ntlm_auth works but not radtest

[Scott McLane Gardner]

I'm attempting to follow the guide at http://deployingradius.com/ Things
were going very well until I tried to set up Active Directory
authentication. Testing with ntlm_auth, I get a success:

$ ntlm_auth --request-nt-key --domain=MYDOMAIN --username=myuname
--password=mypass
NT_STATUS_OK: Success (0x0)


But when I test with radtest it fails. I'm not sure I understand all of
the debug output, but I thnk maybe it has to do with it thinking the realm
is NULL. I have set it up in both smb.conf and krb5.conf as well as in the
mschap module of freeradius. I am using freeradius version 2.1.10 on
Ubuntu 11.10. Here's the output from the command line as well as the debug
output:

$ radtest -t mschap myuname mypass localhost 0 testing123
Sending Access-Request of id 99 to 127.0.0.1 port 1812
	User-Name = "myuname"
	NAS-IP-Address = <mynasip>
	NAS-Port = 0
	MS-CHAP-Challenge = 0xb89b59d41385c67c
	MS-CHAP-Response =
0x00010000000000000000000000000000000000000000000000003edd0cff110926a15d402
f5204078f2d78d908e773c3a9c6
rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=99,
length=20







rad_recv: Access-Request packet from host 127.0.0.1 port 42379, id=209,
length=115
	User-Name = "myuname"
	NAS-IP-Address = <mynasip>
	NAS-Port = 0
	MS-CHAP-Challenge = 0x09d5dfb63fba5357
	MS-CHAP-Response =
0x00010000000000000000000000000000000000000000000000000704b6897326b27adb243
658c300fcd922f008014ee7e25b
Mon Mar  5 14:45:54 2012 : Info: # Executing section authorize from file
/etc/freeradius/sites-enabled/default
Mon Mar  5 14:45:54 2012 : Info: +- entering group authorize {...}
Mon Mar  5 14:45:54 2012 : Info: ++[preprocess] returns ok
Mon Mar  5 14:45:54 2012 : Info: ++[chap] returns noop
Mon Mar  5 14:45:54 2012 : Info: [mschap] Found MS-CHAP attributes.
Setting 'Auth-Type  = mschap'
Mon Mar  5 14:45:54 2012 : Info: ++[mschap] returns ok
Mon Mar  5 14:45:54 2012 : Info: ++[digest] returns noop
Mon Mar  5 14:45:54 2012 : Info: [suffix] No '@' in User-Name = "myuname",
looking up realm NULL
Mon Mar  5 14:45:54 2012 : Info: [suffix] No such realm "NULL"
Mon Mar  5 14:45:54 2012 : Info: ++[suffix] returns noop
Mon Mar  5 14:45:54 2012 : Info: [eap] No EAP-Message, not doing EAP
Mon Mar  5 14:45:54 2012 : Info: ++[eap] returns noop
Mon Mar  5 14:45:54 2012 : Info: ++[files] returns noop
Mon Mar  5 14:45:54 2012 : Info: ++[expiration] returns noop
Mon Mar  5 14:45:54 2012 : Info: ++[logintime] returns noop
Mon Mar  5 14:45:54 2012 : Info: [pap] WARNING! No "known good" password
found for the user.  Authentication may fail because of this.
Mon Mar  5 14:45:54 2012 : Info: ++[pap] returns noop
Mon Mar  5 14:45:54 2012 : Info: Found Auth-Type = MSCHAP
Mon Mar  5 14:45:54 2012 : Info: # Executing group from file
/etc/freeradius/sites-enabled/default
Mon Mar  5 14:45:54 2012 : Info: +- entering group MS-CHAP {...}
Mon Mar  5 14:45:54 2012 : Info: [mschap] Told to do MS-CHAPv1 with
NT-Password
Mon Mar  5 14:45:54 2012 : Info: [mschap] 	expand: %{Stripped-User-Name}
-> 
Mon Mar  5 14:45:54 2012 : Info: [mschap] 	... expanding second conditional
Mon Mar  5 14:45:54 2012 : Info: [mschap] WARNING: Deprecated conditional
expansion ":-".  See "man unlang" for details
Mon Mar  5 14:45:54 2012 : Info: [mschap] 	expand: %{User-Name:-None} ->
myuname
Mon Mar  5 14:45:54 2012 : Info: [mschap] 	expand:
--username=%{%{Stripped-User-Name}:-%{User-Name:-None}} ->
--username=myuname
Mon Mar  5 14:45:54 2012 : Info: [mschap] No NT-Domain was found in the
User-Name.
Mon Mar  5 14:45:54 2012 : Info: [mschap] 	expand: %{mschap:NT-DOMAIN} ->
Mon Mar  5 14:45:54 2012 : Info: [mschap] 	... expanding second conditional
Mon Mar  5 14:45:54 2012 : Info: [mschap] 	expand:
--domain=%{%{mschap:NT-DOMAIN}:-MYDOMAIN} -> --domain=MYDOMAIN
Mon Mar  5 14:45:54 2012 : Info: [mschap]  mschap1: 09
Mon Mar  5 14:45:54 2012 : Info: [mschap] 	expand:
--challenge=%{mschap:Challenge:-00} -> --challenge=09d5dfb63fba5357
Mon Mar  5 14:45:54 2012 : Info: [mschap] 	expand:
--nt-response=%{mschap:NT-Response:-00} ->
--nt-response=0704b6897326b27adb243658c300fcd922f008014ee7e25b
Mon Mar  5 14:45:55 2012 : Debug: Exec-Program output: winbind client not
authorized to use winbindd_pam_auth_crap. Ensure permissions on
/var/run/samba/winbindd_privileged are set correctly. (0xc0000022)
Mon Mar  5 14:45:55 2012 : Debug: Exec-Program-Wait: plaintext: winbind
client not authorized to use winbindd_pam_auth_crap. Ensure permissions on
/var/run/samba/winbindd_privileged are set correctly. (0xc0000022)
Mon Mar  5 14:45:55 2012 : Debug: Exec-Program: returned: 1
Mon Mar  5 14:45:55 2012 : Info: [mschap] External script failed.
Mon Mar  5 14:45:55 2012 : Info: [mschap] MS-CHAP-Response is incorrect.
Mon Mar  5 14:45:55 2012 : Info: ++[mschap] returns reject
Mon Mar  5 14:45:55 2012 : Info: Failed to authenticate the user.
Mon Mar  5 14:45:55 2012 : Info: Using Post-Auth-Type Reject
Mon Mar  5 14:45:55 2012 : Info: # Executing group from file
/etc/freeradius/sites-enabled/default
Mon Mar  5 14:45:55 2012 : Info: +- entering group REJECT {...}
Mon Mar  5 14:45:55 2012 : Info: [attr_filter.access_reject] 	expand:
%{User-Name} -> myuname
Mon Mar  5 14:45:55 2012 : Debug:  attr_filter: Matched entry DEFAULT at
line 11
Mon Mar  5 14:45:55 2012 : Info: ++[attr_filter.access_reject] returns
updated
Mon Mar  5 14:45:55 2012 : Info: Delaying reject of request 0 for 1 seconds
Mon Mar  5 14:45:55 2012 : Debug: Going to the next request
Mon Mar  5 14:45:55 2012 : Debug: Waking up in 0.9 seconds.
Mon Mar  5 14:45:55 2012 : Info: Sending delayed reject for request 0
Sending Access-Reject of id 209 to 127.0.0.1 port 42379
Mon Mar  5 14:45:55 2012 : Debug: Waking up in 4.9 seconds.
Mon Mar  5 14:46:01 2012 : Info: Cleaning up request 0 ID 209 with
timestamp +10
Mon Mar  5 14:46:01 2012 : Info: Ready to process requests.