Chetan Gaonker | 7f4bf74 | 2016-05-04 15:56:08 -0700 | [diff] [blame] | 1 | # -*- text -*- |
| 2 | # |
| 3 | # $Id: 2170df13dbb884fde5d596eba68056781ba3160c $ |
| 4 | |
| 5 | # Microsoft CHAP authentication |
| 6 | # |
| 7 | # This module supports MS-CHAP and MS-CHAPv2 authentication. |
| 8 | # It also enforces the SMB-Account-Ctrl attribute. |
| 9 | # |
| 10 | mschap { |
| 11 | # |
| 12 | # If you are using /etc/smbpasswd, see the 'passwd' |
| 13 | # module for an example of how to use /etc/smbpasswd |
| 14 | |
| 15 | # if use_mppe is not set to no mschap will |
| 16 | # add MS-CHAP-MPPE-Keys for MS-CHAPv1 and |
| 17 | # MS-MPPE-Recv-Key/MS-MPPE-Send-Key for MS-CHAPv2 |
| 18 | # |
| 19 | # use_mppe = no |
| 20 | |
| 21 | # if mppe is enabled require_encryption makes |
| 22 | # encryption moderate |
| 23 | # |
| 24 | # require_encryption = yes |
| 25 | |
| 26 | # require_strong always requires 128 bit key |
| 27 | # encryption |
| 28 | # |
| 29 | # require_strong = yes |
| 30 | |
| 31 | # The module can perform authentication itself, OR |
| 32 | # use a Windows Domain Controller. This configuration |
| 33 | # directive tells the module to call the ntlm_auth |
| 34 | # program, which will do the authentication, and return |
| 35 | # the NT-Key. Note that you MUST have "winbindd" and |
| 36 | # "nmbd" running on the local machine for ntlm_auth |
| 37 | # to work. See the ntlm_auth program documentation |
| 38 | # for details. |
| 39 | # |
| 40 | # If ntlm_auth is configured below, then the mschap |
| 41 | # module will call ntlm_auth for every MS-CHAP |
| 42 | # authentication request. If there is a cleartext |
| 43 | # or NT hashed password available, you can set |
| 44 | # "MS-CHAP-Use-NTLM-Auth := No" in the control items, |
| 45 | # and the mschap module will do the authentication itself, |
| 46 | # without calling ntlm_auth. |
| 47 | # |
| 48 | # Be VERY careful when editing the following line! |
| 49 | # |
| 50 | # You can also try setting the user name as: |
| 51 | # |
| 52 | # ... --username=%{mschap:User-Name} ... |
| 53 | # |
| 54 | # In that case, the mschap module will look at the User-Name |
| 55 | # attribute, and do prefix/suffix checks in order to obtain |
| 56 | # the "best" user name for the request. |
| 57 | # |
| 58 | # ntlm_auth = "/path/to/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}" |
| 59 | |
| 60 | # The default is to wait 10 seconds for ntlm_auth to |
| 61 | # complete. This is a long time, and if it's taking that |
| 62 | # long then you likely have other problems in your domain. |
| 63 | # The length of time can be decreased with the following |
| 64 | # option, which can save clients waiting if your ntlm_auth |
| 65 | # usually finishes quicker. Range 1 to 10 seconds. |
| 66 | # |
| 67 | # ntlm_auth_timeout = 10 |
| 68 | |
| 69 | passchange { |
| 70 | # This support MS-CHAPv2 (not v1) password change |
| 71 | # requests. See doc/mschap.rst for more IMPORTANT |
| 72 | # information. |
| 73 | # |
| 74 | # Samba/ntlm_auth - if you are using ntlm_auth to |
| 75 | # validate passwords, you will need to use ntlm_auth |
| 76 | # to change passwords. Uncomment the three lines |
| 77 | # below, and change the path to ntlm_auth. |
| 78 | # |
| 79 | # ntlm_auth = "/usr/bin/ntlm_auth --helper-protocol=ntlm-change-password-1" |
| 80 | # ntlm_auth_username = "username: %{mschap:User-Name}" |
| 81 | # ntlm_auth_domain = "nt-domain: %{mschap:NT-Domain}" |
| 82 | |
| 83 | # To implement a local password change, you need to |
| 84 | # supply a string which is then expanded, so that the |
| 85 | # password can be placed somewhere. e.g. passed to a |
| 86 | # script (exec), or written to SQL (UPDATE/INSERT). |
| 87 | # We give both examples here, but only one will be |
| 88 | # used. |
| 89 | # |
| 90 | # local_cpw = "%{exec:/path/to/script %{mschap:User-Name} %{MS-CHAP-New-Cleartext-Password}}" |
| 91 | # |
| 92 | # local_cpw = "%{sql:UPDATE radcheck set value='%{MS-CHAP-New-NT-Password}' where username='%{SQL-User-Name}' and attribute='NT-Password'}" |
| 93 | } |
| 94 | |
| 95 | # For Apple Server, when running on the same machine as |
| 96 | # Open Directory. It has no effect on other systems. |
| 97 | # |
| 98 | # use_open_directory = yes |
| 99 | |
| 100 | # On failure, set (or not) the MS-CHAP error code saying |
| 101 | # "retries allowed". |
| 102 | # allow_retry = yes |
| 103 | |
| 104 | # An optional retry message. |
| 105 | # retry_msg = "Re-enter (or reset) the password" |
| 106 | } |