Re: Problems with pptp / freeradius / ppp / pam...

Hello!

> I added a user test via adduser test. Then I changed the password to
> testpass.
>
> Ok, cool, now let me try it from my windows xp box and the built in
> vpn client.. doesn't work: In radiusd -X I get:
>   Processing the authenticate section of radiusd.conf
> modcall: entering group authenticate for request 0
> rlm_unix: Attribute "User-Password" is required for authentication.
>   modcall[authenticate]: module "unix" returns invalid for request 0
> modcall: group authenticate returns invalid for request 0
> auth: Failed to validate the user.
>
> And in /var/log/messages I get:
> Apr 15 14:13:39 rickp4a pppd[12286]: Peer test failed CHAP authentication
> (that's the only bad line I see)

This has probably been said a hundred times already: CHAP and one-way crypt=
ed=20
passwords CONCEPTUALLY DO NOT WORK TOGETHER.
This is because none of the two sides has a means to compare the other side=
's=20
input. CHAP computes a one-way hash of the password, which means that the=20
plain-text password cannot be retrieved from it. passwd crypt() (or MD5, fo=
r=20
that matter) does a similar thing, and the password cannot be retrieved=20
either.
So, both ends of the connection end up with incompatible hashes that are no=
t=20
comparable.
That's why at least one side needs a plain-text password. And this is exact=
ly=20
what the radiusd server said:
"rlm_unix: Attribute "User-Password" is required for authentication."
Pretty clear if you understand the workings of CHAP and crypt().

> Here is a snippet from /var/log/messages first that doesn't look right...
> Apr 15 14:27:06 rickp4a pppd[12342]: MPPE required, but keys are not
> available.  Possible plugin problem?
>
> Sending Access-Accept of id 77 to 127.0.0.1:32825
>         Reply-Message =3D "Hello, bob"
>         MS-CHAP2-Success =3D
> 0xa0533d31463232414342304538354230364334363238463030324232323245313645463=
94
>3434143413838

pppd requested keying material (which is usually transferred in attributes=
=20
named like MS-CHAP-MPPE-...), but the server doesn't send any. You could=20
probably fix that (either by turning encryption off or convincing the radiu=
sd=20
server to send the attributes also when plain text authentication ist done)=
,=20
but since the overall process you want to achieve is to use CHAP, there=20
probably is no point in doing so.
Rather use plain-text passwords in your backend, then your original goal of=
=20
using CHAP will work, and the radiusd server can _easily_ be configured to=
=20
send the keying material with CHAP.

> I've been as verbose as possible... any comments/advice is appreciated.

Me too.

Greetings,

Stefan Winter

=2D-=20
Stefan WINTER

=46ondation RESTENA - R=E9seau T=E9l=E9informatique de l'Education National=
e et de=20
la Recherche
Ing=E9nieur r=E9seau et syst=E8me

6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg
email: [email protected] =A0 =A0 t=E9l.: =A0 =A0 =A0+352 424409-33
http://www.restena.lu =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 fax: =A0 =A0 =
=A0+352 422473

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html