Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My workstation is under Linux. I have an Active Directory domain controller + Radius server on Windows 2008. I can verify user account 'radius-01' using 'radtest' tool:

    $ radtest -t pap radius-01 password123 195.234.133.32 1812 password123
    Sending Access-Request of id 98 to 195.234.73.2 port 1812
            User-Name = "radius-01"
            User-Password = "password123"
            NAS-IP-Address = 127.0.1.1
            NAS-Port = 1812
    rad_recv: Access-Accept packet from host 195.234.133.32 port 1812, id=98, length=84
            Framed-MTU = 1344
            Framed-Protocol = PPP
            Service-Type = Framed-User
            Class = 0x537004f00000013700010200ac1c0...

I have joined my Linux PC to Active Directory domain ARB-HRK using Samba:

    [root@shev-arb]# net ads testjoin
    Join is OK

I can dump machine password:

    [root@shev-arb]# tdbdump /var/lib/samba/private/secrets.tdb
    {
    key(34) = "SECRETS/MACHINE_PASSWORD/ARB-HRK"
    data(15) = "yGgXJsquRnpT0g\00"
    }

How can i authenticate my machine account on Radius server?

Do anybody know any tools for this, like:

    radtest   shev-arb$ yGgXJsquRnpT0g 195.234.133.32 1812 password123

(this command fails)

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

In a Windows Domain, Machine Authentication using machine secret is disabled by default for legacy systems that use MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 as authentication method such as the cases with IKEV1 PAP. In such cases you might encounter DPC Authentication fails at the NPS with error 0xc0000199 (NO_LOGON_WORKSTATION_TRUST_ACCOUNT).

To enable machine authentication for a specific computer account. Do the following:

  • Edit the UserAccountControl attribute such that WORKSTATION_TRUST_ACCOUNT should be removed and NORMAL_ACCOUNT should be added to the value.
  • If the existing value of the UserAccountControl is x then compute update the value to (x-4096+512) to make machine authentication work.

Follow the instruction given in this KB article: http://support.microsoft.com/kb/305144 or:

  1. Run adsiedit.msc on the domain controller
  2. Expand the tree and Select the Computer Leaf, it will be displayed as CN=Hostname
  3. Right click and select Properties
  4. In the properties window select the userAccountControl attribute. Double click to edit.
  5. update the number by deducting 3584 from the existing value.
  6. Press OK to close the edit and OK to close the properties Dialog.

Revert to normal setting once the testing is complete.

radtest -t mschap  'host/shev-arb.arb-hrk.net' yGgXJsquRnpT0g 195.234.133.32 1812 password123
Sending Access-Request of id 139 to 195.234.133.32 port 1812
...
rad_recv: Access-Accept packet from host 195.234.133.32 port 1812, id=139, length=142
...
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.