[Samba] Fwd: ntlm_auth and freeradius

[Kees van Vloten]

Op 03-04-2023 om 16:05 schreef Tim ODriscoll via samba:
> Dear All,
>
> I'm trying to setup FreeRADIUS to authenticate a machine account to grant access to wifi for domain-connected machines. I think I've got the GPO's set up properly and the CA deployed to the clients, as I'm not getting any errors there.
>
> The errors I'm getting are to do with ntlm_auth not authenticating my machine account. Everything looks OK (to me) on the command line:
> # wbinfo -t
> checking the trust secret for domain MYDOMAIN via RPC calls succeeded
> # wbinfo -p
> Ping to winbindd succeeded
> # ls -ld /var/lib/samba/winbindd_privileged/
> drwxr-x---+ 2 root radiusd 18 Apr  1 21:39 /var/lib/samba/winbindd_privileged/
> # ntlm_auth --username=tim.odriscoll
> Password:
> :  (0x0)
You already did the thing I asked below...
> Samba's config has this on the member (FR) server and all the DCs:
>          ntlm auth = mschapv2-and-ntlmv2-only
>
> But I'm getting this back from FreeRADIUS:
> (7) mschap: Creating challenge hash with username: host/SL-6S4BBS3.MYDOMAIN.co.uk
> (7) mschap: Client is using MS-CHAPv2
> (7) mschap: Executing: /usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --allow-mschapv2 --domain=lambrook --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}:
> (7) mschap: EXPAND --username=%{mschap:User-Name}
> (7) mschap:    --> --username=SL-6S4BBS3$
> (7) mschap: Creating challenge hash with username: host/SL-6S4BBS3.MYDOMAIN.co.uk
> (7) mschap: EXPAND --challenge=%{mschap:Challenge:-00}
> (7) mschap:    --> --challenge=f4b42ffab7c68fa8
> (7) mschap: EXPAND --nt-response=%{mschap:NT-Response:-00}
> (7) mschap:    --> --nt-response=66c030f13772db256f38898578b884e013658f121d517fa3
> (7) mschap: ERROR: Program returned code (1) and output 'The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d)'
> (7) mschap: External script failed
> (7) mschap: ERROR: External script says: The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d)
> (7) mschap: ERROR: MS-CHAP2-Response is incorrect
>
> Anyone have any ideas what to try next?
>
> Many thanks,
> Tim


I have setup exactly the same thing recently.
It looks like the machine freeradius is running on is a samba-AD 
domain-member, correct?
Can you authenticate with a normal user:

ntlm_auth –-request-nt-key –-domain=<netbios_domainname> --username=<user>

Let's start with this,  I could post all radius configs but that is a lot...

- Kees.


I guess we have to look at the conf files then, first these two:

mods-enabled/ntlm_auth:
exec ntlm_auth {
        wait = yes
        shell_escape = yes
        program = "/usr/bin/ntlm_auth --allow-mschapv2 --request-nt-key \
                   --domain=example \
                   --require-membership-of=example\authorization_groupname \
                   --username=%{mschap:User-Name} 
--password=%{User-Password}"

mods-enables/mschap
mschap {
    use_mppe = yes
    with_ntdomain_hack = yes
    require_encryption = yes
    require_strong = yes
    ntlm_auth = "/usr/bin/ntlm_auth --allow-mschapv2 --request-nt-key \
                 --domain=example \
                 --require-membership-of=example\authorization_groupname \
                 --username=%{%{mschap:User-Name}:-00} \
                 --challenge=%{%{mschap:Challenge}:-00} \
                 --nt-response=%{%{mschap:NT-Response}:-00}"

    pool {
        start = ${thread[pool].start_servers}
        min = ${thread[pool].min_spare_servers}
        max = ${thread[pool].max_servers}
        spare = ${thread[pool].max_spare_servers}
        uses = 0
        retry_delay = 30
        lifetime = 86400
        cleanup_interval = 300
        idle_timeout = 600
    }
    passchange {
    }
}

The line "--require-membership-of=example\authorization_groupname" is 
optional.