Can't get FreeRADIUS to work with a Samba DC (MSCHAP)

classic Classic list List threaded Threaded
4 messages Options
| Threaded
Open this post in threaded view
|

Can't get FreeRADIUS to work with a Samba DC (MSCHAP)

Users mailing list
Hi all,

I understand my issue is not unique. I have a Samba DC running samba
4.6.7 on Ubuntu 16.04. I'm now trying to set up FreeRADIUS 3 (3.0.16)
with SMB 4.7.6 on Ubuntu 18.04 to authenticate against the Samba DC.

Running "radtest aduser password localhost:18120 0 testing123" works.

Running "radtest -t mschap aduser password localhost:18120 0 testing123"
does not work. I have added this into the smb.conf on both servers:

    ntlm auth = yes

I have been basically following these tutorials:
* https://blog.svedr.in/posts/freeradius-peapv0+mschapv2-howto/

* http://deployingradius.com/documents/configuration/active_directory.html

*
https://wiki.samba.org/index.php/Authenticating_Freeradius_against_Active_Directory

I would also like to add a comment on the fact that I cannot restart
smbd on the DC if I put the following line (nothing in the Samba log nor
syslog):

        ntlm auth = mschapv2-and-ntlmv2-only

I have also tried to set up a Microsoft Radius server (join it to the
same domain), but got the same results ("wrong password"), so I actually
suspect there might be something wrong with the Samba DC. Unfortunately,
I couldn't find so much information on how the DC should be.

Here's my full debug:


main {
  security {
         user = "freerad"
         group = "freerad"
         allow_core_dumps = no
  }
         name = "freeradius"
         prefix = "/usr"
         localstatedir = "/var"
         logdir = "/var/log/freeradius"
         run_dir = "/var/run/freeradius"
}
main {
         name = "freeradius"
         prefix = "/usr"
         localstatedir = "/var"
         sbindir = "/usr/sbin"
         logdir = "/var/log/freeradius"
         run_dir = "/var/run/freeradius"
         libdir = "/usr/lib/freeradius"
         radacctdir = "/var/log/freeradius/radacct"
         hostname_lookups = no
         max_request_time = 30
         cleanup_delay = 5
         max_requests = 16384
         pidfile = "/var/run/freeradius/freeradius.pid"
         checkrad = "/usr/sbin/checkrad"
         debug_level = 0
         proxy_requests = yes
  log {
         stripped_names = no
         auth = no
         auth_badpass = no
         auth_goodpass = no
         colourise = yes
         msg_denied = "You are already logged in - access denied"
  }
  resources {
  }
  security {
         max_attributes = 200
         reject_delay = 1.000000
         status_server = yes
  }
}
radiusd: #### Loading Realms and Home Servers ####
  proxy server {
         retry_delay = 5
         retry_count = 3
         default_fallback = no
         dead_time = 120
         wake_all_if_all_dead = no
  }
  home_server localhost {
         ipaddr = 127.0.0.1
         port = 1812
         type = "auth"
         secret = <<< secret >>>
         response_window = 20.000000
         response_timeouts = 1
         max_outstanding = 65536
         zombie_period = 40
         status_check = "status-server"
         ping_interval = 30
         check_interval = 30
         check_timeout = 4
         num_answers_to_alive = 3
         revive_interval = 120
   limit {
         max_connections = 16
         max_requests = 0
         lifetime = 0
         idle_timeout = 0
   }
   coa {
         irt = 2
         mrt = 16
         mrc = 5
         mrd = 30
   }
  }
  home_server_pool my_auth_failover {
         type = fail-over
         home_server = localhost
  }
  realm example.com {
         auth_pool = my_auth_failover
  }
  realm LOCAL {
  }
radiusd: #### Loading Clients ####
  client localhost {
         ipaddr = 127.0.0.1
         require_message_authenticator = no
         secret = <<< secret >>>
         nas_type = "other"
         proto = "*"
   limit {
         max_connections = 16
         lifetime = 0
         idle_timeout = 30
   }
  }
  client localhost_ipv6 {
         ipv6addr = ::1
         require_message_authenticator = no
         secret = <<< secret >>>
   limit {
         max_connections = 16
         lifetime = 0
         idle_timeout = 30
   }
  }
Debugger not attached
  # Creating Auth-Type = ntlm_auth
  # Creating Auth-Type = eap
  # Creating Auth-Type = PAP
  # Creating Auth-Type = CHAP
  # Creating Auth-Type = MS-CHAP
radiusd: #### Instantiating modules ####
  modules {
   # Loaded module rlm_linelog
   # Loading module "linelog" from file
/etc/freeradius/3.0/mods-enabled/linelog
   linelog {
         filename = "/var/log/freeradius/linelog"
         escape_filenames = no
         syslog_severity = "info"
         permissions = 384
         format = "This is a log message for %{User-Name}"
         reference = "messages.%{%{reply:Packet-Type}:-default}"
   }
   # Loading module "log_accounting" from file
/etc/freeradius/3.0/mods-enabled/linelog
   linelog log_accounting {
         filename = "/var/log/freeradius/linelog-accounting"
         escape_filenames = no
         syslog_severity = "info"
         permissions = 384
         format = ""
         reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}"
   }
   # Loaded module rlm_radutmp
   # Loading module "sradutmp" from file
/etc/freeradius/3.0/mods-enabled/sradutmp
   radutmp sradutmp {
         filename = "/var/log/freeradius/sradutmp"
         username = "%{User-Name}"
         case_sensitive = yes
         check_with_nas = yes
         permissions = 420
         caller_id = no
   }
   # Loaded module rlm_exec
   # Loading module "echo" from file /etc/freeradius/3.0/mods-enabled/echo
   exec echo {
         wait = yes
         program = "/bin/echo %{User-Name}"
         input_pairs = "request"
         output_pairs = "reply"
         shell_escape = yes
   }
   # Loading module "radutmp" from file
/etc/freeradius/3.0/mods-enabled/radutmp
   radutmp {
         filename = "/var/log/freeradius/radutmp"
         username = "%{User-Name}"
         case_sensitive = yes
         check_with_nas = yes
         permissions = 384
         caller_id = yes
   }
   # Loaded module rlm_always
   # Loading module "reject" from file
/etc/freeradius/3.0/mods-enabled/always
   always reject {
         rcode = "reject"
         simulcount = 0
         mpp = no
   }
   # Loading module "fail" from file /etc/freeradius/3.0/mods-enabled/always
   always fail {
         rcode = "fail"
         simulcount = 0
         mpp = no
   }
   # Loading module "ok" from file /etc/freeradius/3.0/mods-enabled/always
   always ok {
         rcode = "ok"
         simulcount = 0
         mpp = no
   }
   # Loading module "handled" from file
/etc/freeradius/3.0/mods-enabled/always
   always handled {
         rcode = "handled"
         simulcount = 0
         mpp = no
   }
   # Loading module "invalid" from file
/etc/freeradius/3.0/mods-enabled/always
   always invalid {
         rcode = "invalid"
         simulcount = 0
         mpp = no
   }
   # Loading module "userlock" from file
/etc/freeradius/3.0/mods-enabled/always
   always userlock {
         rcode = "userlock"
         simulcount = 0
         mpp = no
   }
   # Loading module "notfound" from file
/etc/freeradius/3.0/mods-enabled/always
   always notfound {
         rcode = "notfound"
         simulcount = 0
         mpp = no
   }
   # Loading module "noop" from file /etc/freeradius/3.0/mods-enabled/always
   always noop {
         rcode = "noop"
         simulcount = 0
         mpp = no
   }
   # Loading module "updated" from file
/etc/freeradius/3.0/mods-enabled/always
   always updated {
         rcode = "updated"
         simulcount = 0
         mpp = no
   }
   # Loaded module rlm_dynamic_clients
   # Loading module "dynamic_clients" from file
/etc/freeradius/3.0/mods-enabled/dynamic_clients
   # Loaded module rlm_passwd
   # Loading module "etc_passwd" from file
/etc/freeradius/3.0/mods-enabled/passwd
   passwd etc_passwd {
         filename = "/etc/passwd"
         format = "*User-Name:Crypt-Password:"
         delimiter = ":"
         ignore_nislike = no
         ignore_empty = yes
         allow_multiple_keys = no
         hash_size = 100
   }
   # Loaded module rlm_cache
   # Loading module "cache_eap" from file
/etc/freeradius/3.0/mods-enabled/cache_eap
   cache cache_eap {
         driver = "rlm_cache_rbtree"
         key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}"
         ttl = 15
         max_entries = 0
         epoch = 0
         add_stats = no
   }
   # Loaded module rlm_attr_filter
   # Loading module "attr_filter.post-proxy" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
   attr_filter attr_filter.post-proxy {
         filename = "/etc/freeradius/3.0/mods-config/attr_filter/post-proxy"
         key = "%{Realm}"
         relaxed = no
   }
   # Loading module "attr_filter.pre-proxy" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
   attr_filter attr_filter.pre-proxy {
         filename = "/etc/freeradius/3.0/mods-config/attr_filter/pre-proxy"
         key = "%{Realm}"
         relaxed = no
   }
   # Loading module "attr_filter.access_reject" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
   attr_filter attr_filter.access_reject {
         filename =
"/etc/freeradius/3.0/mods-config/attr_filter/access_reject"
         key = "%{User-Name}"
         relaxed = no
   }
   # Loading module "attr_filter.access_challenge" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
   attr_filter attr_filter.access_challenge {
         filename =
"/etc/freeradius/3.0/mods-config/attr_filter/access_challenge"
         key = "%{User-Name}"
         relaxed = no
   }
   # Loading module "attr_filter.accounting_response" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
   attr_filter attr_filter.accounting_response {
         filename =
"/etc/freeradius/3.0/mods-config/attr_filter/accounting_response"
         key = "%{User-Name}"
         relaxed = no
   }
   # Loaded module rlm_files
   # Loading module "files" from file /etc/freeradius/3.0/mods-enabled/files
   files {
         filename = "/etc/freeradius/3.0/mods-config/files/authorize"
         acctusersfile = "/etc/freeradius/3.0/mods-config/files/accounting"
         preproxy_usersfile =
"/etc/freeradius/3.0/mods-config/files/pre-proxy"
   }
   # Loaded module rlm_realm
   # Loading module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm
   realm IPASS {
         format = "prefix"
         delimiter = "/"
         ignore_default = no
         ignore_null = no
   }
   # Loading module "suffix" from file
/etc/freeradius/3.0/mods-enabled/realm
   realm suffix {
         format = "suffix"
         delimiter = "@"
         ignore_default = no
         ignore_null = no
   }
   # Loading module "realmpercent" from file
/etc/freeradius/3.0/mods-enabled/realm
   realm realmpercent {
         format = "suffix"
         delimiter = "%"
         ignore_default = no
         ignore_null = no
   }
   # Loading module "ntdomain" from file
/etc/freeradius/3.0/mods-enabled/realm
   realm ntdomain {
         format = "prefix"
         delimiter = "\\"
         ignore_default = no
         ignore_null = no
   }
   # Loaded module rlm_pap
   # Loading module "pap" from file /etc/freeradius/3.0/mods-enabled/pap
   pap {
         normalise = yes
   }
   # Loaded module rlm_eap
   # Loading module "eap" from file /etc/freeradius/3.0/mods-enabled/eap
   eap {
         default_eap_type = "md5"
         timer_expire = 60
         ignore_unknown_eap_types = no
         cisco_accounting_username_bug = no
         max_sessions = 16384
   }
   # Loading module "ntlm_auth" from file
/etc/freeradius/3.0/mods-enabled/ntlm_auth
   exec ntlm_auth {
         wait = yes
         program = "/usr/bin/ntlm_auth --request-nt-key
--domain=MY.DOMAIN.COM --username=%{mschap:User-Name}
--password=%{User-Password}"
         shell_escape = yes
   }
   # Loaded module rlm_utf8
   # Loading module "utf8" from file /etc/freeradius/3.0/mods-enabled/utf8
   # Loaded module rlm_logintime
   # Loading module "logintime" from file
/etc/freeradius/3.0/mods-enabled/logintime
   logintime {
         minimum_timeout = 60
   }
   # Loaded module rlm_expr
   # Loading module "expr" from file /etc/freeradius/3.0/mods-enabled/expr
   expr {
         safe_characters =
"@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_:
/äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ"
   }
   # Loaded module rlm_chap
   # Loading module "chap" from file /etc/freeradius/3.0/mods-enabled/chap
   # Loaded module rlm_detail
   # Loading module "auth_log" from file
/etc/freeradius/3.0/mods-enabled/detail.log
   detail auth_log {
         filename =
"/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d"
         header = "%t"
         permissions = 384
         locking = no
         escape_filenames = no
         log_packet_header = no
   }
   # Loading module "reply_log" from file
/etc/freeradius/3.0/mods-enabled/detail.log
   detail reply_log {
         filename =
"/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d"
         header = "%t"
         permissions = 384
         locking = no
         escape_filenames = no
         log_packet_header = no
   }
   # Loading module "pre_proxy_log" from file
/etc/freeradius/3.0/mods-enabled/detail.log
   detail pre_proxy_log {
         filename =
"/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d"
         header = "%t"
         permissions = 384
         locking = no
         escape_filenames = no
         log_packet_header = no
   }
   # Loading module "post_proxy_log" from file
/etc/freeradius/3.0/mods-enabled/detail.log
   detail post_proxy_log {
         filename =
"/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d"
         header = "%t"
         permissions = 384
         locking = no
         escape_filenames = no
         log_packet_header = no
   }
   # Loaded module rlm_unpack
   # Loading module "unpack" from file
/etc/freeradius/3.0/mods-enabled/unpack
   # Loaded module rlm_mschap
   # Loading module "mschap" from file
/etc/freeradius/3.0/mods-enabled/mschap
   mschap {
         use_mppe = yes
         require_encryption = no
         require_strong = no
         with_ntdomain_hack = yes
         ntlm_auth = "/usr/bin/ntlm_auth --allow-mschapv2
--request-nt-key --username=%{mschap:User-Name:-None}
--domain=%{%{mschap:NT-Domain}:-MY.DOMAIN.COM}
--challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"
    passchange {
    }
         allow_retry = yes
         winbind_retry_with_normalised_username = no
   }
   # Loading module "detail" from file
/etc/freeradius/3.0/mods-enabled/detail
   detail {
         filename =
"/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"
         header = "%t"
         permissions = 384
         locking = no
         escape_filenames = no
         log_packet_header = no
   }
   # Loaded module rlm_expiration
   # Loading module "expiration" from file
/etc/freeradius/3.0/mods-enabled/expiration
   # Loaded module rlm_soh
   # Loading module "soh" from file /etc/freeradius/3.0/mods-enabled/soh
   soh {
         dhcp = yes
   }
   # Loaded module rlm_replicate
   # Loading module "replicate" from file
/etc/freeradius/3.0/mods-enabled/replicate
   # Loaded module rlm_digest
   # Loading module "digest" from file
/etc/freeradius/3.0/mods-enabled/digest
   # Loading module "exec" from file /etc/freeradius/3.0/mods-enabled/exec
   exec {
         wait = no
         input_pairs = "request"
         shell_escape = yes
         timeout = 10
   }
   # Loaded module rlm_unix
   # Loading module "unix" from file /etc/freeradius/3.0/mods-enabled/unix
   unix {
         radwtmp = "/var/log/freeradius/radwtmp"
   }
Creating attribute Unix-Group
   # Loaded module rlm_preprocess
   # Loading module "preprocess" from file
/etc/freeradius/3.0/mods-enabled/preprocess
   preprocess {
         huntgroups =
"/etc/freeradius/3.0/mods-config/preprocess/huntgroups"
         hints = "/etc/freeradius/3.0/mods-config/preprocess/hints"
         with_ascend_hack = no
         ascend_channels_per_line = 23
         with_ntdomain_hack = no
         with_specialix_jetstream_hack = no
         with_cisco_vsa_hack = no
         with_alvarion_vsa_hack = no
   }
   instantiate {
   }
   # Instantiating module "linelog" from file
/etc/freeradius/3.0/mods-enabled/linelog
   # Instantiating module "log_accounting" from file
/etc/freeradius/3.0/mods-enabled/linelog
   # Instantiating module "reject" from file
/etc/freeradius/3.0/mods-enabled/always
   # Instantiating module "fail" from file
/etc/freeradius/3.0/mods-enabled/always
   # Instantiating module "ok" from file
/etc/freeradius/3.0/mods-enabled/always
   # Instantiating module "handled" from file
/etc/freeradius/3.0/mods-enabled/always
   # Instantiating module "invalid" from file
/etc/freeradius/3.0/mods-enabled/always
   # Instantiating module "userlock" from file
/etc/freeradius/3.0/mods-enabled/always
   # Instantiating module "notfound" from file
/etc/freeradius/3.0/mods-enabled/always
   # Instantiating module "noop" from file
/etc/freeradius/3.0/mods-enabled/always
   # Instantiating module "updated" from file
/etc/freeradius/3.0/mods-enabled/always
   # Instantiating module "etc_passwd" from file
/etc/freeradius/3.0/mods-enabled/passwd
rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no
   # Instantiating module "cache_eap" from file
/etc/freeradius/3.0/mods-enabled/cache_eap
rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree)
loaded and linked
   # Instantiating module "attr_filter.post-proxy" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/post-proxy
   # Instantiating module "attr_filter.pre-proxy" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/pre-proxy
   # Instantiating module "attr_filter.access_reject" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
reading pairlist file
/etc/freeradius/3.0/mods-config/attr_filter/access_reject
[/etc/freeradius/3.0/mods-config/attr_filter/access_reject]:11 Check
item "FreeRADIUS-Response-Delay"   found in filter list for realm "DEFAULT".
[/etc/freeradius/3.0/mods-config/attr_filter/access_reject]:11 Check
item "FreeRADIUS-Response-Delay-USec"      found in filter list for
realm "DEFAULT".
   # Instantiating module "attr_filter.access_challenge" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
reading pairlist file
/etc/freeradius/3.0/mods-config/attr_filter/access_challenge
   # Instantiating module "attr_filter.accounting_response" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
reading pairlist file
/etc/freeradius/3.0/mods-config/attr_filter/accounting_response
   # Instantiating module "files" from file
/etc/freeradius/3.0/mods-enabled/files
reading pairlist file /etc/freeradius/3.0/mods-config/files/authorize
reading pairlist file /etc/freeradius/3.0/mods-config/files/accounting
reading pairlist file /etc/freeradius/3.0/mods-config/files/pre-proxy
   # Instantiating module "IPASS" from file
/etc/freeradius/3.0/mods-enabled/realm
   # Instantiating module "suffix" from file
/etc/freeradius/3.0/mods-enabled/realm
   # Instantiating module "realmpercent" from file
/etc/freeradius/3.0/mods-enabled/realm
   # Instantiating module "ntdomain" from file
/etc/freeradius/3.0/mods-enabled/realm
   # Instantiating module "pap" from file
/etc/freeradius/3.0/mods-enabled/pap
   # Instantiating module "eap" from file
/etc/freeradius/3.0/mods-enabled/eap
    # Linked to sub-module rlm_eap_md5
    # Linked to sub-module rlm_eap_leap
    # Linked to sub-module rlm_eap_gtc
    gtc {
         challenge = "Password: "
         auth_type = "PAP"
    }
    # Linked to sub-module rlm_eap_tls
    tls {
         tls = "tls-common"
    }
    tls-config tls-common {
         verify_depth = 0
         ca_path = "/etc/freeradius/3.0/certs"
         pem_file_type = yes
         private_key_file = "/etc/ssl/private/ssl-cert-snakeoil.key"
         certificate_file = "/etc/ssl/certs/ssl-cert-snakeoil.pem"
         ca_file = "/etc/ssl/certs/ca-certificates.crt"
         private_key_password = <<< secret >>>
         dh_file = "/etc/freeradius/3.0/certs/dh"
         fragment_size = 1024
         include_length = yes
         auto_chain = yes
         check_crl = no
         check_all_crl = no
         cipher_list = "DEFAULT"
         cipher_server_preference = no
         ecdh_curve = "prime256v1"
         tls_max_version = ""
         tls_min_version = "1.0"
     cache {
         enable = no
         lifetime = 24
         max_entries = 255
     }
     verify {
         skip_if_ocsp_ok = no
     }
     ocsp {
         enable = no
         override_cert_url = yes
         url = "http://127.0.0.1/ocsp/"
         use_nonce = yes
         timeout = 0
         softfail = no
     }
    }
    # Linked to sub-module rlm_eap_ttls
    ttls {
         tls = "tls-common"
         default_eap_type = "md5"
         copy_request_to_tunnel = no
         use_tunneled_reply = no
         virtual_server = "inner-tunnel"
         include_length = yes
         require_client_cert = no
    }
tls: Using cached TLS configuration from previous invocation
    # Linked to sub-module rlm_eap_peap
    peap {
         tls = "tls-common"
         default_eap_type = "mschapv2"
         copy_request_to_tunnel = no
         use_tunneled_reply = no
         proxy_tunneled_request_as_eap = yes
         virtual_server = "inner-tunnel"
         soh = no
         require_client_cert = no
    }
tls: Using cached TLS configuration from previous invocation
    # Linked to sub-module rlm_eap_mschapv2
    mschapv2 {
         with_ntdomain_hack = no
         send_error = no
    }
   # Instantiating module "logintime" from file
/etc/freeradius/3.0/mods-enabled/logintime
   # Instantiating module "auth_log" from file
/etc/freeradius/3.0/mods-enabled/detail.log
rlm_detail (auth_log): 'User-Password' suppressed, will not appear in
detail output
   # Instantiating module "reply_log" from file
/etc/freeradius/3.0/mods-enabled/detail.log
   # Instantiating module "pre_proxy_log" from file
/etc/freeradius/3.0/mods-enabled/detail.log
   # Instantiating module "post_proxy_log" from file
/etc/freeradius/3.0/mods-enabled/detail.log
   # Instantiating module "mschap" from file
/etc/freeradius/3.0/mods-enabled/mschap
rlm_mschap (mschap): authenticating by calling 'ntlm_auth'
   # Instantiating module "detail" from file
/etc/freeradius/3.0/mods-enabled/detail
   # Instantiating module "expiration" from file
/etc/freeradius/3.0/mods-enabled/expiration
   # Instantiating module "preprocess" from file
/etc/freeradius/3.0/mods-enabled/preprocess
reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/huntgroups
reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/hints
  } # modules
radiusd: #### Loading Virtual Servers ####
server { # from file /etc/freeradius/3.0/radiusd.conf
} # server
server inner-tunnel { # from file
/etc/freeradius/3.0/sites-enabled/inner-tunnel
  # Loading authenticate {...}
  # Loading authorize {...}
  # Loading session {...}
  # Loading post-proxy {...}
  # Loading post-auth {...}
} # server inner-tunnel
radiusd: #### Opening IP addresses and Ports ####
listen {
         type = "auth"
         ipaddr = 127.0.0.1
         port = 18120
}
Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel
Listening on proxy address * port 57211
Ready to process requests
(0) Received Access-Request Id 49 from 127.0.0.1:46133 to
127.0.0.1:18120 length 77
(0)   User-Name = "myusername"
(0)   User-Password = "Mcm6jT2UJvjAjJ"
(0)   NAS-IP-Address = 10.84.55.38
(0)   NAS-Port = 0
(0)   Message-Authenticator = 0x17ea111ceca2d0d953d674a38ba4005a
(0) # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/inner-tunnel
(0)   authorize {
(0)     [chap] = noop
(0)     [mschap] = noop
(0) suffix: Checking for suffix after "@"
(0) suffix: No '@' in User-Name = "myusername", looking up realm NULL
(0) suffix: No such realm "NULL"
(0)     [suffix] = noop
(0)     update control {
(0)       Proxy-To-Realm := LOCAL
(0)     } # update control = noop
(0) eap: No EAP-Message, not doing EAP
(0)     [eap] = noop
(0) files: users: Matched entry DEFAULT at line 1
(0)     [files] = ok
(0)     [expiration] = noop
(0)     [logintime] = noop
(0)     [pap] = noop
(0)   } # authorize = ok
(0) Found Auth-Type = ntlm_auth
(0) # Executing group from file
/etc/freeradius/3.0/sites-enabled/inner-tunnel
(0)   authenticate {
(0) ntlm_auth: Executing: /usr/bin/ntlm_auth --request-nt-key
--domain=MY.DOMAIN.COM --username=%{mschap:User-Name}
--password=%{User-Password}:
(0) ntlm_auth: EXPAND --username=%{mschap:User-Name}
(0) ntlm_auth:    --> --username=myusername
(0) ntlm_auth: EXPAND --password=%{User-Password}
(0) ntlm_auth:    --> --password=Mcm6jT2UJvjAjJ
(0) ntlm_auth: Program returned code (0) and output 'NT_STATUS_OK: The
operation completed successfully. (0x0)'
(0) ntlm_auth: Program executed successfully
(0)     [ntlm_auth] = ok
(0)   } # authenticate = ok
(0) # Executing section post-auth from file
/etc/freeradius/3.0/sites-enabled/inner-tunnel
(0) Sent Access-Accept Id 49 from 127.0.0.1:18120 to 127.0.0.1:46133
length 0
(0) Finished request
Waking up in 4.9 seconds.
(1) Received Access-Request Id 15 from 127.0.0.1:52276 to
127.0.0.1:18120 length 133
(1)   User-Name = "myusername"
(1)   NAS-IP-Address = 10.84.55.38
(1)   NAS-Port = 0
(1)   Message-Authenticator = 0x7cab8514fdd0be90fbade3e2c6dfe9fe
(1)   MS-CHAP-Challenge = 0xf41573e4ef540d65
(1)   MS-CHAP-Response =
0x0001000000000000000000000000000000000000000000000000f9f84187630f12e1a1b2fd622925f23d6af05b8dd8e5ebb5
(1) # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/inner-tunnel
(1)   authorize {
(1)     [chap] = noop
(1) mschap: Found MS-CHAP attributes.  Setting 'Auth-Type  = mschap'
(1)     [mschap] = ok
(1) suffix: Checking for suffix after "@"
(1) suffix: No '@' in User-Name = "myusername", looking up realm NULL
(1) suffix: No such realm "NULL"
(1)     [suffix] = noop
(1)     update control {
(1)       Proxy-To-Realm := LOCAL
(1)     } # update control = noop
(1) eap: No EAP-Message, not doing EAP
(1)     [eap] = noop
(1) files: users: Matched entry DEFAULT at line 1
(1)     [files] = ok
(1)     [expiration] = noop
(1)     [logintime] = noop
(1)     [pap] = noop
(1)   } # authorize = ok
(1) Found Auth-Type = MS-CHAP
(1) # Executing group from file
/etc/freeradius/3.0/sites-enabled/inner-tunnel
(1)   Auth-Type MS-CHAP {
(1) mschap: Client is using MS-CHAPv1 with NT-Password
(1) mschap: Executing: /usr/bin/ntlm_auth --allow-mschapv2
--request-nt-key --username=%{mschap:User-Name:-None}
--domain=%{%{mschap:NT-Domain}:-MY.DOMAIN.COM}
--challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}:
(1) mschap: EXPAND --username=%{mschap:User-Name:-None}
(1) mschap:    --> --username=myusername
(1) mschap: ERROR: No NT-Domain was found in the User-Name
(1) mschap: EXPAND --domain=%{%{mschap:NT-Domain}:-MY.DOMAIN.COM}
(1) mschap:    --> --domain=MY.DOMAIN.COM
(1) mschap: mschap1: f4
(1) mschap: EXPAND --challenge=%{mschap:Challenge:-00}
(1) mschap:    --> --challenge=f41573e4ef540d65
(1) mschap: EXPAND --nt-response=%{mschap:NT-Response:-00}
(1) mschap:    -->
--nt-response=f9f84187630f12e1a1b2fd622925f23d6af05b8dd8e5ebb5
(1) mschap: ERROR: Program returned code (1) and output 'The attempted
logon is invalid. This is either due to a bad username or authentication
information. (0xc000006d)'
(1) mschap: External script failed
(1) mschap: ERROR: External script says: The attempted logon is invalid.
This is either due to a bad username or authentication information.
(0xc000006d)
(1) mschap: ERROR: MS-CHAP2-Response is incorrect
(1)     [mschap] = reject
(1)   } # Auth-Type MS-CHAP = reject
(1) Failed to authenticate the user
(1) Using Post-Auth-Type Reject
(1) # Executing group from file
/etc/freeradius/3.0/sites-enabled/inner-tunnel
(1)   Post-Auth-Type REJECT {
(1) attr_filter.access_reject: EXPAND %{User-Name}
(1) attr_filter.access_reject:    --> myusername
(1) attr_filter.access_reject: Matched entry DEFAULT at line 11
(1)     [attr_filter.access_reject] = updated
(1)   } # Post-Auth-Type REJECT = updated
(1) Delaying response for 1.000000 seconds
Waking up in 0.3 seconds.
Waking up in 0.6 seconds.
(1) Sending delayed response
(1) Sent Access-Reject Id 15 from 127.0.0.1:18120 to 127.0.0.1:52276
length 61
(1)   MS-CHAP-Error = "\000E=691 R=1 C=ec6840b4c19cf4a4 V=2"
Waking up in 1.4 seconds.
(0) Cleaning up request packet ID 49 with timestamp +6
Waking up in 2.5 seconds.
(1) Cleaning up request packet ID 15 with timestamp +9
Ready to process requests

Thanks a lot in advance.

Oleg

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
| Threaded
Open this post in threaded view
|

Re: Can't get FreeRADIUS to work with a Samba DC (MSCHAP)

Alan DeKok-2
On Aug 23, 2019, at 4:16 AM, Oleg Blyahher via Freeradius-Users <[hidden email]> wrote:
>
> I understand my issue is not unique. I have a Samba DC running samba 4.6.7 on Ubuntu 16.04. I'm now trying to set up FreeRADIUS 3 (3.0.16) with SMB 4.7.6 on Ubuntu 18.04 to authenticate against the Samba DC.

  That's good.

> Running "radtest aduser password localhost:18120 0 testing123" works.
>
> Running "radtest -t mschap aduser password localhost:18120 0 testing123" does not work. I have added this into the smb.conf on both servers:
>
>    ntlm auth = yes

  That's bad.

> I have been basically following these tutorials:
> * https://blog.svedr.in/posts/freeradius-peapv0+mschapv2-howto/

  Which looks to be mostly copied from my site.

  How do you even find those pages?  My site has been up for 15 years, and is pointed to from pretty much everywhere as the definitive guide.

> * http://deployingradius.com/documents/configuration/active_directory.html
>
> * https://wiki.samba.org/index.php/Authenticating_Freeradius_against_Active_Directory
>
> I would also like to add a comment on the fact that I cannot restart smbd on the DC if I put the following line (nothing in the Samba log nor syslog):
>
> ntlm auth = mschapv2-and-ntlmv2-only

  See the Samba documentation for how their software works.

> I have also tried to set up a Microsoft Radius server (join it to the same domain), but got the same results ("wrong password"), so I actually suspect there might be something wrong with the Samba DC. Unfortunately, I couldn't find so much information on how the DC should be.
>
> Here's my full debug:
> ...
> (1) mschap: ERROR: Program returned code (1) and output 'The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d)'
> (1) mschap: External script failed
> (1) mschap: ERROR: External script says: The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d)
> (1) mschap: ERROR: MS-CHAP2-Response is incorrect

  That's pretty definitive.  The ntlm_auth program is returning an error from Samba.  No amount of poking FreeRADIUS will fix the problem.

  Unfortunately there is very little we can do here.  If Samba is refusing to do ntlm, then you have to fix Samba.

  Alan DeKok.


-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
| Threaded
Open this post in threaded view
|

Re: Can't get FreeRADIUS to work with a Samba DC (MSCHAP)

Users mailing list
Hi Alan,

Thank you so much for pointing that out.

I guess migrating to a new DC it is...

All the best!

On 2019-08-23 13:22, Alan DeKok wrote:

> On Aug 23, 2019, at 4:16 AM, Oleg Blyahher via Freeradius-Users <[hidden email]> wrote:
>> I understand my issue is not unique. I have a Samba DC running samba 4.6.7 on Ubuntu 16.04. I'm now trying to set up FreeRADIUS 3 (3.0.16) with SMB 4.7.6 on Ubuntu 18.04 to authenticate against the Samba DC.
>    That's good.
>
>> Running "radtest aduser password localhost:18120 0 testing123" works.
>>
>> Running "radtest -t mschap aduser password localhost:18120 0 testing123" does not work. I have added this into the smb.conf on both servers:
>>
>>     ntlm auth = yes
>    That's bad.
>
>> I have been basically following these tutorials:
>> * https://blog.svedr.in/posts/freeradius-peapv0+mschapv2-howto/
>    Which looks to be mostly copied from my site.
>
>    How do you even find those pages?  My site has been up for 15 years, and is pointed to from pretty much everywhere as the definitive guide.
>
>> * http://deployingradius.com/documents/configuration/active_directory.html
>>
>> * https://wiki.samba.org/index.php/Authenticating_Freeradius_against_Active_Directory
>>
>> I would also like to add a comment on the fact that I cannot restart smbd on the DC if I put the following line (nothing in the Samba log nor syslog):
>>
>> ntlm auth = mschapv2-and-ntlmv2-only
>    See the Samba documentation for how their software works.
>
>> I have also tried to set up a Microsoft Radius server (join it to the same domain), but got the same results ("wrong password"), so I actually suspect there might be something wrong with the Samba DC. Unfortunately, I couldn't find so much information on how the DC should be.
>>
>> Here's my full debug:
>> ...
>> (1) mschap: ERROR: Program returned code (1) and output 'The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d)'
>> (1) mschap: External script failed
>> (1) mschap: ERROR: External script says: The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d)
>> (1) mschap: ERROR: MS-CHAP2-Response is incorrect
>    That's pretty definitive.  The ntlm_auth program is returning an error from Samba.  No amount of poking FreeRADIUS will fix the problem.
>
>    Unfortunately there is very little we can do here.  If Samba is refusing to do ntlm, then you have to fix Samba.
>
>    Alan DeKok.
>
>
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
| Threaded
Open this post in threaded view
|

Re: Can't get FreeRADIUS to work with a Samba DC (MSCHAP)

Users mailing list
Hi there,

I've solved it.

Adding --allow-mschapv2 to /etc/freeradius/3.0/mods-enabled/mschap got
the job done and now it's all working as it should.

If anyone has the same problem in the future:

ntlm_auth = "/usr/bin/ntlm_auth --allow-mschapv2 --request-nt-key
--username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}}
--challenge=%{%{mschap:Challenge}:-00}
--nt-response=%{%{mschap:NT-Response}:-00}"

All the best

Oleg

On 2019-08-23 13:41, Oleg Blyahher wrote:

> Hi Alan,
>
> Thank you so much for pointing that out.
>
> I guess migrating to a new DC it is...
>
> All the best!
>
> On 2019-08-23 13:22, Alan DeKok wrote:
>> On Aug 23, 2019, at 4:16 AM, Oleg Blyahher via Freeradius-Users
>> <[hidden email]> wrote:
>>> I understand my issue is not unique. I have a Samba DC running samba
>>> 4.6.7 on Ubuntu 16.04. I'm now trying to set up FreeRADIUS 3
>>> (3.0.16) with SMB 4.7.6 on Ubuntu 18.04 to authenticate against the
>>> Samba DC.
>>    That's good.
>>
>>> Running "radtest aduser password localhost:18120 0 testing123" works.
>>>
>>> Running "radtest -t mschap aduser password localhost:18120 0
>>> testing123" does not work. I have added this into the smb.conf on
>>> both servers:
>>>
>>>     ntlm auth = yes
>>    That's bad.
>>
>>> I have been basically following these tutorials:
>>> * https://blog.svedr.in/posts/freeradius-peapv0+mschapv2-howto/
>>    Which looks to be mostly copied from my site.
>>
>>    How do you even find those pages?  My site has been up for 15
>> years, and is pointed to from pretty much everywhere as the
>> definitive guide.
>>
>>> *
>>> http://deployingradius.com/documents/configuration/active_directory.html 
>>>
>>>
>>> *
>>> https://wiki.samba.org/index.php/Authenticating_Freeradius_against_Active_Directory
>>>
>>> I would also like to add a comment on the fact that I cannot restart
>>> smbd on the DC if I put the following line (nothing in the Samba log
>>> nor syslog):
>>>
>>>     ntlm auth = mschapv2-and-ntlmv2-only
>>    See the Samba documentation for how their software works.
>>
>>> I have also tried to set up a Microsoft Radius server (join it to
>>> the same domain), but got the same results ("wrong password"), so I
>>> actually suspect there might be something wrong with the Samba DC.
>>> Unfortunately, I couldn't find so much information on how the DC
>>> should be.
>>>
>>> Here's my full debug:
>>> ...
>>> (1) mschap: ERROR: Program returned code (1) and output 'The
>>> attempted logon is invalid. This is either due to a bad username or
>>> authentication information. (0xc000006d)'
>>> (1) mschap: External script failed
>>> (1) mschap: ERROR: External script says: The attempted logon is
>>> invalid. This is either due to a bad username or authentication
>>> information. (0xc000006d)
>>> (1) mschap: ERROR: MS-CHAP2-Response is incorrect
>>    That's pretty definitive.  The ntlm_auth program is returning an
>> error from Samba.  No amount of poking FreeRADIUS will fix the problem.
>>
>>    Unfortunately there is very little we can do here.  If Samba is
>> refusing to do ntlm, then you have to fix Samba.
>>
>>    Alan DeKok.
>>
>>
>> -
>> List info/subscribe/unsubscribe? See
>> http://www.freeradius.org/list/users.html
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html