rlm_mschap(5) [centos man page]
rlm_mschap(5) FreeRADIUS Module rlm_mschap(5) NAME
rlm_mschap - FreeRADIUS Module DESCRIPTION
The rlm_mschap module provides MS-CHAP and MS-CHAPv2 authentication support. This module validates a user with MS-CHAP or MS-CHAPv2 authentication. If called in Authorize, it will look for MS-CHAP Challenge/Response attributes in the Acess-Request and adds an Auth-Type attribute set to MS-CHAP in the Config-Items list unless Auth-Type has already set. The module can authenticate the MS-CHAP session via plain-text passwords (User-Password attribute), or NT passwords (NT-Password attribute). The module cannot perform authentication against an NT domain. The module also enforces the SMB-Account-Ctrl attribute. See the Samba documentation for the meaning of SMB account control. The module does not read Samba password files. Instead, the fIrlm_passwd module can be used to read a Samba password file, and supply an NT-Password attribute which this module can use. The main configuration items to be aware of are: authtype This is the string used to set the authtype. Normally it should be left to the default value of MS-CHAP. use_mppe Unless this is set to 'no', FreeRADIUS will add MS-CHAP-MPPE-Keys for MS-CHAPv1 and MS-MPPE-Recv-Key/MS-MPPE-Send-Key for MS-CHAPv2. The default is 'yes'. require_encryption If MPPE is enabled, setting this attribute to 'yes' will cause the MS-MPPE-Encryption-Policy attribute to be set to require encryp- tion. The default is 'no'. require_strong If MPPE is enabled, setting this attribute to 'yes' will cause the MS-MPPE-Encryption-Types attribute to be set to require a 128 bit key. The default is 'no'. with_ntdomain_hack Windows clients send User-Name in the form of "DOMAINUser", but send the challenge/response based only on the User portion. Set- ting this value to yes, enables a work-around for this error. The default is 'no'. CONFIGURATION
modules { ... mschap { authtype = MS-CHAP use_mppe = yes } ... } ... authorize { ... mschap ... } ... authenticate { ... mschap ... } SECTIONS
authorization, authentication FILES
/etc/raddb/radiusd.conf SEE ALSO
radiusd(8), radiusd.conf(5) AUTHOR
Chris Parker, cparker@segv.org 13 March 2004 rlm_mschap(5)
Check Out this Related Man Page
rlm_files(5) FreeRADIUS Module rlm_files(5) NAME
rlm_files - FreeRADIUS Module DESCRIPTION
The rlm_files module uses the 'users' file for accessing authorization information for users. Additionally, it supports a 'users' file syntax to be applied to the accounting and pre-proxy sections. The main configuration items to be aware of are: usersfile The filename of the 'users' file, which is parsed during the authorization stage of this module. acctusersfile The filename of the 'users' file, which is parsed during the accounting stage of this module. preproxy_usersfile The filename of the 'users' file, which is parsed during the pre_proxy stage of this module. compat This option allows FreeRADIUS to parse an old style Cistron syntax. The default is 'no'. If you need to parse an old style Cistron file, set this option to 'cistron'. key This option lets you set the attribute to use as a key to find entries. The default is "%{Stripped-User-Name:-%{User-Name}}". Note that the key MUST supply real data. Dynamic attributes like "Group" will not work, because the "Group" attribute can only be used as a comparison, to see if a user is in a Unix group. It will not return the name of the Unix group that a user is in. If you want to use groups as a key, see the rlm_passed, which will create a real attribute that contains the group name. This configuration entry enables you to have configurations that perform per-group checks, and return per-group attributes, where the group membership is dynamically defined by a previous module. It also lets you do things like key off of attributes in the reply, and express policies like like "when I send replies containing attribute FOO with value BAR, do more checks, and maybe send additional attributes". CONFIGURATION
modules { ... stuff here ... files { usersfile = %{confdir}/users acctusersfile = %{confdir}/acct_users preproxy_usersfile = %{confdir}/preproxy_users compat = no key = %{Stripped-User-Name:-%{User-Name}} } ... stuff here ... } SECTIONS
authorization, accounting, pre_proxy FILES
/etc/raddb/radiusd.conf, /etc/raddb/users, /etc/raddb/acct_users, /etc/raddb/preproxy_users SEE ALSO
radiusd(8), radiusd.conf(5), users(5) AUTHORS
Chris Parker, cparker@segv.org 5 February 2004 rlm_files(5)