Hi, i have VPN mikrotik server → freeradius → openldap I have plaintext passwords for users in ldap. And all it’s okay. I encrypted users passwords in SSHA and my VPN don’t working Logs from freeradius (5) ldap: Performing search in "ou=people,dc=fusioncore,dc=local" with filter "(uid=scherevko)", scope "sub" (5) ldap: Waiting for search result... (5) ldap: User object found at DN "uid=scherevko,ou=people,dc=fusioncore,dc=local" (5) ldap: Processing user attributes (5) ldap: control:Password-With-Header += '{SSHA}y11iufAi/kWir/t/5npxER+fpUYSroNSr0VM4Q==' rlm_ldap (ldap): Released connection (11) (5) [ldap] = updated (5) [expiration] = noop (5) [logintime] = noop (5) pap: Converted: &control:Password-With-Header -> &control:SSHA1-Password (5) pap: Removing &control:Password-With-Header (5) pap: Normalizing SSHA1-Password from base64 encoding, 40 bytes -> 28 bytes (5) pap: WARNING: Auth-Type already set. Not setting to PAP (5) [pap] = noop (5) } # authorize = updated (5) Found Auth-Type = mschap (5) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (5) authenticate { (5) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (5) mschap: WARNING: No Cleartext-Password configured. Cannot create LM-Password (5) mschap: Creating challenge hash with username: scherevko (5) mschap: Client is using MS-CHAPv2 (5) mschap: ERROR: FAILED: No NT/LM-Password. Cannot perform authentication (5) mschap: ERROR: MS-CHAP2-Response is incorrect (5) [mschap] = reject (5) } # authenticate = reject (5) Failed to authenticate the user (5) Using Post-Auth-Type Reject (5) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (5) Post-Auth-Type REJECT { (5) attr_filter.access_reject: EXPAND %{User-Name} (5) attr_filter.access_reject: --> scherevko (5) attr_filter.access_reject: Matched entry DEFAULT at line 11 (5) [attr_filter.access_reject] = updated (5) [eap] = noop (5) policy remove_reply_message_if_eap { (5) if (&reply:EAP-Message && &reply:Reply-Message) { (5) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (5) else { (5) [noop] = noop (5) } # else = noop (5) } # policy remove_reply_message_if_eap = noop (5) } # Post-Auth-Type REJECT = updated (5) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (5) (5) Discarding duplicate request from client mikrotik_router port 56532 - ID: 31 due to delayed response Waking up in 0.6 seconds. (5) (5) Discarding duplicate request from client mikrotik_router port 56532 - ID: 31 due to delayed response Waking up in 0.3 seconds. (5) Sending delayed response (5) Sent Access-Reject Id 31 from 10.10.2.176:1812 to 10.10.2.1:56532 length 103 (5) MS-CHAP-Error = "\001E=691 R=1 C=359def4fd6e2f6ec8965898ccce170c8 V=3 M=Authentication rejected" Waking up in 3.9 seconds. (5) Cleaning up request packet ID 31 with timestamp +1893 Ready to process requests