我的 freeradius 服务器配置有问题。我希望能够根据 Windows ActiveDirectory (2008 R2) 和用户文件对用户进行身份验证，因为我的一些同事未在 AD 中列出。
我们使用 freeradius 服务器来验证 WLAN 用户。（PEAP/MSCHAPv2）
AD 身份验证运行良好，但我仍然对 /etc/freeradius/users 文件存在问题
当我运行 freeradius -X -x 时，我得到以下信息：
Mon Jul 2 09:15:58 2012 : Info: ++++[chap] returns noop
Mon Jul 2 09:15:58 2012 : Info: ++++[mschap] returns noop
Mon Jul 2 09:15:58 2012 : Info: [suffix] No '@' in User-Name = "testtest", looking up realm NULL
Mon Jul 2 09:15:58 2012 : Info: [suffix] Found realm "NULL"
Mon Jul 2 09:15:58 2012 : Info: [suffix] Adding Stripped-User-Name = "testtest"
Mon Jul 2 09:15:58 2012 : Info: [suffix] Adding Realm = "NULL"
Mon Jul 2 09:15:58 2012 : Info: [suffix] Authentication realm is LOCAL.
Mon Jul 2 09:15:58 2012 : Info: ++++[suffix] returns ok
Mon Jul 2 09:15:58 2012 : Info: [eap] EAP packet type response id 1 length 13
Mon Jul 2 09:15:58 2012 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation
Mon Jul 2 09:15:58 2012 : Info: ++++[eap] returns updated
Mon Jul 2 09:15:58 2012 : Info: [files] users: Matched entry testtest at line 1
Mon Jul 2 09:15:58 2012 : Info: ++++[files] returns ok
Mon Jul 2 09:15:58 2012 : Info: ++++[expiration] returns noop
Mon Jul 2 09:15:58 2012 : Info: ++++[logintime] returns noop
Mon Jul 2 09:15:58 2012 : Info: [pap] WARNING: Auth-Type already set. Not setting to PAP
Mon Jul 2 09:15:58 2012 : Info: ++++[pap] returns noop
Mon Jul 2 09:15:58 2012 : Info: +++- else else returns updated
Mon Jul 2 09:15:58 2012 : Info: ++- else else returns updated
Mon Jul 2 09:15:58 2012 : Info: Found Auth-Type = EAP
Mon Jul 2 09:15:58 2012 : Info: # Executing group from file /etc/freeradius/sites-enabled/default
Mon Jul 2 09:15:58 2012 : Info: +- entering group authenticate {...}
Mon Jul 2 09:15:58 2012 : Info: [eap] EAP Identity
Mon Jul 2 09:15:58 2012 : Info: [eap] processing type tls
Mon Jul 2 09:15:58 2012 : Info: [tls] Initiate
Mon Jul 2 09:15:58 2012 : Info: [tls] Start returned 1
Mon Jul 2 09:15:58 2012 : Info: ++[eap] returns handled
Sending Access-Challenge of id 199 to 192.168.61.11 port 3072
EAP-Message = 0x010200061920
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x85469e2a854487589fb1196910cb8ae3
Mon Jul 2 09:15:58 2012 : Info: Finished request 125.
Mon Jul 2 09:15:58 2012 : Debug: Going to the next request
Mon Jul 2 09:15:58 2012 : Debug: Waking up in 2.4 seconds.
此后，它会重复登录尝试，并在某个时候尝试使用 ntlm 针对 ActiveDirectory 进行身份验证，但由于用户仅存在于用户文件中，因此它不起作用。
有人能帮我吗？
谢谢。
PS：希望这会有所帮助，freeradius 尝试针对 AD 进行身份验证：
Mon Jul 2 09:15:58 2012 : Info: ++[chap] returns noop
Mon Jul 2 09:15:58 2012 : Info: ++[mschap] returns noop
Mon Jul 2 09:15:58 2012 : Info: [suffix] No '@' in User-Name = "testtest", looking up realm NULL
Mon Jul 2 09:15:58 2012 : Info: [suffix] Found realm "NULL"
Mon Jul 2 09:15:58 2012 : Info: [suffix] Adding Stripped-User-Name = "testtest"
Mon Jul 2 09:15:58 2012 : Info: [suffix] Adding Realm = "NULL"
Mon Jul 2 09:15:58 2012 : Info: [suffix] Authentication realm is LOCAL.
Mon Jul 2 09:15:58 2012 : Info: ++[suffix] returns ok
Mon Jul 2 09:15:58 2012 : Info: ++[control] returns ok
Mon Jul 2 09:15:58 2012 : Info: [eap] EAP packet type response id 7 length 67
Mon Jul 2 09:15:58 2012 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation
Mon Jul 2 09:15:58 2012 : Info: ++[eap] returns updated
Mon Jul 2 09:15:58 2012 : Info: [files] users: Matched entry testtest at line 1
Mon Jul 2 09:15:58 2012 : Info: ++[files] returns ok
Mon Jul 2 09:15:58 2012 : Info: ++[smbpasswd] returns notfound
Mon Jul 2 09:15:58 2012 : Info: ++[expiration] returns noop
Mon Jul 2 09:15:58 2012 : Info: ++[logintime] returns noop
Mon Jul 2 09:15:58 2012 : Info: [pap] WARNING: Auth-Type already set. Not setting to PAP
Mon Jul 2 09:15:58 2012 : Info: ++[pap] returns noop
Mon Jul 2 09:15:58 2012 : Info: Found Auth-Type = EAP
Mon Jul 2 09:15:58 2012 : Info: # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
Mon Jul 2 09:15:58 2012 : Info: +- entering group authenticate {...}
Mon Jul 2 09:15:58 2012 : Info: [eap] Request found, released from the list
Mon Jul 2 09:15:58 2012 : Info: [eap] EAP/mschapv2
Mon Jul 2 09:15:58 2012 : Info: [eap] processing type mschapv2
Mon Jul 2 09:15:58 2012 : Info: [mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
Mon Jul 2 09:15:58 2012 : Info: [mschapv2] +- entering group MS-CHAP {...}
Mon Jul 2 09:15:58 2012 : Info: [mschap] Creating challenge hash with username: testtest
Mon Jul 2 09:15:58 2012 : Info: [mschap] Told to do MS-CHAPv2 for testtest with NT-Password
Mon Jul 2 09:15:58 2012 : Info: [mschap] expand: --username=%{mschap:User-Name:-None} -> --username=testtest
Mon Jul 2 09:15:58 2012 : Info: [mschap] No NT-Domain was found in the User-Name.
Mon Jul 2 09:15:58 2012 : Info: [mschap] expand: %{mschap:NT-Domain} ->
Mon Jul 2 09:15:58 2012 : Info: [mschap] ... expanding second conditional
Mon Jul 2 09:15:58 2012 : Info: [mschap] expand: --domain=%{%{mschap:NT-Domain}:-DC.COMP.COM} -> --domain=DC.COMP.COM
Mon Jul 2 09:15:58 2012 : Info: [mschap] mschap2: 82
Mon Jul 2 09:15:58 2012 : Info: [mschap] Creating challenge hash with username: testtest
Mon Jul 2 09:15:58 2012 : Info: [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=dd441972f987d68b
Mon Jul 2 09:15:58 2012 : Info: [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=7e6c537cd5c26093789cf7831715d378e16ea3e6c5b1f579
Mon Jul 2 09:15:58 2012 : Debug: Exec-Program output: Logon failure (0xc000006d)
Mon Jul 2 09:15:58 2012 : Debug: Exec-Program-Wait: plaintext: Logon failure (0xc000006d)
Mon Jul 2 09:15:58 2012 : Debug: Exec-Program: returned: 1
Mon Jul 2 09:15:58 2012 : Info: [mschap] External script failed.
Mon Jul 2 09:15:58 2012 : Info: [mschap] FAILED: MS-CHAP2-Response is incorrect
Mon Jul 2 09:15:58 2012 : Info: ++[mschap] returns reject
Mon Jul 2 09:15:58 2012 : Info: [eap] Freeing handler
Mon Jul 2 09:15:58 2012 : Info: ++[eap] returns reject
Mon Jul 2 09:15:58 2012 : Info: Failed to authenticate the user.
Mon Jul 2 09:15:58 2012 : Auth: Login incorrect (mschap: External script says Logon failure (0xc000006d)): [testtest] (from client techap01 port 0 via TLS tunnel)
PPS：问题可能出在这里：在 /etc/freeradius/modules/ntlm_auth 中我已将 ntlm 设置为：
program = "/usr/bin/ntlm_auth --request-nt-key --domain=DC.COMP.COM --username=%{mschap:User-Name} --password=%{User-Password}"
我需要这个，这样用户就可以登录而无需在用户名中添加 @DC.COMP.COM。但我如何告诉 freeradius 尝试两种登录方式？[电子邮件保护]（应该失败）测试测试（针对用户文件 - 应该有效）
答案1
没关系，我找到了解决问题的方法。
在 /etc/freeradius/users 中我将用户从
test01 Cleartext-Password := "1231231"
到
test01 Cleartext-Password := "1231231", MS-CHAP-Use-NTLM-Auth := No
现在一切都运行正常！