[Samba] [EXTERNAL] Fwd: ntlm_auth and freeradius

[Kees van Vloten]

Op 04-04-2023 om 09:45 schreef Andrew Bartlett:
> On Tue, 2023-04-04 at 09:37 +0200, Kees van Vloten wrote:
>> Op 04-04-2023 om 00:32 schreef Andrew Bartlett:
>>
>>> On Mon, 2023-04-03 at 15:08 +0000, Tim ODriscoll via samba wrote:
>>>
>>>> Unfortunately it's still erroring out:
>>>> (7) mschap: Creating challenge hash with username: host/SL-6S4BBS3.MYDOMAIN.co.uk
>>>> (7) mschap: Client is using MS-CHAPv2
>>>
>>> Is this set as a UPN (with the realm appended) on the user?
>>>
>> In my environment (where samba + freeradius + wifi connect with 
>> machine account works), there is no UPN set on the machine account, 
>> just a set of SPNs:
>>
>> servicePrincipalName: HOST/myhost.example.com
>> servicePrincipalName: RestrictedKrbHost/myhost.example.com
>> servicePrincipalName: HOST/MYHOST
>> servicePrincipalName: RestrictedKrbHost/BARTOK
>> servicePrincipalName: WSMAN/myhost.example.com
>> servicePrincipalName: WSMAN/myhost
>> servicePrincipalName: TERMSRV/myhost.example.com
>> servicePrincipalName: TERMSRV/MYHOST
>>
>> One of which does match with the username in Tim's output, btw. I 
>> have seen exactly the same username format while I was setting this 
>> up around a month ago.
>>
>> - Kees.
>>
> So NTLM (and Kerberos client) authentication is not possible with an 
> SPN, but many folks work around it by selecting one of these and 
> having that in the UPN, eg
> userPrincipalName: HOST/myhost.example.com at example.com
>
> This is about the (unusual) username pattern Tim is using, you may be 
> logging in with myhost$, which would work normally.
In the end freeradius uses myhost$ to login, that is indeed what I see 
in the audit.log on the DC. Kerberos is not involved at all between the 
client-machine and the DC. It sends the machine-password to freeradius, 
which uses ntlm_auth + winbind to login, but first it transforms the 
username from the UPN into a normal username.
>
> Andrew Bartlett
>
> -- 
> Andrew Bartlett (he/him)https://samba.org/~abartlet/
> Samba Team Member (since 2001)https://samba.org
> Samba Developer, Catalyst IThttps://catalyst.net.nz/services/samba
>