problems getting ntlm_auth working.
L.P.H. van Belle
belle at bazuin.nl
Thu Aug 29 15:00:33 CEST 2019
Hai,
Im new here, so please be nice if i missed a thing.
Im having problem to get my ntlm_auth working with freeradius.
My Setup:
Debian Buster
Samba 4.10.7 ( running winbind only )
My winbind auth works fine, server is domain joined.
Squid is also configured on this server which also uses winbind and kerberos for authentication.
SSH uses kerberos authentication, and im using nfsv4 kerberizes automounted homedirs for the users.
This all works fine.
Now im adding freeradius.
So i hope with a little bit of help, someone can point to me what i did wrong.
Im following the site http://deployingradius.com
Steps 1-4 all done and all working.
Only i use my own certificates here.
This is the running samba config :
[global]
# Auth-Only setup with winbind. ( no Shares )
workgroup = NTDOM
security = ADS
realm = MY.REALM.TLD
netbios name = HOSTNAME
preferred master = no
domain master = no
host msdfs = no
dns proxy = yes
interfaces = eth0 lo
bind interfaces only = yes
log level = 1
#Add and Update TLS Key
tls enabled = yes
tls keyfile = /etc/ssl/private/my.key.pem
tls certfile = /etc/ssl/certs/my.cert.pem
tls cafile = /etc/ssl/certs/my-ca.cert.pem
## map id's outside to domain to tdb files.
idmap config *: backend = tdb
idmap config *: range = 2000-9999
## map ids from the domain and (*) the range may not overlap !
idmap config NTDOM : backend = ad
idmap config NTDOM : schema_mode = rfc2307
idmap config NTDOM : range = 10000-3999999
#4.6+ ( get primary group from AD )
idmap config NTDOM : unix_nss_info = yes
#4.6+ ( get primary group from unix primary group )
idmap config NTDOM : unix_primary_group = yes
kerberos method = secrets and keytab
dedicated keytab file = /etc/krb5.keytab
# renew the kerberos ticket
winbind refresh tickets = yes
# We strip the domain (NTDOM\username) to username
winbind use default domain = yes
# use: getent passwd username to check.
# enabled slows down you samba.
winbind enum users = no
winbind enum groups = no
# enable offline logins
# Not on a VPN server.
#winbind offline logon = no
# check depth of nested groups, ! slows down you samba, if to much groups depth
# Not needed on the VPN server.
#winbind expand groups = 4
# Added for freeradius
ntlm auth = mschapv2-and-ntlmv2-only
# user Administrator workaround, without it you are unable to set privileges
username map = /etc/samba/samba_usermapping
# disable usershares creating
usershare path =
# Disable printing completely
load printers = no
printing = bsd
printcap name = /dev/null
disable spoolss = yes
# For ACL support on member servers with shares
vfs objects = acl_xattr
map acl inherit = Yes
store dos attributes = Yes
######## SHARE DEFINITIONS ################
I've proceded to : http://deployingradius.com/documents/configuration/active_directory.html
I've edited : /etc/freeradius/3.0/users and tested it.
radtest user password localhost 0 testing123
This all works with : DEFAULT Auth-Type = ntlm_auth enabled.
Im now at : Configuring FreeRADIUS to use ntlm_auth for MS-CHAP
Now i remove DEFAULT Auth-Type = ntlm_auth from /etc/freeradius/3.0/users
I edited : /etc/freeradius/3.0/mods-available/mschap
As suggested on the site, but that did not work.
I used:
ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --allow-mschapv2 \
--username=%{mschap:User-Name:-None} \
--domain=%{%{mschap:NT-Domain}:-NTDOM} \
--challenge=%{mschap:Challenge:-00} \
--nt-response=%{mschap:NT-Response:-00}"
Tried with and without the --mschapv2 and/or the --domain=%{%{mschap:NT-Domain}:-NTDOM}.
That did not work when testing with :
radtest -t mschap bob hello localhost 0 testing123
Or with
radtest -t mschap username password localhost 0 testing123
Where this username and password is 10000000000% sure correct. ;-)
I also noticed these :
# winbind_username = "%{mschap:User-Name}"
# winbind_domain = "%{mschap:NT-Domain}"
# and i checked that lbwbclient is installed. libwbclient0:amd64 2:4.10.7-0.1~deb10
But also did not work.
Note,
# An alternative to using ntlm_auth is to connect to the
# winbind daemon directly for authentication. This option
# is likely to be faster and may be useful on busy systems,
# but is less well tested.
This is one i like but first i need the basic ntlm_auth working.
Or kerberos auth, i have not added the radius/SPN yet to the keytab file.
When i now run radtest username ... .. This is the output.
What im a doing wrong, or what did i miss.
radtest -t mschap username password localhost 0 testing123
Ready to process requests
(0) Received Access-Request Id 126 from 127.0.0.1:60982 to 127.0.0.1:1812 length 131
(0) User-Name = "username"
(0) NAS-IP-Address = 192.168.xxx.xxx
(0) NAS-Port = 10
(0) Message-Authenticator = 0x18e47fd9598eba89c40254557077f7ff
(0) MS-CHAP-Challenge = 0x08243010dec6eb38
(0) MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000e386418de8527edff1949800324f8f34d4716529e6176b1c
(0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default
(0) authorize {
(0) policy filter_username {
(0) if (&User-Name) {
(0) if (&User-Name) -> TRUE
(0) if (&User-Name) {
(0) if (&User-Name =~ / /) {
(0) if (&User-Name =~ / /) -> FALSE
(0) if (&User-Name =~ /@[^@]*@/ ) {
(0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(0) if (&User-Name =~ /\.\./ ) {
(0) if (&User-Name =~ /\.\./ ) -> FALSE
(0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE
(0) if (&User-Name =~ /\.$/) {
(0) if (&User-Name =~ /\.$/) -> FALSE
(0) if (&User-Name =~ /@\./) {
(0) if (&User-Name =~ /@\./) -> FALSE
(0) } # if (&User-Name) = notfound
(0) } # policy filter_username = notfound
(0) [preprocess] = ok
(0) [chap] = noop
(0) mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap'
(0) [mschap] = ok
(0) [digest] = noop
(0) suffix: Checking for suffix after "@"
(0) suffix: No '@' in User-Name = "username", looking up realm NULL
(0) suffix: No such realm "NULL"
(0) [suffix] = noop
(0) eap: No EAP-Message, not doing EAP
(0) [eap] = noop
(0) [files] = noop
(0) [expiration] = noop
(0) [logintime] = noop
(0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type
(0) pap: WARNING: Authentication will fail unless a "known good" password is available
(0) [pap] = noop
(0) } # authorize = ok
(0) Found Auth-Type = mschap
(0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(0) authenticate {
(0) mschap: Client is using MS-CHAPv1 with NT-Password
(0) mschap: Executing: /usr/bin/ntlm_auth --request-nt-key --allow-mschapv2 --username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-NTDOM} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}:
(0) mschap: EXPAND --username=%{mschap:User-Name:-None}
(0) mschap: --> --username=username
(0) mschap: ERROR: No NT-Domain was found in the User-Name
(0) mschap: EXPAND --domain=%{%{mschap:NT-Domain}:-NTDOM}
(0) mschap: --> --domain=NTDOM
(0) mschap: mschap1: 08
(0) mschap: EXPAND --challenge=%{mschap:Challenge:-00}
(0) mschap: --> --challenge=08243010dec6eb38
(0) mschap: EXPAND --nt-response=%{mschap:NT-Response:-00}
(0) mschap: --> --nt-response=e386418de8527edff1949800324f8f34d4716529e6176b1c
(0) mschap: ERROR: Program returned code (1) and output 'The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d)'
(0) mschap: External script failed
(0) mschap: ERROR: External script says: The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d)
(0) mschap: ERROR: MS-CHAP2-Response is incorrect
(0) [mschap] = reject
(0) } # authenticate = reject
(0) Failed to authenticate the user
(0) Using Post-Auth-Type Reject
(0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(0) Post-Auth-Type REJECT {
(0) attr_filter.access_reject: EXPAND %{User-Name}
(0) attr_filter.access_reject: --> username
(0) attr_filter.access_reject: Matched entry DEFAULT at line 11
(0) [attr_filter.access_reject] = updated
(0) [eap] = noop
(0) policy remove_reply_message_if_eap {
(0) if (&reply:EAP-Message && &reply:Reply-Message) {
(0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE
(0) else {
(0) [noop] = noop
(0) } # else = noop
(0) } # policy remove_reply_message_if_eap = noop
(0) } # Post-Auth-Type REJECT = updated
(0) Delaying response for 1.000000 seconds
Waking up in 0.2 seconds.
Waking up in 0.7 seconds.
(0) Sending delayed response
(0) Sent Access-Reject Id 126 from 127.0.0.1:1812 to 127.0.0.1:60982 length 61
(0) MS-CHAP-Error = "\000E=691 R=1 C=0b9be1dfc950ab3e V=2"
Waking up in 3.9 seconds.
(0) Cleaning up request packet ID 126 with timestamp +4
Ready to process requests
If anyone has some suggestions what i did wrong or what did i miss, i would be greatfull.
Im lost..
Greetz,
Louis
More information about the Freeradius-Users
mailing list