<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 5/16/18 7:12 AM, Phil Frost wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAC6ry0Jn7MPh25KAAv+BoBF2PX80Gs3HhvXiCXw0JivKFMS8og@mail.gmail.com">
<div dir="ltr">
<div class="gmail_quote">
<div dir="ltr">On Tue, May 15, 2018 at 10:00 PM Pete Ashdown
<<a href="mailto:pashdown@xmission.com"
moz-do-not-send="true">pashdown@xmission.com</a>>
wrote:</div>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
I am trying to get NTLM hashes stored in LDAP to be
authenticated via eap-radius. However, when I connect a
Windows client (7 or 10), I see this type of failure in the
freeradius logs:<br>
<br>
radius3 freeradius[23803]: Login Incorrect:
[\\300\\250z+/] from client vpn01 (mac=, cli=[IP
deleted][4500], port=ikev2-mschapv2)<br>
<br>
An incorrect login would normally have the form of:<br>
<br>
Login Incorrect: [username/badpassword]<br>
<br>
Any idea why Windows (or Strongswan) is sending garbage for
the username/password?<br>
</blockquote>
<div><br>
</div>
<div>I have seen this, and I'm having a vague recollection!
It's not entirely garbage, it's the client IP in binary,
interpreted as a string.</div>
<div><br>
</div>
<div>ord("\300") -> 192</div>
<div>ord("\250") -> 168</div>
<div>ord("z") -> 122</div>
<div>ord("+") -> 43</div>
<div><br>
</div>
<div>It's been a while, but I'm 65% sure this "garbage
username" symptom is what you'll see if the EAP exchange
between Strongswan and FreeRADIUS isn't working, and the
garbage username is a red herring. I'd guess without a
functional EAP exchange the real username is never
exchanged, and so what you're seeing is some fallback.</div>
<div><br>
</div>
<div><a
href="http://lists.freeradius.org/pipermail/freeradius-users/2018-March/090898.html"
moz-do-not-send="true">http://lists.freeradius.org/pipermail/freeradius-users/2018-March/090898.html</a></div>
</div>
</div>
</blockquote>
<br>
Thank you Phil. The odd thing here is that the proper
username/password is exchanged with MacOS clients. I'm at a loss as
to why the EAP exchange works for MacOS, but not Windows. So it
isn't "never exchanged". I'll keep working on it. Is anyone else
using StrongSwan eap-radius -> freeradius -> ldap and has a
working setup?<br>
<br>
</body>
</html>