FreeRADIUS mschap

Question

Following this guide, I am trying to set up FreeRADIUS to authenticate against Active Directory. I can get an Access-Accept message when I send the password in plaintext (using the DEFAULT Auth-Type = ntlm_auth method); however, I want to use mschapv2 so the password is not sent in plaintext.

when I do: radtest -t mschap user pass 10.10.1.21 0 d34db33f

I get:

Sending Access-Request Id 144 from 0.0.0.0:41971 to 10.10.1.21:1812
User-Name = 'user'
NAS-IP-Address = 10.10.7.178
NAS-Port = 0
Message-Authenticator = 0x00
MS-CHAP-Challenge = 0xc118ac9d5a2fbfd0
MS-CHAP-Response = 0x00010000000000000000000000000000000000000000000000003f0b91a63532bc231468ae3034fa0788e64e28efa4832ecf
Received Access-Reject Id 144 from 10.10.1.21:1812 to 10.10.7.178:41971 length 38
MS-CHAP-Error = '\000E=691 R=1'
(0) Expected Access-Accept got Access-Reject

On the server, if I do:

/usr/bin/ntlm_auth --request-nt-key --username=user --challenge=0xc118ac9d5a2fbfd0 --nt-response=0x00010000000000000000000000000000000000000000000000003f0b91a63532bc231468ae3034fa0788e64e28efa4832ecf

I get:

Logon failure (0xc000006d)

It sounds to me like I have a problem with the conversion to mschap. What do I need to edit so that I may authenticate properly?

Does `ntlm_auth --username=user --password=pass` return success? — user1686, Jun 27 '14 at 22:49
Also note that MSCHAPv2 [**is practically plaintext**](https://www.cloudcracker.com/blog/2012/07/29/cracking-ms-chap-v2/). Prefer tunneling it over TTLS or PEAP. — user1686, Jun 27 '14 at 22:52
@grawity yes, it does return successful. At least it will be slightly harder for network snoops to get passwords. — AWippler, Jun 27 '14 at 23:03
Have you tried setting control:Cleartext-Password locally to make sure that works, and it's not a bug in the server or utilities (seeing as you're using the feature releases) — Arran Cudbard-Bell, Jun 28 '14 at 09:05

score 1 · Accepted Answer · answered Jul 07 '14 at 22:08

Turns out the problem I was having was related to the freerad user not being able to access the winbind socket. More info here

Quote:

Ubuntu (12.04) places the socket in /var/run/samba/winbindd_privileged
The socket itself is owned root:root permissions  s777
The directory is owned root:winbindd_privileged permissions 750
Adding the user freerad to the group winbindd_privileged did the trick.

FreeRADIUS mschap

1 Answers1