ntlm_auth w/ plain test passwords to Windows 2003 domain

Ken George Ken.George at mi-services.com
Thu Jul 14 17:30:21 CEST 2005


Still unable to get this to work via freeradius, but works with
ntlm_auth from the command line.

 

 

[root at phllnxsrv01 raddb]# ntlm_auth --username="test ops"
--password=m1sg0ps --domain=usmisgnet --request-NT-key

NT_STATUS_OK: Success (0x0)

 

BUT

 

wbinfo -a "ken george"%262144                         plaintext password
authentication failed

error code was NT_STATUS_NO_SUCH_USER (0xc0000064)

error messsage was: No such user

Could not authenticate user ken george%262144 with plaintext password

challenge/response password authentication succeeded

 

 

Is this a samba/winbindd/Windows 2003 issue or is my freeradius
configuration still lacking??

 

radiusd.conf

 

exec win_domain {

             wait = yes

             input_pairs = request

             output_pairs = reply

             program = "/usr/bin/ntlm_auth --username=\"%{User-Name}\"
--password=\"%{User-Password}\" --domain=usmisgnet"

        }

        

.

.

.

#

        Auth-Type win_domain {

        win_domain

        }

#

 

In the users file

 

#

DEFAULT   Auth-Type = win_domain

 

#

 

radtest "test ops" m1sg0ps localhost 0 xxxxxx

 

[root at phllnxsrv01 raddb]# radiusd -xxyz -l stdout

Starting - reading configuration files ...

reread_config:  reading radiusd.conf

Config:   including file: /etc/raddb/proxy.conf

Config:   including file: /etc/raddb/clients.conf

Config:   including file: /etc/raddb/snmp.conf

Config:   including file: /etc/raddb/eap.conf

Config:   including file: /etc/raddb/sql.conf

 main: prefix = "/usr"

 main: localstatedir = "/var"

 main: logdir = "/var/log/radius"

 main: libdir = "/usr/lib"

 main: radacctdir = "/var/log/radius/radacct"

 main: hostname_lookups = no

 main: max_request_time = 30

 main: cleanup_delay = 5

 main: max_requests = 1024

 main: delete_blocked_requests = 0

 main: port = 0

 main: allow_core_dumps = no

 main: log_stripped_names = no

 main: log_file = "/var/log/radius/radius.log"

 main: log_auth = yes

 main: log_auth_badpass = no

 main: log_auth_goodpass = no

 main: pidfile = "/var/run/radiusd/radiusd.pid"

 main: user = "radiusd"

 main: group = "radiusd"

 main: usercollide = no

 main: lower_user = "before"

 main: lower_pass = "no"

 main: nospace_user = "no"

 main: nospace_pass = "no"

 main: checkrad = "/usr/sbin/checkrad"

 main: proxy_requests = yes

 proxy: retry_delay = 5

 proxy: retry_count = 3

 proxy: synchronous = no

 proxy: default_fallback = yes

 proxy: dead_time = 120

 proxy: post_proxy_authorize = yes

 proxy: wake_all_if_all_dead = no

 security: max_attributes = 200

 security: reject_delay = 1

 security: status_server = no

 main: debug_level = 0

read_config_files:  reading dictionary

read_config_files:  reading naslist

Using deprecated naslist file.  Support for this will go away soon.

read_config_files:  reading clients

read_config_files:  reading realms

radiusd:  entering modules setup

Module: Library search path is /usr/lib

Module: Loaded exec

 exec: wait = yes

 exec: program = "(null)"

 exec: input_pairs = "request"

 exec: output_pairs = "(null)"

 exec: packet_type = "(null)"

rlm_exec: Wait=yes but no output defined. Did you mean output=none?

Module: Instantiated exec (exec)

Module: Loaded expr

Module: Instantiated expr (expr)

Module: Loaded PAP

 pap: encryption_scheme = "crypt"

Module: Instantiated pap (pap)

Module: Loaded CHAP

Module: Instantiated chap (chap)

Module: Loaded MS-CHAP

 mschap: use_mppe = yes

 mschap: require_encryption = yes

 mschap: require_strong = yes

 mschap: with_ntdomain_hack = no

 mschap: passwd = "(null)"

 mschap: authtype = "MS-CHAP"

 mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key
--username=%{Stripped-User-Name:-%{User-Name:-None}}
--domain=%{mschap:NT-Domain} --challenge=%{mschap:Challenge:-00}
--nt-response=%{mschap:NT-Response:-00}"

Module: Instantiated mschap (mschap)

 exec: wait = yes

 exec: program = "/usr/bin/ntlm_auth --username="%{User-Name}"
--password="%{User-Password}" --domain=usmisgnet"

 exec: input_pairs = "request"

 exec: output_pairs = "reply"

 exec: packet_type = "(null)"

Module: Instantiated exec (win_domain)

Module: Loaded System

 unix: cache = no

 unix: passwd = "(null)"

 unix: shadow = "/etc/shadow"

 unix: group = "(null)"

 unix: radwtmp = "/var/log/radius/radwtmp"

 unix: usegroup = no

 unix: cache_reload = 600

Module: Instantiated unix (unix)

Module: Loaded eap

 eap: default_eap_type = "md5"

 eap: timer_expire = 60

 eap: ignore_unknown_eap_types = no

 eap: cisco_accounting_username_bug = no

rlm_eap: Loaded and initialized type md5

rlm_eap: Loaded and initialized type leap

 gtc: challenge = "Password: "

 gtc: auth_type = "PAP"

rlm_eap: Loaded and initialized type gtc

 mschapv2: with_ntdomain_hack = no

rlm_eap: Loaded and initialized type mschapv2

Module: Instantiated eap (eap)

Module: Loaded preprocess

 preprocess: huntgroups = "/etc/raddb/huntgroups"

 preprocess: hints = "/etc/raddb/hints"

 preprocess: with_ascend_hack = no

 preprocess: ascend_channels_per_line = 23

 preprocess: with_ntdomain_hack = yes

 preprocess: with_specialix_jetstream_hack = no

 preprocess: with_cisco_vsa_hack = yes

Module: Instantiated preprocess (preprocess)

Module: Loaded realm

 realm: format = "suffix"

 realm: delimiter = "@"

 realm: ignore_default = no

 realm: ignore_null = no

Module: Instantiated realm (suffix)

 realm: format = "prefix"

 realm: delimiter = "\"

 realm: ignore_default = no

 realm: ignore_null = no

Module: Instantiated realm (ntdomain)

Module: Loaded files

 files: usersfile = "/etc/raddb/users"

 files: acctusersfile = "/etc/raddb/acct_users"

 files: preproxy_usersfile = "/etc/raddb/preproxy_users"

 files: compat = "no"

Module: Instantiated files (files)

Module: Loaded Acct-Unique-Session-Id

 acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address,
Client-IP-Address, NAS-Port"

Module: Instantiated acct_unique (acct_unique)

Module: Loaded detail

 detail: detailfile =
"/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d"

 detail: detailperm = 384

 detail: dirperm = 493

 detail: locking = no

Module: Instantiated detail (detail)

Module: Loaded radutmp

 radutmp: filename = "/var/log/radius/radutmp"

 radutmp: username = "%{User-Name}"

 radutmp: case_sensitive = yes

 radutmp: check_with_nas = yes

 radutmp: perm = 384

 radutmp: callerid = yes

Module: Instantiated radutmp (radutmp)

Initializing the thread pool...

 thread: start_servers = 5

 thread: max_servers = 32

 thread: min_spare_servers = 3

 thread: max_spare_servers = 10

 thread: max_requests_per_server = 0

 thread: cleanup_delay = 5

Thread 1 waiting to be assigned a request

Thread spawned new child 1. Total threads in pool: 1

Thread 2 waiting to be assigned a request

Thread spawned new child 2. Total threads in pool: 2

Thread 3 waiting to be assigned a request

Thread spawned new child 3. Total threads in pool: 3

Thread 4 waiting to be assigned a request

Thread spawned new child 4. Total threads in pool: 4

Thread 5 waiting to be assigned a request

Thread spawned new child 5. Total threads in pool: 5

Thread pool initialized

Listening on authentication *:1812

Listening on accounting *:1813

Listening on proxy *:1814

Ready to process requests.

rad_recv: Access-Request packet from host 127.0.0.1:32785, id=139,
length=60

--- Walking the entire request list ---

Waking up in 31 seconds...

Threads: total/active/spare threads = 5/0/5

Thread 1 got semaphore

Thread 1 handling request 0, (1 handled so far)

        User-Name = "test ops"

        User-Password = "xxxxxx"

        NAS-IP-Address = 255.255.255.255

        NAS-Port = 0

rad_lowerpair:  User-Name now 'test ops'

  Processing the authorize section of radiusd.conf

modcall: entering group authorize for request 0

  modcall[authorize]: module "preprocess" returns ok for request 0

  modcall[authorize]: module "chap" returns noop for request 0

  modcall[authorize]: module "mschap" returns noop for request 0

    rlm_realm: No '@' in User-Name = "test ops", looking up realm NULL

    rlm_realm: No such realm "NULL"

  modcall[authorize]: module "suffix" returns noop for request 0

    rlm_realm: No '\' in User-Name = "test ops", looking up realm NULL

    rlm_realm: No such realm "NULL"

  modcall[authorize]: module "ntdomain" returns noop for request 0

  rlm_eap: No EAP-Message, not doing EAP

  modcall[authorize]: module "eap" returns noop for request 0

    users: Matched DEFAULT at 204

  modcall[authorize]: module "files" returns ok for request 0

modcall: group authorize returns ok for request 0

  rad_check_password:  Found Auth-Type win_domain

auth: type "win_domain"

  Processing the authenticate section of radiusd.conf

modcall: entering group Auth-Type for request 0

radius_xlat:  '/usr/bin/ntlm_auth --username="test ops"
--password="xxxxxx" --domain=usmisgnet'

Exec-Program: /usr/bin/ntlm_auth --username="test ops"
--password="xxxxxx" --domain=usmisgnet

Exec-Program output: NT_STATUS_NO_SUCH_USER: No such user (0xc0000064)

Exec-Program-Wait: plaintext: NT_STATUS_NO_SUCH_USER: No such user
(0xc0000064)

Exec-Program: returned: 1

rlm_exec (win_domain): External script failed

  modcall[authenticate]: module "win_domain" returns fail for request 0

modcall: group Auth-Type returns fail for request 0

auth: Failed to validate the user.

Login incorrect: [test ops] (from client localhost port 0)

Delaying request 0 for 1 seconds

Finished request 0

Going to the next request

Thread 1 waiting to be assigned a request

rad_recv: Access-Request packet from host 127.0.0.1:32785, id=139,
length=60

Sending Access-Reject of id 139 to 127.0.0.1:32785

--- Walking the entire request list ---

Waking up in 3 seconds...

--- Walking the entire request list ---

Cleaning up request 0 ID 139 with timestamp 42d682b2

Nothing to do.  Sleeping until we see a request.

 

Ken George

Systems and Network Engineering

Mi Services Group, Inc.    

+1 610-230-2500 x129  

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20050714/55973db8/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.gif
Type: image/gif
Size: 884 bytes
Desc: image001.gif
URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20050714/55973db8/attachment.gif>


More information about the Freeradius-Users mailing list