samba - May 2017 - ntlm_auth with freeradius

On 29 May 2017 12:32
>When running 'winbindd -SFd5', I see a little more of the problem
after I run my two ntlm_auth commands > one after the other. I believe the
'crap' part is an acronym for 'Challenge Response
> Authentication Protocol', so why would it be failing?
Edit2:
wbinfo -a tim.odriscoll%<mypass> works perfectly, with the winbindd debug
logs showing the same output as ntlm_auth except with success messages.

So, am I correct in assuming the challenge/response's that freeradius is
calculating are incorrect?

Many thanks,

Tim

Hey,

In samba 4.5.0 update notes it states:

/NTLMv1 authentication disabled by default 
----------------------------------------- In order to improve security 
we have changed the default value for the "ntlm auth" option from
"yes"
to "no". This may have impact on very old clients which doesn't
support
NTLMv2 yet. The primary user of NTLMv1 is MSCHAPv2 for VPNs and 802.1x. 
By default, Samba will only allow NTLMv2 via NTLMSSP now, as we have the 
following default "lanman auth = no", "ntlm auth = no" and
"raw NTLMv2
auth = no"./


I setup freeradius with samba 4.5.3 AD some time ago for 802.1x and I had to
change my smb.conf accordingly, otherwise I was also getting mschapv2 failures.

Hope it helps.



W dniu 2017-05-29 o 14:50, Tim ODriscoll via samba
pisze:
> On 29 May 2017 12:32
>> When running 'winbindd -SFd5', I see a little more of the
problem after I run my two ntlm_auth commands > one after the other. I
believe the 'crap' part is an acronym for 'Challenge Response
>> Authentication Protocol', so why would it be failing?
> Edit2:
> wbinfo -a tim.odriscoll%<mypass> works perfectly, with the winbindd
debug logs showing the same output as ntlm_auth except with success messages.
>
> So, am I correct in assuming the challenge/response's that freeradius
is calculating are incorrect?
>
> Many thanks,
>
> Tim
-- 

Z poważaniem,
Kacper Wirski
tel. +48 608 421 424


tel:   + 48 22 637 50 01
fax:   + 48 22 637 50 04

Babka Medica Spółka z ograniczoną odpowiedzialnością Spółka komandytowa
ul. Słomińskiego 19 lok.517, 00-195 Warszawa
Sąd Rejonowy dla M.St. Warszawy w Warszawie  XII Wydział Gospodarczy KRS 
0000491764
NIP 525-234-00-28

www.babkamedica.pl <http://www.babkamedica.pl/>


----------------------------------------------------------------------------

Informacja zawarta w niniejszej korespondencji jest poufna. Korespondencja
skierowana jest wyłącznie do osoby (firmy) wymienionej wyżej.
Rozpowszechnianie, kopiowanie, ujawnianie lub przekazywanie osobom trzecim w
jakiejkolwiek formie informacji zawartych w niniejszym dokumencie w całości
lub w części jest zakazane bez uprzedniej pisemnej (pod rygorem nieważności)
zgody Babka Medica Sp. z o.o. Sp. k.

On 29 May 2017 16:15
> In samba 4.5.0 update notes it states:
Damn, I didn't read that one..
> I setup freeradius with samba 4.5.3 AD some time ago for 802.1x and I had
to change
> my smb.conf accordingly, otherwise I was also getting mschapv2 failures.
Spot on, that was it!
> Hope it helps.
More than you can imagine!!

Thank you very much!

Tim