MultiOTP + FreeRADIUS + MS Active Directory

Я использую 64-разрядный сервер CentOS 6.6 с FreeRADIUS 2.1.12, установленным из базового репозитория. Дополнительно я использую MultiOTP (http://www.multiotp.net/), который настроен для подключения к нашему серверу Windows 2012 R2.

Версия MultiOTP - 4.3.1.1, и для настройки FreeRADIUS я использовал это руководство: http://wiki.freeradius.org/guide/multiOTP-HOWTO

Я не смог найти никакой информации о более старых версиях FreeRADIUS, но, по крайней мере, использование PAP, похоже, работает:

radtest -t pap -x myusername mypasswordandtoken localhost 1812 sharedsecret
Sending Access-Request of id 95 to 127.0.0.1 port 1812
    User-Name = "myusername"
    User-Password = "mypasswordandtoken"
    NAS-IP-Address = 127.0.0.1
    NAS-Port = 1812
    Message-Authenticator = 0x00000000000000000000000000000000
rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=95, length=20

В radiusd -X вывод выглядит следующим образом:

[suffix] No '@' in User-Name = "myusername", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] No EAP-Message, not doing EAP
++[eap] returns noop
++[files] returns noop
++[expiration] returns noop
++[logintime] returns noop
++? if (control:Auth-Type == 'MS-CHAP')
    (Attribute control:Auth-Type was not found)
? Evaluating (control:Auth-Type == 'MS-CHAP') -> FALSE
++? if (control:Auth-Type == 'MS-CHAP') -> FALSE
++- entering else else {...}
+++? if (!control:Auth-Type)
? Evaluating !(control:Auth-Type) -> TRUE
+++? if (!control:Auth-Type) -> TRUE
+++- entering if (!control:Auth-Type) {...}
++++[control] returns noop
+++- if (!control:Auth-Type) returns noop
++- else else returns noop
[pap] WARNING! No "known good" password found for the user.  Authentication may fail because of this.
++[pap] returns noop
Found Auth-Type = multiotp
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group multiotp {...}
[multiotp]  expand: '%{User-Name}' -> 'myusername'
[multiotp]  expand: '%{User-Password}' -> 'mypasswordandtoken'
[multiotp]  expand: -src=%{Packet-Src-IP-Address} -> -src=127.0.0.1
[multiotp]  expand: -chap-challenge=%{CHAP-Challenge} -> -chap-challenge=
[multiotp]  expand: -chap-password=%{CHAP-Password} -> -chap-password=
[multiotp]  expand: -ms-chap-challenge=%{MS-CHAP-Challenge} -> -ms-chap-challenge=
[multiotp]  expand: -ms-chap-response=%{MS-CHAP-Response} -> -ms-chap-response=
[multiotp]  expand: -ms-chap2-response=%{MS-CHAP2-Response} -> -ms-chap2-response=
Exec-Program output:
Exec-Program: returned: 0
++[multiotp] returns ok

Запуск Radtest с -t mschap не работает, вывод Radius следующий:

[suffix] No '@' in User-Name = "myusername", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] No EAP-Message, not doing EAP
++[eap] returns noop
++[files] returns noop
++[expiration] returns noop
++[logintime] returns noop
++? if (control:Auth-Type == 'MS-CHAP')
? Evaluating (control:Auth-Type == 'MS-CHAP') -> TRUE
++? if (control:Auth-Type == 'MS-CHAP') -> TRUE
++- entering if (control:Auth-Type == 'MS-CHAP') {...}
+++[control] returns noop
++- if (control:Auth-Type == 'MS-CHAP') returns noop
++ ... skipping else for request 1: Preceding "if" was taken
[pap] WARNING! No "known good" password found for the user.  Authentication may fail because of this.
++[pap] returns noop
Found Auth-Type = multiotpmschap
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group multiotpmschap {...}
[multiotpmschap] Told to do MS-CHAPv1 with NT-Password
[multiotpmschap]    expand: %{User-Name} -> myusername
[multiotpmschap]    expand: %{User-Password} -> 
[multiotpmschap]    expand: -src=%{Packet-Src-IP-Address} -> -src=127.0.0.1
[multiotpmschap]    expand: -chap-challenge=%{CHAP-Challenge} -> -chap-challenge=
[multiotpmschap]    expand: -chap-password=%{CHAP-Password} -> -chap-password=
[multiotpmschap]    expand: -ms-chap-challenge=%{MS-CHAP-Challenge} -> -ms-chap-challenge=0xdf908aaeb26f4444
[multiotpmschap]    expand: -ms-chap-response=%{MS-CHAP-Response} -> -ms-chap-response=0x0001000000000000000000000000000000000000000000000000fbb0b53f018a0e1fec964169db2b88be0ca521a8d8a234b6
[multiotpmschap]    expand: -ms-chap2-response=%{MS-CHAP2-Response} -> -ms-chap2-response=
Exec-Program output: NT_KEY: F1111A9A8F0E249D347BE73B2D538685
Exec-Program-Wait: plaintext: NT_KEY: F1111A9A8F0E249D347BE73B2D538685
Exec-Program: returned: 99
[multiotpmschap] External script failed.
[multiotpmschap] MS-CHAP-Response is incorrect.
++[multiotpmschap] returns reject
Failed to authenticate the user.
Using Post-Auth-Type Reject
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group REJECT {...}
[attr_filter.access_reject]         expand: %{User-Name} -> myusername
attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] returns updated
Delaying reject of request 1 for 1 seconds
Going to the next request
Waking up in 0.6 seconds.
Sending delayed reject for request 1
Sending Access-Reject of id 105 to 127.0.0.1 port 49595
    MS-CHAP-Error = "\000E=69
Waking up in 4.9 seconds.

Также подключение приложения, которое выполняет аутентификацию MS-CHAPv2 к freeradius, вызывает ту же ошибку, что и использование mschap с radclient.

Кто-нибудь знает, можно ли эту версию FreeRADIUS использовать с MultiOTP, который подключается к активному каталогу?