PEAP / mschapv2 Error Messages

[Alan Buxey]

Hi,
> Hi,
> Using the default eap/peap & inner-tunnel configuration, a failure gives rise to
> this:
> 
> Exec-Program output: Logon failure (0xc000006d) 
> Exec-Program-Wait: plaintext: Logon failure (0xc000006d) 
> Exec-Program: returned: 1
> [mschap] External script failed.
> [mschap] FAILED: MS-CHAP2-Response is incorrect
> ++[mschap] returns reject
> [eap] Freeing handler
> ++[eap] returns reject
> Failed to authenticate the user.
> } # server inner-tunnel
> [peap] Got tunneled reply code 3
> 	MS-CHAP-Error = "\nE=691 R=1"
> 	EAP-Message = 0x040a0004
> 	Message-Authenticator = 0x00000000000000000000000000000000
> [peap] Got tunneled reply RADIUS code 3
> 	MS-CHAP-Error = "\nE=691 R=1"
> 	EAP-Message = 0x040a0004
> 	Message-Authenticator = 0x00000000000000000000000000000000
> [peap] Tunneled authentication was rejected.
> [peap] FAILURE
> ++[eap] returns handled
> 
> How can I take that MS-Chap-Error attribute and pass it back in the final
> access-reject, as a Reply-Message attribute for example.

unlang? set a variable to the value of MS-CHAP-Error and then set the Reply-Message
to be some text with that variable in it.

alternatively you could probably call PERL pr pythin etc at the right time and
do the required variable and reply-message settings with those languages instead

however....by sending such messages the remote user knows the reason for failure
eg incorrect password but a successful user...and could bruteforce

alan