Alan, I finally made EAP-GTC using ntlm_auth to work. Basically my initial configuration inside "gtc" sub-section of raddb/eap.conf was correct and modifying raddb/modules/ntlm_auth from "%{mschap:User-Name}" to "%{User-Name}" was also correct. I can also use %{%{mschap:User-Name}:-%{User-Name}} that is also working fine and won't break mschap testing thru radtest.
The problem lies somewhere else, in this case something inside file raddb/users where the following line was added when I configured freeRadius with EAP-MSCHAPv2 and testing it with radtest: DEFAULT Auth-Type := ntlm_auth Once I removed that line from raddb/users, EAP-GTC with ntlm_auth works. So, the "gtc" sub-section inside raddb/eap.conf is as follow: gtc { .... challenge = "Password: " .... .... auth_type = ntlm_auth } and raddb/modules/ntlm_auth content: exec ntlm_auth { wait yes program = "/usr/bin/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{%{mschap:User-Name}:-%{User-Name}} --password=%{User-Password} } Again, thank you for all the supports. Regards, Dono On Fri, Sep 27, 2013 at 9:50 AM, Alan DeKok <al...@deployingradius.com>wrote: > Don wrote: > > Nothing secret, as I said I tried both configuration (one at a time) > > inside "gtc" sub-section of eap.conf. > > That's a problem. NOTHING in the documentation or examples says to do > that. LOTS of documentation and examples give the CORRECT way to use > ntlm_auth. > > > I did that, but that didn't work. > > See the FAQ for "it doesn't work" > > > Perhaps I didn't configure the > > ntlm_auth module though there is modules/ntlm_auth created when I > > configured EAP-MSCHAPv2 with ntlm_auth. > > Perhaps you could try following the examples on deployingradius.com, > or the examples distributed with the server. > > > My understanding about RADIUS is that client sends AccessRequest and > > wait for either: AccessReject, AccessAccept, or AccessChallenge. If it > > gets AccessChallenge and later gets another AccessChallenge again, it > > will response, until it gets AccessAccept or AccessReject. The client > > that I am using is NetMotion Mobility XE. > > Which is all useless and irrelevant. I asked about the EAP-GTC spec, > not RADIUS. > > > Thank you once again for your response. Apologize if I am wasting your > > time, not my intention. > > If you ask questions on this list, you need to follow the instructions > we give. Doing anything else is rude. > > You've been very careful to say as little as possible about what > you're doing. You've also been careful to NOT follow the documentation > or examples. > > That explains why you're having issues making it work. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html