Problem with ntlm_auth between freeradius 3.0 and Samba 4 AD

Benjamin DUPALUT benjamin.dupalut at esiee.fr
Tue Jul 3 17:49:15 CEST 2018


Hello,

First of all, sorry for my english if there is some mistakes.

I'm trying to set up an authentication between a freeradius 3.0 server and
a Samba 4 AD using ntlm_auth.

I apply the configuration from
deployingradius.com/documents/configuration/active_directory.html but i got
an error when testing with the "radtest -t mschap  user passwd  127.0.0.1 0
testing123" command.

Here is the issue of the freeradius -X debug :

(11) Received Access-Request Id 115 from 127.0.0.1:60705 to 127.0.0.1:1812
length 143
(11)   User-Name = "dupalutb at esiee.fr"
(11)   NAS-IP-Address = 127.0.1.1
(11)   NAS-Port = 0
(11)   Message-Authenticator = 0xe7c32a18a131310841e6f149e528647b
(11)   MS-CHAP-Challenge = 0x9aa1c8732f3e45a9
(11)   MS-CHAP-Response =
0x0001000000000000000000000000000000000000000000000000c93d69617f9ccbf98d1b673b2d75a401034e14ac56100964
(11) # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/eduroam
(11)   authorize {
(11)     if (!(User-Name =~ /@/)){
(11)     if (!(User-Name =~ /@/)) -> FALSE
(11)     if (User-Name =~ /@$/){
(11)     if (User-Name =~ /@$/) -> FALSE
(11)     if (User-Name =~ /@.+?@/){
(11)     if (User-Name =~ /@.+?@/) -> FALSE
(11)     if (User-Name =~ /@.+?[^[:alnum:]\\.-]/){
(11)     if (User-Name =~ /@.+?[^[:alnum:]\\.-]/) -> FALSE
(11)     if (User-Name =~ /@[\\.-]/){
(11)     if (User-Name =~ /@[\\.-]/) -> FALSE
(11)     if (User-Name =~ /@.+?[\\.-]$/){
(11)     if (User-Name =~ /@.+?[\\.-]$/) -> FALSE
(11)     if (User-Name =~ /@[^\\.]+$/){
(11)     if (User-Name =~ /@[^\\.]+$/) -> FALSE
(11)     if (User-Name =~ /@.+?\\.\\./){
(11)     if (User-Name =~ /@.+?\\.\\./) -> FALSE
(11)     if (User-Name =~ /@myabc\\.com$/i){
(11)     if (User-Name =~ /@myabc\\.com$/i) -> FALSE
(11)     if (User-Name =~
/@wlan\\.[[:alnum:]]+\\.[[:alnum:]]+\\.3gppnetwork\\.org$/i){
(11)     if (User-Name =~
/@wlan\\.[[:alnum:]]+\\.[[:alnum:]]+\\.3gppnetwork\\.org$/i) -> FALSE
(11)     if (User-Name =~ /@gmail\\.co(m|\\.[[:alnum:]][[:alnum:]])$/i){
(11)     if (User-Name =~ /@gmail\\.co(m|\\.[[:alnum:]][[:alnum:]])$/i) ->
FALSE
(11)     if (User-Name =~ /@yahoo\\.co(m|\\.[[:alnum:]][[:alnum:]])$/i){
(11)     if (User-Name =~ /@yahoo\\.co(m|\\.[[:alnum:]][[:alnum:]])$/i) ->
FALSE
(11)     if (User-Name =~ /@hotmail\\.co(m|\\.[[:alnum:]][[:alnum:]])$/i){
(11)     if (User-Name =~ /@hotmail\\.co(m|\\.[[:alnum:]][[:alnum:]])$/i)
-> FALSE
(11)     if (User-Name =~ /@\\.?ac\\.uk$/i){
(11)     if (User-Name =~ /@\\.?ac\\.uk$/i) -> FALSE
(11)     if (User-Name =~ /@.+?\\.ax\\.uk$/i){
(11)     if (User-Name =~ /@.+?\\.ax\\.uk$/i) -> FALSE
(11)     [preprocess] = ok
(11) auth_log: EXPAND
/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(11) auth_log:    --> /var/log/freeradius/radacct/
127.0.0.1/auth-detail-20180703
(11) auth_log:
/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
expands to /var/log/freeradius/radacct/127.0.0.1/auth-detail-20180703
(11) auth_log: EXPAND %t
(11) auth_log:    --> Tue Jul  3 17:36:31 2018
(11)     [auth_log] = ok
(11)     policy operator-name.authorize {
(11)       if ("%{client:Operator-Name}") {
(11)       EXPAND %{client:Operator-Name}
(11)          -->
(11)       if ("%{client:Operator-Name}")  -> FALSE
(11)     } # policy operator-name.authorize = ok
(11)     policy cui.authorize {
(11)       if ("%{client:add_cui}" == 'yes') {
(11)       EXPAND %{client:add_cui}
(11)          -->
(11)       if ("%{client:add_cui}" == 'yes')  -> FALSE
(11)     } # policy cui.authorize = ok
(11)     [chap] = noop
(11) mschap: Found MS-CHAP attributes.  Setting 'Auth-Type  = mschap'
(11)     [mschap] = ok
(11)     [digest] = noop
(11) suffix: Checking for suffix after "@"
(11) suffix: Looking up realm "esiee.fr" for User-Name = "dupalutb at esiee.fr"
(11) suffix: Found realm "esiee.fr"
(11) suffix: Adding Stripped-User-Name = "dupalutb"
(11) suffix: Adding Realm = "esiee.fr"
(11) suffix: Authentication realm is LOCAL
(11)     [suffix] = ok
(11) eap: No EAP-Message, not doing EAP
(11)     [eap] = noop
(11) files: users: Matched entry DEFAULT at line 1
(11)     [files] = ok
(11)     [expiration] = noop
(11)     [logintime] = noop
(11) pap: WARNING: No "known good" password found for the user.  Not
setting Auth-Type
(11) pap: WARNING: Authentication will fail unless a "known good" password
is available
(11)     [pap] = noop
(11)   } # authorize = ok
(11) Found Auth-Type = mschap
(11) # Executing group from file /etc/freeradius/3.0/sites-enabled/eduroam
(11)   authenticate {
(11) mschap: WARNING: No Cleartext-Password configured.  Cannot create
NT-Password
(11) mschap: WARNING: No Cleartext-Password configured.  Cannot create
LM-Password
(11) mschap: Client is using MS-CHAPv1 with NT-Password
(11) mschap: ERROR: FAILED: No NT/LM-Password.  Cannot perform
authentication
(11) mschap: ERROR: MS-CHAP2-Response is incorrect
(11)     [mschap] = reject
(11)   } # authenticate = reject
(11) Failed to authenticate the user
(11) Using Post-Auth-Type Reject
(11) # Executing group from file /etc/freeradius/3.0/sites-enabled/eduroam
(11)   Post-Auth-Type REJECT {
(11) attr_filter.access_reject: EXPAND %{User-Name}
(11) attr_filter.access_reject:    --> dupalutb at esiee.fr
(11) attr_filter.access_reject: Matched entry DEFAULT at line 11
(11)     [attr_filter.access_reject] = updated
(11)     [eap] = noop
(11)     policy remove_reply_message_if_eap {
(11)       if (&reply:EAP-Message && &reply:Reply-Message) {
(11)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
(11)       else {
(11)         [noop] = noop
(11)       } # else = noop
(11)     } # policy remove_reply_message_if_eap = noop
(11)   } # Post-Auth-Type REJECT = updated
(11) Delaying response for 1.000000 seconds
Waking up in 0.3 seconds.
Waking up in 0.6 seconds.
(11) Sending delayed response
(11) Sent Access-Reject Id 115 from 127.0.0.1:1812 to 127.0.0.1:60705
length 61
(11)   MS-CHAP-Error = "\000E=691 R=1 C=32c072eb4937c259 V=2"
Waking up in 3.9 seconds.
(11) Cleaning up request packet ID 115 with timestamp +545

It seems that radius try to use mschap authentication method instead of
ntlm_auth. Where did i make a mistake ?

Thanks in advance for your suggestions.

Regards​
,

*Benjamin Dupalut*
Administrateur système et réseau
Service des Moyens Informatiques Généraux (SMIG)
ESIEE Paris
2 bd Blaise Pascal - 93162 Noisy-le-Grand Cedex
T : +33 1 45 92 66 17
benjamin.dupalut at esiee.fr
www.esiee.fr / www.cci-paris-idf.fr


More information about the Freeradius-Users mailing list