Debian 9 - Samba 4.5.12 - Freeradius 3.02 ntlm_auth not working
Kasandra Padisha
kasandrapadisha at aol.com
Wed Jan 31 00:06:34 CET 2018
Hi
I have tried everything possible. I have read every publication
available and I am about to give up !!! I could not make it work:
Radius using ntlm_auth to autenthicate.
Details ..: a bit long . apologies :-)
--------------------------------- SAMBA ---------------------------------
I have samba 4.5.12 working OK
------------------- smb.conf
# Global parameters
[global]
netbios name = GALAPA
realm = MINUT.EDU.CO
workgroup = MINUT-EXT
dns forwarder = 192.168.32.1
server role = active directory domain controller
# Autenticaion sin dominio
winbind use default domain = no
[netlogon]
path = /var/lib/samba/sysvol/minut.edu.co/scripts
read only = No
[sysvol]
path = /var/lib/samba/sysvol
read only = No
-------------------
All tests of samba working OK
-------------------
#>> smbclient -L localhost -U%
Domain=[MINUT-EXT] OS=[Windows 6.1] Server=[Samba 4.5.12-Debian]
Sharename Type Comment
--------- ---- -------
netlogon Disk
sysvol Disk
IPC$ IPC IPC Service (Samba 4.5.12-Debian)
Domain=[MINUT-EXT] OS=[Windows 6.1] Server=[Samba 4.5.12-Debian
Server Comment
--------- -------
Workgroup Master
--------- -------
WORKGROUP GALAPA
-------------------
#>> root at galapa:/etc/freeradius/3.0# smbclient //localhost/netlogon
-Uskina%'Nio4LasOo' -c 'ls'
Domain=[MINUT-EXT] OS=[Windows 6.1] Server=[Samba 4.5.12-Debian]
. D 0 Tue Jan 30 11:11:29 2018
.. D 0 Tue Jan 30 11:11:48 2018
65799648 blocks of size 1024. 61762632 blocks available
#>> ntlm_auth --request-nt-key --domain=MINUT-EXT --username=skina
--password='Nio4LasOo'
NT_STATUS_OK: Success (0x0)
#>> wbinfo --ntlmv2 -a 'skina'%'Nio4LasOo'
plaintext password authentication succeeded
challenge/response password authentication succeeded
# wbinfo -a 'skina'%'Nio4LasOo'
plaintext password authentication succeeded
challenge/response password authentication failed
wbcAuthenticateUserEx(MINUT-EXT\skina): error code was
NT_STATUS_WRONG_PASSWORD (0xc000006a)
error message was: Wrong Password
Could not authenticate user skina with challenge/response
-------------------
**** This last message is my only clue.
--------------------------------- FREERADIUS
---------------------------------
I have installed y configured freeradius following every manual ..
First .. the basic configuration .. and working OK
http://wiki.freeradius.org/guide/Basic-configuration-HOWTO
-------------------
#>> radtest bob hello localhost 0 testing123
Sent Access-Request Id 70 from 0.0.0.0:37544 to 127.0.0.1:1812 length 73
User-Name = "bob"
User-Password = "hello"
NAS-IP-Address = 127.0.1.1
NAS-Port = 0
Message-Authenticator = 0x00
Cleartext-Password = "hello"
Received Access-Accept Id 70 from 127.0.0.1:1812 to 0.0.0.0:0 length 20
Reply-Message = "Hello, bob"
-------------------
Second .. configure OK freeradius with ntlm_auth and PAP
http://wiki.freeradius.org/guide/NTLM%20Auth%20with%20PAP%20HOWTO
-------------------
#>> radtest 'skina' 'Nio4LasOo' localhost 0 testing123
Sent Access-Request Id 14 from 0.0.0.0:34004 to 127.0.0.1:1812 length 75
User-Name = "skina"
User-Password = "Nio4Las2Oo"
NAS-IP-Address = 127.0.1.1
NAS-Port = 0
Message-Authenticator = 0x00
Cleartext-Password = "Nio4LasOo"
Received Access-Accept Id 14 from 127.0.0.1:1812 to 0.0.0.0:0 length 20
-------------------
Third .. tryied to configure freeradius ntlm_auth and MSCHAP
http://deployingradius.com/documents/configuration/active_directory.html
I have already set all the permissions to user freerad to
winbindd_private directory so that not the issue.
It does not matter what I do .. I always get the same error ..
-------------------
#>> radtest -t mschap 'skina' 'Nio4LasOo' localhost 0 testing123
Sent Access-Request Id 158 from 0.0.0.0:33353 to 127.0.0.1:1812 length 131
User-Name = "skina"
MS-CHAP-Password = "Nio4LasOo"
NAS-IP-Address = 127.0.1.1
NAS-Port = 0
Message-Authenticator = 0x00
Cleartext-Password = "Nio4LasOo"
MS-CHAP-Challenge = 0x59e2a1e585ad94e6
MS-CHAP-Response =
0x00010000000000000000000000000000000000000000000000001eacb1bfed243034f718b74d89b6b11b84af50869ab40b06
Received Access-Reject Id 158 from 127.0.0.1:1812 to 0.0.0.0:0 length 61
MS-CHAP-Error = "\000E=691 R=1 C=c3f65e6f825239e4 V=2"
(0) -: Expected Access-Accept got Access-Reject
-------------------
And the output of "freeradius -X"
-------------------
(2) Received Access-Request Id 57 from 127.0.0.1:34102 to 127.0.0.1:1812
length 131
(2) User-Name = "skina"
(2) NAS-IP-Address = 127.0.1.1
(2) NAS-Port = 0
(2) Message-Authenticator = 0xe88750a3ffc2bc75b90b872caf81f7e5
(2) MS-CHAP-Challenge = 0x1fa8d5c8e307ea3f
(2) MS-CHAP-Response =
0x000100000000000000000000000000000000000000000000000074102cb712031d37dcb5bda4745b7e918794c4168fa1e5f5
(2) # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/default
(2) authorize {
(2) policy ntlm_auth.authorize {
(2) if (!control:Auth-Type && User-Password) {
(2) if (!control:Auth-Type && User-Password) -> FALSE
(2) } # policy ntlm_auth.authorize = notfound
(2) policy filter_username {
(2) if (&User-Name) {
(2) if (&User-Name) -> TRUE
(2) if (&User-Name) {
(2) if (&User-Name =~ / /) {
(2) if (&User-Name =~ / /) -> FALSE
(2) if (&User-Name =~ /@[^@]*@/ ) {
(2) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(2) if (&User-Name =~ /\.\./ ) {
(2) if (&User-Name =~ /\.\./ ) -> FALSE
(2) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(2) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))
-> FALSE
(2) if (&User-Name =~ /\.$/) {
(2) if (&User-Name =~ /\.$/) -> FALSE
(2) if (&User-Name =~ /@\./) {
(2) if (&User-Name =~ /@\./) -> FALSE
(2) } # if (&User-Name) = notfound
(2) } # policy filter_username = notfound
(2) [preprocess] = ok
(2) [chap] = noop
(2) mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap'
(2) [mschap] = ok
(2) [digest] = noop
(2) suffix: Checking for suffix after "@"
(2) suffix: No '@' in User-Name = "skina", looking up realm NULL
(2) suffix: No such realm "NULL"
(2) [suffix] = noop
(2) eap: No EAP-Message, not doing EAP
(2) [eap] = noop
(2) [files] = noop
(2) [sql] = notfound
(2) [expiration] = noop
(2) [logintime] = noop
(2) } # authorize = ok
(2) Found Auth-Type = mschap
(2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(2) authenticate {
(2) mschap: Client is using MS-CHAPv1 with NT-Password
(2) mschap: Executing: /usr/bin/ntlm_auth --allow-mschapv2 --ntlmv2
--request-nt-key --username=%{mschap:User-Name:-None} --domain=MINUT-EXT
--challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}:
(2) mschap: EXPAND --username=%{mschap:User-Name:-None}
(2) mschap: --> --username=skina
(2) mschap: mschap1: 1f
(2) mschap: EXPAND --challenge=%{mschap:Challenge:-00}
(2) mschap: --> --challenge=1fa8d5c8e307ea3f
(2) mschap: EXPAND --nt-response=%{mschap:NT-Response:-00}
(2) mschap: -->
--nt-response=74102cb712031d37dcb5bda4745b7e918794c4168fa1e5f5
(2) mschap: ERROR: Program returned code (1) and output 'Logon failure
(0xc000006d)'
(2) mschap: External script failed
(2) mschap: ERROR: External script says: Logon failure (0xc000006d)
(2) mschap: ERROR: MS-CHAP2-Response is incorrect
(2) [mschap] = reject
(2) } # authenticate = reject
(2) Failed to authenticate the user
(2) Using Post-Auth-Type Reject
(2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(2) Post-Auth-Type REJECT {
(2) [sql] = ok
(2) attr_filter.access_reject: EXPAND %{User-Name}
(2) attr_filter.access_reject: --> skina
(2) attr_filter.access_reject: Matched entry DEFAULT at line 11
(2) [attr_filter.access_reject] = updated
(2) [eap] = noop
(2) policy remove_reply_message_if_eap {
(2) if (&reply:EAP-Message && &reply:Reply-Message) {
(2) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE
(2) else {
(2) [noop] = noop
(2) } # else = noop
(2) } # policy remove_reply_message_if_eap = noop
(2) } # Post-Auth-Type REJECT = updated
(2) Delaying response for 1.000000 seconds
Waking up in 0.2 seconds.
Waking up in 0.7 seconds.
(2) Sending delayed response
(2) Sent Access-Reject Id 57 from 127.0.0.1:1812 to 127.0.0.1:34102
length 61
(2) MS-CHAP-Error = "\000E=691 R=1 C=be58a2cfd7660c37 V=2"
Waking up in 3.9 seconds.
(2) Cleaning up request packet ID 57 with timestamp +161
Ready to process requests
-------------------
This is the same error when I used wbinfo without --ntlmv2 ... ( might
be a clue)
In mods_enabled/mschap I have tried many parameters in ntlm_auth command
.. including hardcoding a known user ..
ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=MINUT-EXT
--username=skina --password='Nio4LasOo'"
It returned NT OK . .. but when I added the other to parameters .. i
came back to the same error.
--challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"
-----------
I was wondering if it is a kind of incompatibility concerning the
version of MSCHAP or NTLM ..
I appreciate any help you can give me. I have four days trying every
option, reading every post, .. without success.
Kasandra
More information about the Freeradius-Users
mailing list