MPPE with PPTP - external module
Hi, I'm using multiotp with freeradius for VPN. Since multiotp supports CHAP/MSCHAP, I have the AuthType set to multiotp. The multiotp module has the following: exec multiotp { wait = yes input_pairs = request output_pairs = reply program = "/path/to/multiotp.php %{User-Name} %{User-Password} -src=%{Packet-Src-IP-Address} -chap-challenge=%{CHAP-Challenge} -chap-password=%{CHAP-Password} -ms-chap-challenge=%{MS-CHAP-Challenge} -ms-chap-response=%{MS-CHAP-Response} -ms-chap2-response=%{MS-CHAP2-Response}" shell_escape = yes } VPN works fine with CHAP & MSCHAP with multiotp. The trouble is encryption (PPTP with MPPE). When encryption is selected by the user, VPN fails. The problem is that radius will not send the required MPPE responses(MS-MPPE-Recv-Key, MS-MPPE-Send-Key etc.) to NAS. I note that mschap module has options like use_mppe, require_encryption etc.. How can I get radius to send those when I'm using multiotp module to perform chap/mschap so that PPTP with MPPE works? Thanks.
P K wrote:
VPN works fine with CHAP & MSCHAP with multiotp. The trouble is encryption (PPTP with MPPE). When encryption is selected by the user, VPN fails. The problem is that radius will not send the required MPPE responses(MS-MPPE-Recv-Key, MS-MPPE-Send-Key etc.) to NAS.
Because the multiotp program isn't supplying them to FreeRADIUS.
I note that mschap module has options like use_mppe, require_encryption etc.. How can I get radius to send those when I'm using multiotp module to perform chap/mschap so that PPTP with MPPE works?
Make the multiotp program supply them to FreeRADIUS. The keys are derived from the NT-Password, and the MS-CHAP information. Since FreeRADIUS doesn't have the NT-Password, it can't derive the keys. Alan DeKok.
participants (2)
-
Alan DeKok -
P K