OK,
Just to recap, I'm working on setting Freeradius up to authenticate users to
our wireless network. We want to use PEAP-MSCHAPv2 and authenticate against
Active Directory. I'm using samba and ntlm_auth.
Versions:freeradius2-2.1.7-7.el5 and samba3.0.33-3.29
Needless to say it's failing.
I set the mydomain.ox.ac.uk realm in proxy.conf as someone on here suggested on
Friday, and that has cleared up the warning about unknown realms.
When connecting, I still get several errors before auth fails.
I've pasted my debug output into the web tool and it picks out the following in
red
security {
max_attributes = 200
reject_delay = 1 (This line in red)
status_server = yes
}
(all in red)
Module: Instantiating attr_filter.access_reject
attr_filter attr_filter.access_reject {
attrsfile = "/etc/raddb/attrs.access_reject"
[pap] WARNING! No "known good" password found for the user. Authentication may
fail because of this. (In yellow)
I also see (not highlighted) that I'm still getting
[mschap] No Cleartext-Password configured. Cannot create LM-Password.
[mschap] No Cleartext-Password configured. Cannot create NT-Password.
[mschap] Told to do MS-CHAPv2 for hol...@mydomain.ox.ac.uk with NT-Password
[mschap] FAILED: No NT/LM-Password. Cannot perform authentication.
[mschap] FAILED: MS-CHAP2-Response is incorrect
I have configured modules/mschap to use ntlm_auth as follows
ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key
--username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-MYDOMAIN}
--challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"
Am I missing something in the MSCHAP config?
Cheers,
Mark
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
