MS-Chap is in RFC 2433 (Oct 1998) MS-Chap V2 is in RFC 2759 (Jan 2000) see also Microsoft Specific RADIUS attributes - RFC 2548 (Mar 1999) Dave. ----Original Message---- From: p.mayers@imperial.ac.uk Date: Feb 9, 2007 6:01 To: "FreeRadius users mailing list"<freeradius-users@lists.freeradius. org> Subj: Re: VPN authentication from Windows Vista Lai Fu Keung wrote:

Hi,

My users said the VPN login failed with their Windows Vista.

I enabled freeradius debug. I came across an authentication method, md5chap in debug output that my freeradius is currently not configured

Do you mean "mschap"?

to support. If the user unselects "Require Data Encryption" in VPN. It then works fine.

It uses PAP and sends the password in plaintext (bad idea). Windows has always done that, back to win95.

Can anyone confirm the following questions for me?

1. Is it that Vista uses md5chap for VPN authentication with "Data Encryption"?

Windows has always done that.

2. Can freeradius be configured to support md5chap?

Yes

I don't get a lot of information about md5chap in google. I

appreciate That's because there's no such thing - as I said, I think you mean "mschap" (or "MSCHAP" or "MS-CHAP" whichever they've called it). I don't have a vista box handy, I'll fire up a VM and take a look in a bit.

any pointers on this subject and how freeradius can be made to support it, as radiusd.conf seems no mentioning on this subject.

Thanks.

Lai

- List info/subscribe/unsubscribe? See http://www.freeradius. org/list/users.html

- List info/subscribe/unsubscribe? See http://www.freeradius. org/list/users.html