Problem with MSCHAP
Alan Buxey
A.L.M.Buxey at lboro.ac.uk
Fri Oct 8 15:53:50 CEST 2010
Hi,
> I'm new to freeradius, I'm working on setting it up to authenticate users to our wireless network. We want to use PEAP-MSCHAPv2 and authenticate against Active Directory. I'm using samba and ntlm_auth.
okay - a fairly standard setup for modern 802.1X
> Versions:freeradius2-2.1.7-7.el5 and samba3.0.33-3.29
okay - the right 'blend'..as it were
> I have the ntlm_auth part working in as far as I can put DEFAULT Auth-Type = ntlm_auth in users and then do
you dont need to set Auth-Type for the MSCHAPv2 stuff... you might need it if, for example, you wanted
to do MSCHAPv2 AND kerberos for different type of requests - even then, you only need to set kerberos
to be the Auth-Type as the EAP module is intelligent
> I then configure MS-CHAP, removing the DEFAULT Auth-Type from users and editing modules/mschap as follows
>
> ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-MYDOMAIN} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"
do you REALLY want to accept what the user puts in as the gospel truth? ie, I wouldnt be comfirtable
taking the user-supplied domain for the ntlm_auth - I'd set it manually (if it really was a local user!)
> Output from radius -X at the bottom of this message. The bit that looks relevant to me is
what you have posted is the 'replay' of a transaction - try starting the daemon up and launching
the request ASAP - ie so what we have is straight after the 'listen and ready' line - especially
as with your current ntlm_auth line I'd expect to see a deprecated warning
> [suffix] Looking up realm "mydomain.ox.ac.uk" for User-Name = "firstname.lastname at mydomain.ox.ac.uk"
> [suffix] No such realm "mydomain.ox.ac.uk"
>
> However I'm not sure I need to worry about that bit - at the moment this is just a single, stand alone RADIUS server so I'm not sure I need to worry about realms or do I?....
it'd still be best to define that realm, if using prefix, to be local eg in proxy.conf
realm mydomain.ox.ac.uk {
strip
}
alan
More information about the Freeradius-Users
mailing list