Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to set up FreeRadius (on debian 7, samba 3.6.6) to authenticate with AD, and I've successfully joined the the radius machine to the domain (server 08 r2).

I can successfully run

  • wbinfo -u & -g
  • ntlm_auth --request-nt-key --domain=MYDOMAIN --username=user --password=password
  • kinit user@DOMAIN.COM

so all seems good. However when I run

radtest -t mschap user password localhost 0 testing123

I get

Access-Reject ....[snip]...MS-CHAP-Error = "\000E=691 R=1"

The debug output shows this:

Exec-Program output: Reading winbind reply failed! (0xc0000001) ..[snip]..
MS-CHAP-Response is incorrect

I am seeing the appropriate --nt-response={longstring} so I don't believe this is an issue with auth to AD (as I do when I run ntlm_auth in terminal).

My reading says that this may be a permissions issue. However I have added the freeradius process (freerad) to /etc/group (winbindd_priv:x:119:freerad), and I still see the error.

I've searched and found nothing else to try...

Any ideas?

share|improve this question
Have you attempted to update samba to a newer version. – Cyrus Ramirez Jan 9 '15 at 20:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.