MS-CHAP: what password backends can be used?

[Alan DeKok]

Alain Fauconnet <alain at ait.ac.th> wrote:
> Then I must have missed it. I probably have searched for the wrong
> keywords... yes, I see now in the FAQ, I should have searched for
> "chap" and not "ms-chap" or "mschap". Sorry.

  You're not the first person to ask this question.  Google should
return a *lot* of answers.

> This PPTP so encryption is MPPE.
> When you configure a Windows client for a VPN (PPTP)
> connection, if you enable encryption and allow anything but MS-CHAP
> and MS-CHAP-V2, it says that if anything else is used (such as PAP),
> encryption will be disabled.

  Ah.  That would appear to be definitive, then.

> Well, I've inherited this installation and the Radius service is used
> for a dozen different things so I have to be very careful not to break
> anything. Anyway why is PAM so evil by itself?

  I've been working with PAM for many years.  I've never liked it.

  If nothing else, PAM isnt designed to be used in the way that
FreeRADIUS is using it: one process doing many PAM authentications.
It's meant to be used by "login", and similar programs.  We've had
problems in the past with PAM because of this.

> OK, assuming I have a smbpasswd format file somewhere (not the case
> now), I should configure the mschap *and* passwd modules,
> uncommenting out:

  Yes.

  Alan DeKok.