query mschap with ntlm_auth samba4
Nicolás Lopiano
nlopiano at gmail.com
Wed Apr 7 17:42:03 CEST 2021
Hello! Sorry for the inconvenience.
I have been looking for information for a long time and could not find to
solve the problem I am running into.
My scenario is a vm with freeradius 3.0.17 joined to a samba4 domain with
sssd, samba version 4.9.5-Debian.
I need to get mschap to work via ntlm_auth. When making the query for
ntlm_auth I have no problem and it works. But when making the query using
mschap it gives me the following error:
Wed Apr 7 11:06:35 2021: ERROR: (3) mschap: Program returned code (1) and
output 'The attempted logon is invalid. This is either due to a bad
username or authentication information. (0xc000006d) '
Wed Apr 7 11:06:35 2021: Debug: (3) mschap: External script failed
Wed Apr 7 11:06:35 2021: ERROR: (3) mschap: External script says: The
attempted logon is invalid. This is either due to a bad username or
authentication information. (0xc000006d)
Wed Apr 7 11:06:35 2021: ERROR: (3) mschap: MS-CHAP2-Response is incorrect
Next I copy how I have the config files:
cat /etc/samba/smb.conf
[global]
workgroup = DOMAIN
netbios name = RADIUS
realm = DOMAIN
security = ads
password server = DC.DOMAIN
ntlm auth = mschapv2-and-ntlmv2-only
winbind use default domain = no
/etc/freeradius/3.0/sites-enabled/default
authorize {
chap
mschap
preprocess
suffix
eap {
ok = return
updated = return
}
ldap
expiration
logintime
authenticate {
Auth-Type MS-CHAP {
mschap
}
Auth-Type ntlm_auth {
ntlm_auth
}
Auth-Type eap {
eap {
handled = 1
}
if (handled && (Response-Packet-Type == Access-Challenge)) {
attr_filter.access_challenge.post-auth
handled # override the "updated" code from attr_filter
}
}
}
/etc/freeradius/3.0/mods-enabled/mschap
mschap {
with_ntdomain_hack = yes
ntlm_auth = "/ usr / bin / ntlm_auth --allow-mschapv2 --request-nt-key
--username =% {% {Stripped-User-Name}: -% {% {User-Name}: - None}} --domain
=% {% {mschap: NT-Domain}: - MYDOMAIN} --challenge =% {% {mschap:
Challenge}: - 00} --nt-response =% {% { mschap: NT-Response}: - 00} "
pool {
start = $ {thread [pool] .start_servers}
min = $ {thread [pool] .min_spare_servers}
max = $ {thread [pool] .max_servers}
spare = $ {thread [pool] .max_spare_servers}
uses = 0
retry_delay = 30
lifetime = 86400
cleanup_interval = 300
idle_timeout = 600
}
}
I have tried several clients to check the service. He eapol_test and also
radtest -t mschap.
I can't find what the problem is
any suggestion? Thanks a lot!
Greetings.
More information about the Freeradius-Users
mailing list