Proxy RADIUS from MSCHAPv1 to MSCHAPv2
Hi! I have a NAS that ONLY support MSCHAPv1 (requiring the Microsoft RADIUS extended attribute MS-CHAP-MPPE-Keys), that need to authenticate with a RADIUS server that ONLY support MSCHAPv2. Can I proxy RADIUS packets through FreeRADIUS and convert MSCHAPv1 <--> MSCHAPv2? To be more specific, is it possible to make the MS-CHAP-MPPE-Keys (v1) from then MS-MPPE-Send-Key (v2)? NAS --- (MSCHAPv1) --- Freeradius --- (MSCHAPv2) --- RADIUS server Thanks! _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/
Franco Pieressa wrote:
Hi! I have a NAS that ONLY support MSCHAPv1 (requiring the Microsoft RADIUS extended attribute MS-CHAP-MPPE-Keys), that need to authenticate with a RADIUS server that ONLY support MSCHAPv2.
This doesn't appear to have anything to do with FreeRADIUS.
Can I proxy RADIUS packets through FreeRADIUS and convert MSCHAPv1 <--> MSCHAPv2? To be more specific, is it possible to make the MS-CHAP-MPPE-Keys (v1) from then MS-MPPE-Send-Key (v2)?
Why not just upgrade your NAS and RADIUS server? They both appear to be substantially broken. And no, I don't think FreeRADIUS supports this. Maybe it's possible, but as this is the first time I've seen anyone ask for it, it's not a high priority. Alan DeKok.
I can't upgrade the NAS nor the RADIUS server :-( What I need to know, is if it's theorically possible to translate the MSCHAPv1 authentication to a MSCHAPv2 authentication? Can the keys and the challenge be converted? Thanks! Regards> Date: Sat, 23 Feb 2008 14:40:02 +0100> From: aland@deployingradius.com> To: freeradius-users@lists.freeradius.org> Subject: Re: Proxy RADIUS from MSCHAPv1 to MSCHAPv2> > Franco Pieressa wrote:> > Hi! I have a NAS that ONLY support MSCHAPv1 (requiring the Microsoft> > RADIUS extended attribute MS-CHAP-MPPE-Keys), that need to authenticate> > with a RADIUS server that ONLY support MSCHAPv2.> > This doesn't appear to have anything to do with FreeRADIUS.> > > Can I proxy RADIUS packets through FreeRADIUS and convert MSCHAPv1 <-->> > MSCHAPv2? To be more specific, is it possible to make the> > MS-CHAP-MPPE-Keys (v1) from then MS-MPPE-Send-Key (v2)?> > Why not just upgrade your NAS and RADIUS server? They both appear to> be substantially broken.> > And no, I don't think FreeRADIUS supports this. Maybe it's possible,> but as this is the first time I've seen anyone ask for it, it's not a> high priority.> > Alan DeKok.> -> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/
Franco Pieressa wrote:
I can't upgrade the NAS nor the RADIUS server :-(
I would suggest trying *really* hard. It's a lot easier to upgrade than to do the impossible.
What I need to know, is if it's theorically possible to translate the MSCHAPv1 authentication to a MSCHAPv2 authentication? Can the keys and the challenge be converted?
No. It's impossible. See above for better suggestions. Hint: using broken software is bad. Use real software that works. Alan DeKok.
participants (2)
-
Alan DeKok -
Franco Pieressa