samba - Mar 2008 - ntlm_auth

I am trying to get FreeRADIUS using Samba's ntlm auth for MSCHAPv2
authentication.

I asked this question over on the FreeRADIUS list, and I think the stunned
silence means that the folks over there think you guys in the Samba world may be
able to help better.

I admit it's been a few years since I did any Samba!

I have joined my two RADIUS servers (FreeRADIUS 2.0.2, Solaris 10 x86, Sun's
winbindd 3.0.25a) to our AD domain with the "net join" command. This
worked (eventually!).

Now when I test "ntlm_auth" I get the following odd goings on:

Scenario A: Works

	Type: ntlm_auth --username=USER --password=PASSWORD --domain=DOMAIN
	Result: NT_STATUS_OK: Success (0x0)

Scenario B: FAILS

	Type: ntlm_auth --username=USER --domain=DOMAIN
		password: <PASSWORD>

	Result: NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a)

What's different about the password handling between A and B?

The upshot is that the command issued by FreeRADIUS:

ntlm_auth = "/usr/sfw/bin/ntlm_auth --request-nt-key --username=
%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --
nt-response=%{mschap:NT-Response:-00}"

the %{} bits become a basic domain free user name, eg "user", and some
long Hex strings...

Also fails.

So my MSCHAPv2 auth is now broken.

This worked with our Test AD environment fine. I am told the only difference
between test/production is:

1) Production is in "native mode"
2) Production supports logins using both "USER\livad.liv.ac.uk" and
"USER@liverpool.ac.uk" forms.

Thanks in advance.

---------------
Barry Dean
Networks Team

Dean, Barry <B.Dean <at> liverpool.ac.uk> writes:
> Now when I test "ntlm_auth" I get the following odd goings on:
> 
> Scenario A: Works
> 
> 	Type: ntlm_auth --username=USER --password=PASSWORD --domain=DOMAIN
> 	Result: NT_STATUS_OK: Success (0x0)
> 
> Scenario B: FAILS
> 
> 	Type: ntlm_auth --username=USER --domain=DOMAIN
> 		password: <PASSWORD>
> 
> 	Result: NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a)
> 
> What's different about the password handling between A and B?
That's a good question. I'm currently looking into that.
> The upshot is that the command issued by FreeRADIUS:
> 
> ntlm_auth = "/usr/sfw/bin/ntlm_auth --request-nt-key --username>
%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00}
-- nt-response=%{mschap:NT-Response:-00}"
> 
> the %{} bits become a basic domain free user name, eg "user", and
some long
Hex strings...
> 
> Also fails.
That's a completely different ntlm_auth mode. I'll check that as well,
though.
> So my MSCHAPv2 auth is now broken.
What version of Samba is this again?

Cheers,
Kai

-- 
Kai Blin
WorldForge developer  http://www.worldforge.org/
Wine developer        http://wiki.winehq.org/KaiBlin
Samba team member     http://www.samba.org/samba/team/
--
Will code for cotton.