MS-CHAPv2 not working

[Alan DeKok]

On Apr 30, 2019, at 7:36 PM, Matthew McTague via Freeradius-Users <freeradius-users at lists.freeradius.org> wrote:
> Does anyone know why MS-CHAPv2 may not be working on a new FreeRADIUS implementation we've built?

  You edited the configuration and broke it.  Don't do that.

> I'm trying to do MS-CHAPv2 with a SQL database, not with LDAP.
> 
> The issue only occurs when a realm is added to the username (on the RADIUS client). As I understand, as nostrip is not entered in the relevant realm block in /etc/raddb/proxy.conf, this should be stripped.

  The MS-CHAP calculations are done with the User-Name.  If you mangle the User-Name, the MS-CHAP calculations will be wrong.

> radiusd -X output is at https://pastebin.com/kK9JYsF0

  Just post it here.  That's what the documentation says to do.

> Information and passwords have been changed / sanitized.

	• rad_recv: Access-Request packet from host 10.11.127.229 port 60421, id=170, length=278
	•     Service-Type = Framed-User
	•     Framed-Protocol = PPP
	•     NAS-Port = 15732821
	•     NAS-Port-Type = Ethernet
	•     User-Name = "testuser at test.net.nz"

  This is the real User-Name.

	• [preprocess]    expand: %{User-Name} -> testuser at test.net.nz
	• [preprocess]   hints: Matched DEFAULT at 36
	• [preprocess]    expand: %{1} -> testuser

  Then you mangle it, for reasons unexplained.

	• [mschap] Creating challenge hash with username: testuser

  Which is not the correct User-Name.

	• [mschap] Client is using MS-CHAPv2 for testuser, we need NT-Password
	• [mschap] FAILED: MS-CHAP2-Response is incorrect

  And MS-CHAP fails.

  Don't re-write the User-Name.  If you need to support realms, the "realms" module does this already.  And, it does it in a way that *doesn't* break everything.

  Delete the "hints" configuration which re-writes the User-Name.

  Add in "test.net.nz" as a local realm to proxy.conf.

  It *will* work.

  Alan DeKok.