RADIUS authentication fails with ERROR: No NT-Password

MacUsers

Dear all,

I'm using freeRADIUS3 (v0.15.7_33) on pfSense+, which is working perfectly fine for OpenVPN authentication with OTP enabled. But when I use it to authenticate WiFi access, it fails with the below message:

Dec  7 15:28:58 pfsplus radiusd[1503]: (8)   Login incorrect (mschap: FAILED: No NT-Password.  Cannot perform authentication): [santanu.das] (from client unifi port 0 via TLS tunnel) 
Dec  7 15:28:58 pfsplus radiusd[1503]: (9) Login incorrect (eap_peap: The users session was previously rejected: returning reject (again.)): [santanu.das] (from client unifi port 0 cli B0-xx-xx-xx-xx)

NT passwords is not used, in fact no password at all due to the use of OTP - where is this coming from? I tried all sorts of thing from Internet but still no joy. Is it a bug or am I missing something?

MacUsers

So, no one apart form me having this issue, really??

-S

stephenw10

Not an error I'm familiar with but it seems quite common.

You are just authenticating against Freeradius directly?

How is the client configured? EAP setup?

Steve

MacUsers

Sorry for replying late. Got some other stuff

You are just authenticating against Freeradius directly?

If I really understood the question, the answer is yes. Just using UniFi AP WiFi access.

How is the client configured? EAP setup?

The NAS/Client on the pfSense is configured with the AP IP as Client IP Address, IPv4 and with a client shared-secret and default EAP type PEAP. On the AP, it's configured with WAP2 Enterprise, pointing to pfSense IP as the RADIUS server, with the appropreate Authrozion and Accounting port.

Is that answer your question? Let me know if you ned any othert information.

-San

stephenw10

Hmm you're trying to use OTP for wifi auth also? Have you tested it without that?

MacUsers

@stephenw10 at the the same RADIUS users are used for VPN access as well, so OTP is on. I can give a try disabling OTP but it has to work with OTP for us. I'll reply here soon.

stephenw10

Sure, and I'd expect it to work, but it's definitely something unusual. I'd want to confirm it's not the cause before doing anything further.

Steve

andersonshatch

I encountered this error too on pfSense Community 2.6.0 trying to setup UniFi RADIUS login.
An account with a password specified can login okay, but one setup to use OTP yields the below failure:

Login incorrect (mschap: FAILED: No NT-Password.  Cannot perform authentication)

MacUsers

okay, so looks like it's not an isolated case. I tried with one of my Linksys AP and got exactly the same error - that indicates the issue on the RADIUS side but cannot be very sure. Is there any one can help to debug this pls?

-S

stephenw10

And that was also with OTP? Were you able to test anything without OTP to confirm?

dawsnet

I seem to be getting the same issue's also.

Pfsense : 2.6.0-RELEASE (amd64)
Freeraduis: 3: 0.15.7_33
Access points Unifi

Auth: (11)   Login incorrect (mschap: FAILED: No NT-Password.  Cannot perform authentication): 

Auth: (12) Login incorrect (eap_peap: The users session was previously rejected: returning reject (again.)):

But if I untick the "Disables weak EAP types: MD5, and GTC" everything connects fine both MAC and Windows devices.

When ticked the Mac device's prompt twice for login's and then connect but the windows device don't connect..

Any help would be great.

Thanks

stephenw10

So the clients is trying to use a weak EAP type and in OSX it is able to see that switch to another type but Windows doesn't. There's probably tweak for that in Windows.

dawsnet

@stephenw10 I am using this solution for a flex office so don't really wan't to go about tweaking the devices ;) but cheers for the advice.

do you think this issue can be fixed so we don't need to use weak EAP ?

Cheers

stephenw10

Probably not if the clients are using one of those weaker options and do not try anything else.
For local wifi auth it's unlikely to be significant risk IMO.

Steve

dawsnet

Would this even be the case with a fresh install of Windows 10 fully up-to-date as I am getting the same errors

Sorry just trying to understand it fully..

Cheers

stephenw10

Not something I've ever looked into but if Windows is choosing to use that I'm not sure what you can do. Maybe radius can indicate why it fails prompting Windows to re-try or send a list of accepted ciphers. Also not something I've had to try.