[Samba] ntlm_auth and PEAP machine authentication

[Matthew Alexander]

Thanks.  I wish I could be of more help.  The weird thing is that every once 
in a while (like 1 out of 20 times) I get a successful machine auth via 
ntlm_auth.  It fails with either an incorrect password or unknown username 
all of the other times.

Matt Alexander


> On Sun, 2005-10-02 at 11:25 -0400, Matthew Alexander wrote:
>> I am trying to use ntlm_auth for machine authentication requests
>> against a Win2003/AD from my RADIUS server.  Normal, user
>> authentication works fine, but not machine authentication.
>> The username passed from RADIUS to ntlm-auth looks like host/pcname123.
>> I'm wondering if the "/" is killing it?  The ntlm_auth man page says
>> that it expects only Samba's unix charset.
>>
>> Does anyone have any ideas about how I can accomplish this?  Thanks.

Machine accounts are a problem because historically, they were not
permitted to login with NTLMSSP.  This appears to have changed, but
there must be some flag that windows domain members set, to change this
behaviour.  I don't know what this is at this stage, so I either need to
see this done to a windows DC, by a windows VPN server (with a system
policy of 'secure channel: sign'), or try random things till it works...

Andrew Bartlett

-- 
Andrew Bartlett                                http://samba.org/~abartlet/
Samba Developer, SuSE Labs, Novell Inc.        http://suse.de
Authentication Developer, Samba Team           http://samba.org
Student Network Administrator, Hawker College  http://hawkerc.net

----- Original Message ----- 
From: "Andrew Bartlett" <abartlet at samba.org>
To: "Matthew Alexander" <mra4d at virginia.edu>
Cc: <samba at lists.samba.org>
Sent: Monday, October 03, 2005 12:19 AM
Subject: Re: [Samba] ntlm_auth and PEAP machine authentication