Linux – Machine account authentication on Radius server

active-directorylinuxradius

My workstation is under Linux. I have an Active Directory domain controller + Radius server on Windows 2008.
I can verify user account 'radius-01' using 'radtest' tool:

    $ radtest -t pap radius-01 password123 195.234.133.32 1812 password123
    Sending Access-Request of id 98 to 195.234.73.2 port 1812
            User-Name = "radius-01"
            User-Password = "password123"
            NAS-IP-Address = 127.0.1.1
            NAS-Port = 1812
    rad_recv: Access-Accept packet from host 195.234.133.32 port 1812, id=98, length=84
            Framed-MTU = 1344
            Framed-Protocol = PPP
            Service-Type = Framed-User
            Class = 0x537004f00000013700010200ac1c0...

I have joined my Linux PC to Active Directory domain ARB-HRK using Samba:

    [root@shev-arb]# net ads testjoin
    Join is OK

I can dump machine password:

    [root@shev-arb]# tdbdump /var/lib/samba/private/secrets.tdb
    {
    key(34) = "SECRETS/MACHINE_PASSWORD/ARB-HRK"
    data(15) = "yGgXJsquRnpT0g\00"
    }

How can i authenticate my machine account on Radius server?

Do anybody know any tools for this, like:

    radtest   shev-arb$ yGgXJsquRnpT0g 195.234.133.32 1812 password123

(this command fails)

Best Answer

In a Windows Domain, Machine Authentication using machine secret is disabled by default for legacy systems that use MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 as authentication method such as the cases with IKEV1 PAP. In such cases you might encounter DPC Authentication fails at the NPS with error 0xc0000199 (NO_LOGON_WORKSTATION_TRUST_ACCOUNT).

To enable machine authentication for a specific computer account. Do the following:

  • Edit the UserAccountControl attribute such that WORKSTATION_TRUST_ACCOUNT should be removed and NORMAL_ACCOUNT should be added to the value.
  • If the existing value of the UserAccountControl is x then compute update the value to (x-4096+512) to make machine authentication work.

Follow the instruction given in this KB article: http://support.microsoft.com/kb/305144 or:

  1. Run adsiedit.msc on the domain controller
  2. Expand the tree and Select the Computer Leaf, it will be displayed as CN=Hostname
  3. Right click and select Properties
  4. In the properties window select the userAccountControl attribute. Double click to edit.
  5. update the number by deducting 3584 from the existing value.
  6. Press OK to close the edit and OK to close the properties Dialog.

Revert to normal setting once the testing is complete.

radtest -t mschap  'host/shev-arb.arb-hrk.net' yGgXJsquRnpT0g 195.234.133.32 1812 password123
Sending Access-Request of id 139 to 195.234.133.32 port 1812
...
rad_recv: Access-Accept packet from host 195.234.133.32 port 1812, id=139, length=142
...
Related Topic