Greetings, Trying to get FreeRADIUS 2.1.8 to authenticate VPN users for PfSense's PPTP server. I am having an issue similar to the one in this old list post: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg40632.h.... When I try to log into the VPN from a Windows client, I get the error message: "Error 691: Access was denied because the user name and/or password was invalid on the domain.", but radius logs show "Access-Accept". My major difference is that I am using a LDAP backend which contains NT passwords (it is also the LDAP backend for my samba server). Tried fiddling with mppe and encryption settings in the mschap module, but always get the same results. "freeradius -X" debug below, as always any reply would be great. rad_recv: Access-Request packet from host 192.168.1.55 port 43210, id=116, length=166 NAS-Identifier = "pfsense.local" NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "192.168.1.153" User-Name = "cjohnson" MS-CHAP-Challenge = 0xbc4e68fb2822b769cef9f48f6420925f MS-CHAP2-Response = 0x0100991b81f3bbq3859d8qa75ae826662d8600000000000000009584dde386742b71bc7c72fca79a678ebf1fee00b74a36e2 server vpn { +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [suffix] No '@' in User-Name = "cjohnson", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [ldap] Entering ldap_groupcmp() [vpn] expand: dc=corp,dc=example,dc=com -> dc=corp,dc=example,dc=com [vpn] expand: %{Stripped-User-Name} -> [vpn] ... expanding second conditional [vpn] expand: %{User-Name} -> cjohnson [vpn] expand: (&(objectClass=posixAccount)(uid=%{%{Stripped-User-Name}:-%{User-Name}})) -> (&(objectClass=posixAccount)(uid=cjohnson)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to 192.168.1.99:389, authentication 0 [ldap] bind as cn=admin,dc=corp,dc=example,dc=com/s3cr3t to 192.168.1.99:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in dc=corp,dc=example,dc=com, with filter (&(objectClass=posixAccount)(uid=cjohnson)) [ldap] ldap_release_conn: Release Id: 0 [vpn] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [vpn] ... expanding second conditional [vpn] expand: %{User-Name} -> cjohnson [vpn] expand: (&(objectClass=posixGroup)(memberUid=%{Stripped-User-Name:-%{User-Name}})) -> (&(objectClass=posixGroup)(memberUid=cjohnson)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=corp,dc=example,dc=com, with filter (&(cn=VPN)(&(objectClass=posixGroup)(memberUid=cjohnson))) rlm_ldap::ldap_groupcmp: User found in group VPN [ldap] ldap_release_conn: Release Id: 0 [vpn] users: Matched entry DEFAULT at line 5 ++[vpn] returns ok [ldap] performing user authorization for cjohnson [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> cjohnson [ldap] expand: (&(objectClass=posixAccount)(uid=%{%{Stripped-User-Name}:-%{User-Name}})) -> (&(objectClass=posixAccount)(uid=cjohnson)) [ldap] expand: dc=corp,dc=example,dc=com -> dc=corp,dc=example,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=corp,dc=example,dc=com, with filter (&(objectClass=posixAccount)(uid=cjohnson)) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] sambaNtPassword -> NT-Password == 0x4039323544423042363155514544454138343541433236383039324641284532 [ldap] sambaLmPassword -> LM-Password == 0x3145314444423038343342393233433141414433423444454235313430333545 [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user cjohnson authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing NT-Password from hex encoding [pap] Normalizing LM-Password from hex encoding [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = Accept Auth-Type = Accept, accepting the user expand: Great Success! -> Great Success! Login OK: [cjohnson] (from client 192.168.1.55 port 0 cli 192.168.1.153) Great Success! +- entering group post-auth {...} ++[exec] returns noop } # server vpn Sending Access-Accept of id 116 to 192.168.1.55 port 43210 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 116 with timestamp +23 Ready to process requests. --CJ