is working:
# ntlm_auth --username=ferrao --request-nt-key # Password: # NT_STATUS_OK: Success (0x0)
But RADIUS fails when doing EAP-PEAP authentication, and running FreeRADIUS in debug mode this is the error message:
# (9) mschap : Executing: /usr/local/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%#{mschap:NT-Response}:-00}
%{%#{mschap:NT-Response}:-00} ^ What's this? Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Hi,
%{%#{mschap:NT-Response}:-00} ^ What's this?
its a hash - also known as many other names - http://en.wikipedia.org/wiki/Number_sign ;-) alan
Hi, --On 26. September 2014 19:54:23 +0000 Vinícius Ferrão <ferrao@if.ufrj.br> wrote:
But RADIUS fails when doing EAP-PEAP authentication, and running FreeRADIUS in debug mode this is the error message:
# (9) mschap : Executing: /usr/local/bin/ntlm_auth --request-nt-key # --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} # --challenge=%{%{mschap:Challenge}:-00} # --nt-response=%{%#{mschap:NT-Response}:-00} (9) mschap : EXPAND # --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (9) mschap : # --> --username=ferrao # (9) mschap : Creating challenge hash with username: ferrao # (9) mschap : EXPAND --challenge=%{%{mschap:Challenge}:-00} # (9) mschap : --> --challenge=082e8ba7b848aaae # (9) mschap : EXPAND --nt-response=%{%{mschap:NT-Response}:-00} # (9) mschap : --> # --nt-response=27b40a6d1dba1b4acfd33aff5c710a43e70d050269087bf1 (9) # ERROR: mschap : Program returned code (1) and output 'Reading winbind # reply failed! (0xc0000001)' (9) mschap : External script failed. # (9) ERROR: mschap : External script says: Reading winbind reply failed! # (0xc0000001) (9) ERROR: mschap : MS-CHAP2-Response is incorrect # (9) [mschap] = reject # (9) } # Auth-Type MS-CHAP = reject # (9) eap : Freeing handler # (9) [eap] = reject # (9) } # authenticate = reject # (9) Failed to authenticate the user. # (9) Login incorrect (mschap: Program returned code (1) and output # 'Reading winbind reply failed! (0xc0000001)'): [ferrao/<via Auth-Type = # EAP>] (from client 192.168.0.0/26 port 0 via TLS tunnel)
So something is wrong with Winbind and FreeRADIUS, and I don't know what.
check the archives: <http://lists.freeradius.org/pipermail/freeradius-users/2012-May/061047.html> -- .:.Sebastian Hagedorn - Weyertal 121 (Gebäude 133), Zimmer 2.02.:. .:.Regionales Rechenzentrum (RRZK).:. .:.Universität zu Köln / Cologne University - ✆ +49-221-470-89578.:.
Hi Sebastian, Did you update SAMBA at any point and did you possibly change the ownership of the winbindd_privileged directory? If so, that might be the reason. Add radiusd (or freerad on Deb platforms) to the group that Winbind belongs to. That should resolve the problem. Stefan
-----Original Message----- From: freeradius-users-bounces+stefan.paetow=ja.net@lists.freeradius.org [mailto:freeradius-users- bounces+stefan.paetow=ja.net@lists.freeradius.org] On Behalf Of Sebastian Hagedorn Sent: 29 September 2014 14:28 To: Vinícius Ferrão Cc: FreeRadius users mailing list Subject: Re: FreeRADIUS using Active Directory integration broken without any traces
Hi,
--On 26. September 2014 19:54:23 +0000 Vinícius Ferrão <ferrao@if.ufrj.br> wrote:
But RADIUS fails when doing EAP-PEAP authentication, and running FreeRADIUS in debug mode this is the error message:
# (9) mschap : Executing: /usr/local/bin/ntlm_auth --request-nt-key # --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} # --challenge=%{%{mschap:Challenge}:-00} # --nt-response=%{%#{mschap:NT-Response}:-00} (9) mschap : EXPAND # --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (9) mschap : # --> --username=ferrao # (9) mschap : Creating challenge hash with username: ferrao # (9) mschap : EXPAND --challenge=%{%{mschap:Challenge}:-00} # (9) mschap : --> --challenge=082e8ba7b848aaae # (9) mschap : EXPAND --nt-response=%{%{mschap:NT-Response}:-00} # (9) mschap : --> # --nt-response=27b40a6d1dba1b4acfd33aff5c710a43e70d050269087bf1 (9) # ERROR: mschap : Program returned code (1) and output 'Reading winbind # reply failed! (0xc0000001)' (9) mschap : External script failed. # (9) ERROR: mschap : External script says: Reading winbind reply failed! # (0xc0000001) (9) ERROR: mschap : MS-CHAP2-Response is incorrect # (9) [mschap] = reject # (9) } # Auth-Type MS-CHAP = reject # (9) eap : Freeing handler # (9) [eap] = reject # (9) } # authenticate = reject # (9) Failed to authenticate the user. # (9) Login incorrect (mschap: Program returned code (1) and output # 'Reading winbind reply failed! (0xc0000001)'): [ferrao/<via Auth-Type = # EAP>] (from client 192.168.0.0/26 port 0 via TLS tunnel)
So something is wrong with Winbind and FreeRADIUS, and I don't know what.
check the archives:
<http://lists.freeradius.org/pipermail/freeradius-users/2012- May/061047.html> -- .:.Sebastian Hagedorn - Weyertal 121 (Gebäude 133), Zimmer 2.02.:. .:.Regionales Rechenzentrum (RRZK).:. .:.Universität zu Köln / Cologne University - ✆ +49-221-470-89578.:.
Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238
participants (5)
-
A.L.M.Buxey＠lboro.ac.uk -
Arran Cudbard-Bell -
Sebastian Hagedorn -
Stefan Paetow -
Vinícius Ferrão