rlm_mschap(5)

💅 rlm_mschap(5) — FreeRADIUS Module ✨

Okay so welcome to the group chat for <pink>rlm_mschap</pink> — the manual name is folded in right at the top, bestie. No cap.

✨ NAME ✨

rlm_mschap — FreeRADIUS Module. Iconic. Periodt.

💖 DESCRIPTION 💖

The rlm_mschap module provides MS-CHAP and MS-CHAPv2 authentication support. It's giving auth, but make it Microsoft-flavored.

This module validates a user with MS-CHAP or MS-CHAPv2 authentication. If called in Authorize, it will look for MS-CHAP Challenge/Response attributes in the Acess-Request and adds an Auth-Type attribute set to MS-CHAP in the Config-Items list unless Auth-Type has already set. Yes, that sentence is a whole vibe, but those are the facts.

The module can authenticate the MS-CHAP session via plain-text passwords (User-Password attribute), or NT passwords (NT-Password attribute). The module cannot perform authentication against an NT domain. 🚨 Like, absolutely not, don't ask.

The module also enforces the SMB-Account-Ctrl attribute. See the Samba documentation for the meaning of SMB account control. The module does not read Samba password files. Instead, the fIrlm_passwd module can be used to read a Samba password file, and supply an NT-Password attribute which this module can use.

The main configuration items to be aware of are:

• authtype — this is the string used to set the authtype. Normally it should be left to the default value of MS-CHAP. Leave it on default unless you're feeling chaotic.
• use_mppe — unless this is set to 'no', FreeRADIUS will add MS-CHAP-MPPE-Keys for MS-CHAPv1 and MS-MPPE-Recv-Key/MS-MPPE-Send-Key for MS-CHAPv2. The default is 'yes'.
• require_encryption — if MPPE is enabled, setting this attribute to 'yes' will cause the MS-MPPE-Encryption-Policy attribute to be set to require encryption. The default is 'no'.
• require_strong — if MPPE is enabled, setting this attribute to 'yes' will cause the MS-MPPE-Encryption-Types attribute to be set to require a 128 bit key. The default is 'no'.
• with_ntdomain_hack — Windows clients send User-Name in the form of "DOMAIN\User", but send the challenge/response based only on the User portion. Setting this value to yes enables a work-around for this error. The default is 'no'.

🛠️ CONFIGURATION 🛠️

Here's the configuration layout, copied exactly so you can trust it:

modules {
  ...
  mschap {
     authtype = MS-CHAP
     use_mppe = yes
  }
  ...
}
 ...
authorize {
  ...
  mschap
  ...
}
 ...
authenticate {
  ...
  mschap
  ...
}

🗂️ SECTIONS 🗂️

authorization, authentication

📁 FILES 📁

• /etc/raddb/radiusd.conf

👀 SEE ALSO 👀

• radiusd(8)
• radiusd.conf(5)

👑 AUTHOR 👑

Chris Parker, cparker@segv.org

---

💌 That's the rlm_mschap(5) page, bestie — source/version vibes: FreeRADIUS Module, dated 13 March 2004. Stay slaying, and may your MS-CHAP sessions pass the vibe check. 💅✨