mschap configuration problem

[Piviul]

Alan DeKok ha scritto il 07/07/20 alle 15:15:
> On Jul 7, 2020, at 9:05 AM, Piviul <piviul at riminilug.it> wrote:
>[...]
>    Follow my guide.  It walks you through the process step by step.  If one step succeeds and the next one fails, you know *exactly* what went wrong, and exactly what to do in order to fix it.
> 
>    Alan DeKok.
Hi Alan, thank you very much. I have followed your guide and PAP and EAP 
now seems to work flawlessy; furthermore even AD authentication and 
ntlm_auth are successfully configured. But when I go to the section 
"Configuring FreeRADIUS to use ntlm_auth for MS-CHAP" fails; on the 
server I can see these logs:
> (0) Found Auth-Type = mschap
> (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
> (0)   authenticate {
> (0) mschap: Client is using MS-CHAPv1 with NT-Password
> (0) mschap: Executing: /usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None}  --domain=%{%{mschap:NT-Domain}:-CSATEST}--challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}:
> (0) mschap: EXPAND --username=%{mschap:User-Name:-None}
> (0) mschap:    --> --username=user1
> (0) mschap: mschap1: 1a
> (0) mschap: EXPAND --domain=%{%{mschap:NT-Domain}:-CSATEST}--challenge=%{mschap:Challenge:-00}
> (0) mschap:    --> --domain=CSATEST--challenge=1a162d834a0ac705
> (0) mschap: EXPAND --nt-response=%{mschap:NT-Response:-00}
> (0) mschap:    --> --nt-response=f7539949c09457385f97329664296f699d915ccd6a0a58fa
> (0) mschap: ERROR: Program returned code (1) and output 'Password: NT_STATUS_NO_SUCH_USER: The specified account does not exist. (0xc0000064)'
> (0) mschap: External script failed
> (0) mschap: ERROR: External script says: Password: NT_STATUS_NO_SUCH_USER: The specified account does not exist. (0xc0000064)
> (0) mschap: ERROR: MS-CHAP2-Response is incorrect
> (0)     [mschap] = reject
> (0)   } # authenticate = reject

that seems that user1 doesn't exists but:
> # getent passwd CSATEST\\user1
> CSATEST\user1:*:11106:10513:user1:/home/user1:/bin/bash

 From the log above seems that the client send a MS-CHAPv1 request... I 
have tried to add --allow-mschapv2 to the ntlm_auth command in the 
mschap configuration file but nothing changed;

Do you think I've found a bug in samba?

Piviul