View difference between Paste ID: ukmRq7wP and 3C8vn1Hp

 # -*- text -*-
 #
 #  $Id: 18f600589b67177679b9521feb65b7fbb0200ac2 $
 
 # Microsoft CHAP authentication
 #
 #  This module supports MS-CHAP and MS-CHAPv2 authentication.
 #  It also enforces the SMB-Account-Ctrl attribute.
 #
 mschap {
 	#
 	#  If you are using /etc/smbpasswd, see the 'passwd'
 	#  module for an example of how to use /etc/smbpasswd
 
 	# if use_mppe is not set to no mschap will
 	# add MS-CHAP-MPPE-Keys for MS-CHAPv1 and
 	# MS-MPPE-Recv-Key/MS-MPPE-Send-Key for MS-CHAPv2
 	#
 #	use_mppe = no
 
 	# if mppe is enabled require_encryption makes
 	# encryption moderate
 	#
 #	require_encryption = yes
 
 	# require_strong always requires 128 bit key
 	# encryption
 	#
 #	require_strong = yes
 
 	# The module can perform authentication itself, OR
 	# use a Windows Domain Controller.  This configuration
 	# directive tells the module to call the ntlm_auth
 	# program, which will do the authentication, and return
 	# the NT-Key.  Note that you MUST have "winbindd" and
 	# "nmbd" running on the local machine for ntlm_auth
 	# to work.  See the ntlm_auth program documentation
 	# for details.
 	#
 	# If ntlm_auth is configured below, then the mschap
 	# module will call ntlm_auth for every MS-CHAP
 	# authentication request.  If there is a cleartext
 	# or NT hashed password available, you can set
 	# "MS-CHAP-Use-NTLM-Auth := No" in the control items,
 	# and the mschap module will do the authentication itself,
 	# without calling ntlm_auth.
 	#
 	# Be VERY careful when editing the following line!
 	#
 	# You can also try setting the user name as:
 	#
 	#	... --username=%{mschap:User-Name} ...
 	#
 	# In that case, the mschap module will look at the User-Name
 	# attribute, and do prefix/suffix checks in order to obtain
 	# the "best" user name for the request.
 	#
-	#ntlm_auth = "/usr/bin/systemd-run -q -M nsdc -t /usr/bin/ntlm_auth --request-nt-key --allow-mschapv2 --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}"
+	ntlm_auth = "/usr/bin/nsdc-run -e /usr/bin/ntlm_auth_nsdc %{%{Stripped-User-Name}:-%{%{User-Name}:-None}} %{%{mschap:Challenge}:-00} %{%{mschap:NT-Response}:-00}"
-    ntlm_auth = "nsdc-run -e /ntlm_auth_nsdc %{%{Stripped-User-Name}:-%{%{User-Name}:-None}} %{%{mschap:Challenge}:-00} %{%{mschap:NT-Response}:-00}"
+
 	# complete.  This is a long time, and if it's taking that
 	# long then you likely have other problems in your domain.
 	# The length of time can be decreased with the following
 	# option, which can save clients waiting if your ntlm_auth
 	# usually finishes quicker. Range 1 to 10 seconds.
 	#
 #	ntlm_auth_timeout = 10
 
 	# An alternative to using ntlm_auth is to connect to the
 	# winbind daemon directly for authentication. This option
 	# is likely to be faster and may be useful on busy systems,
 	# but is less well tested.
 	#
 	# Using this option requires libwbclient from Samba 4.2.1
 	# or later to be installed. Make sure that ntlm_auth above is
 	# commented out.
 	#
 #	winbind_username = "%{mschap:User-Name}"
 #	winbind_domain = "%{mschap:NT-Domain}"
 
 	# When using single sign-on with a winbind connection and the
 	# client uses a different casing for the username than the
 	# casing is according to the backend, reauth may fail because
 	# of some Windows internals. This switch tries to find the
 	# user in the correct casing in the backend, and retry
 	# authentication with that username.
 	#
 #	winbind_retry_with_normalised_username = no
 
 	#
 	#  Information for the winbind connection pool.  The configuration
 	#  items below are the same for all modules which use the new
 	#  connection pool.
 	#
 	pool {
 		#  Connections to create during module instantiation.
 		#  If the server cannot create specified number of
 		#  connections during instantiation it will exit.
 		#  Set to 0 to allow the server to start without the
 		#  winbind daemon being available.
 		start = ${thread[pool].start_servers}
 
 		#  Minimum number of connections to keep open
 		min = ${thread[pool].min_spare_servers}
 
 		#  Maximum number of connections
 		#
 		#  If these connections are all in use and a new one
 		#  is requested, the request will NOT get a connection.
 		#
 		#  Setting 'max' to LESS than the number of threads means
 		#  that some threads may starve, and you will see errors
 		#  like 'No connections available and at max connection limit'
 		#
 		#  Setting 'max' to MORE than the number of threads means
 		#  that there are more connections than necessary.
 		max = ${thread[pool].max_servers}
 
 		#  Spare connections to be left idle
 		#
 		#  NOTE: Idle connections WILL be closed if "idle_timeout"
 		#  is set.  This should be less than or equal to "max" above.
 		spare = ${thread[pool].max_spare_servers}
 
 		#  Number of uses before the connection is closed
 		#
 		#  0 means "infinite"
 		uses = 0
 
 		#  The number of seconds to wait after the server tries
 		#  to open a connection, and fails.  During this time,
 		#  no new connections will be opened.
 		retry_delay = 30
 
 		#  The lifetime (in seconds) of the connection
 		#
 		#  NOTE: A setting of 0 means infinite (no limit).
 		lifetime = 86400
 
 		#  The pool is checked for free connections every
 		#  "cleanup_interval".  If there are free connections,
 		#  then one of them is closed.
 		cleanup_interval = 300
 
 		#  The idle timeout (in seconds).  A connection which is
 		#  unused for this length of time will be closed.
 		#
 		#  NOTE: A setting of 0 means infinite (no timeout).
 		idle_timeout = 600
 
 		#  NOTE: All configuration settings are enforced.  If a
 		#  connection is closed because of "idle_timeout",
 		#  "uses", or "lifetime", then the total number of
 		#  connections MAY fall below "min".  When that
 		#  happens, it will open a new connection.  It will
 		#  also log a WARNING message.
 		#
 		#  The solution is to either lower the "min" connections,
 		#  or increase lifetime/idle_timeout.
 	}
 
 	passchange {
 		# This support MS-CHAPv2 (not v1) password change
 		# requests.  See doc/mschap.rst for more IMPORTANT
 		# information.
 		#
 		# Samba/ntlm_auth - if you are using ntlm_auth to
 		# validate passwords, you will need to use ntlm_auth
 		# to change passwords.  Uncomment the three lines
 		# below, and change the path to ntlm_auth.
 		#
 #		ntlm_auth = "/usr/bin/ntlm_auth --helper-protocol=ntlm-change-password-1"
 #		ntlm_auth_username = "username: %{mschap:User-Name}"
 #		ntlm_auth_domain = "nt-domain: %{mschap:NT-Domain}"
 
 		# To implement a local password change, you need to
 		# supply a string which is then expanded, so that the
 		# password can be placed somewhere.  e.g. passed to a
 		# script (exec), or written to SQL (UPDATE/INSERT).
 		# We give both examples here, but only one will be
 		# used.
 		#
 #		local_cpw = "%{exec:/path/to/script %{mschap:User-Name} %{MS-CHAP-New-Cleartext-Password}}"
 		#
 #		local_cpw = "%{sql:UPDATE radcheck set value='%{MS-CHAP-New-NT-Password}' where username='%{SQL-User-Name}' and attribute='NT-Password'}"
 	}
 
 	# For Apple Server, when running on the same machine as
 	# Open Directory.  It has no effect on other systems.
 	#
 #	use_open_directory = yes
 
 	# On failure, set (or not) the MS-CHAP error code saying
 	# "retries allowed".
 #	allow_retry = yes
 
 	# An optional retry message.
 #	retry_msg = "Re-enter (or reset) the password"
 }