ntlm_auth and MSCHAP issues

[Adam McPartlan]

Howdy,

I am experiencing problems with an existing working install of
FreeRADIUS to get it to use AD to part authenticate users.

Following the instructions found here:
http://deployingradius.com/documents/configuration/active_directory.html


I can sucessfully get FreeRADUS to authenticate using ntlm_auth.

# Executing group from file /etc/freeradius/sites-enabled/default
+group authenticate {
[ntlm_auth] expand: --username=%{mschap:User-Name} -> --
username=mcpartlana
[ntlm_auth] expand: --password=%{User-Password} -> --
password=redactedpassword
Exec output: NT_STATUS_OK: Success (0x0)
Exec plaintext: NT_STATUS_OK: Success (0x0)

However, making the switch to MSCHAP as per the instructions i get the
following outcome:

radtest -t mschap mcpartlana redactedpassword localhost 0
redactedsecret

Sending Access-Request of id 8 to 127.0.0.1 port 1812
User-Name = "mcpartlana"
NAS-IP-Address = 192.168.172.45
NAS-Port = 0
Message-Authenticator = 0x00000000000000000000000000000000
MS-CHAP-Challenge = 0x58b0f84e08b68e46
MS-CHAP-Response =
0x00010000000000000000000000000000000000000000000000003c312cfc3724df41c
5adb769615849f47a081cbb22c73c45
rad_recv: Access-Request packet from host 127.0.0.1 port 48263, id=8,
length=136
User-Name = "mcpartlana"
NAS-IP-Address = 192.168.172.45
NAS-Port = 0
Message-Authenticator = 0x0651b559ed7f1e615e14b10e56fed797
MS-CHAP-Challenge = 0x58b0f84e08b68e46
MS-CHAP-Response =
0x00010000000000000000000000000000000000000000000000003c312cfc3724df41c
5adb769615849f47a081cbb22c73c45

# Executing group from file /etc/freeradius/sites-enabled/default
+group authenticate {
[ntlm_auth] expand: --username=%{mschap:User-Name} -> --
username=mcpartlana
[ntlm_auth] expand: --password=%{User-Password} -> --password=
Exec output: NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a)
Exec plaintext: NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a)
[ntlm_auth] Exec: program returned: 1
++[ntlm_auth] = reject


Sending Access-Reject of id 8 to 127.0.0.1 port 48263
Waking up in 4.9 seconds.
rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=8,
length=20



To me this looks like the password is not being sent to the AD server -
hence the "WRONG_PASSWORD" message - It could just be hidden which is
ok. I can only pressume I have messed something up in my configuration.

Many thanks

Adam













CONFIDENTIALITY WARNING: This email has been sent from NYnet Ltd, a UK limited company controlled by North Yorkshire County Council. The information in this email (and any document(s) attached to it) is confidential or legally privileged, and is intended solely for the use of the person named above. If you are not the intended recipient, please be aware that any disclosure, copying, distribution or use of the contents of this E-mail is strictly prohibited. An individual with the title of director does not necessarily mean they are a statutory director. A full list of statutory directors is available for inspection at our registered office.