Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm trying to set up FreeRadius (on debian 7, samba 3.6.6) to authenticate with AD, and I've successfully joined the the radius machine to the domain (server 08 r2).

I can successfully run

  • wbinfo -u & -g
  • ntlm_auth --request-nt-key --domain=MYDOMAIN --username=user --password=password
  • kinit user@DOMAIN.COM

so all seems good. However when I run

radtest -t mschap user password localhost 0 testing123

I get

Access-Reject ....[snip]...MS-CHAP-Error = "\000E=691 R=1"

The debug output shows this:

Exec-Program output: Reading winbind reply failed! (0xc0000001) ..[snip]..
MS-CHAP-Response is incorrect

I am seeing the appropriate --nt-response={longstring} so I don't believe this is an issue with auth to AD (as I do when I run ntlm_auth in terminal).

My reading says that this may be a permissions issue. However I have added the freeradius process (freerad) to /etc/group (winbindd_priv:x:119:freerad), and I still see the error.

I've searched and found nothing else to try...

Any ideas?

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.