I realized I had a perfectly serviceable smbpassword file mirroring /etc/shaddow and that seems to work just fine with MS-CHAP. Now, my setup still doesn't *work*, but the debug output from radius sure looks like it's accepting the username & password and sending back an OK. So I think I have radius configured correctly.
You have.
If someone could confirm that, I'd really appreciate it. Then I can move on to figuring out whether my client or my AP is the sticking point.
Well, you are using 1.1.3. It's known not to work with Vista, XP SP3 and probably more supplicants. You should upgrade to current version (follow RedHat FAQ).
Sending Access-Accept of id 0 to 192.168.1.253 port 2048 MS-MPPE-Recv-Key = 0xa1836258d98b7a77c6cf4a84b7866f22 MS-MPPE-Send-Key = 0x541b00b14300752de69272f2e8d0f196 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Recv-Key = 0x8083917dfae797d7a33df37fa99c2f8f295c1b48a600bc86a486b05027c33515 MS-MPPE-Send-Key = 0x9f7031c562af44e884a67d8d14ef36df9008de8b7bc2f01b06ab9dd2e8a46c93 EAP-Message = 0x03030004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "andy"
Only thing that looks wrong here are two sets of MPPE keys. Debug the supplicant and see if that's breaking things. Ivan Kalik