.TH rlm_mschap 5 "13 March 2004" "" "FreeRADIUS Module".SH NAMErlm_mschap \- FreeRADIUS Module.SH DESCRIPTIONThe \fIrlm_mschap\fP module provides MS-CHAP and MS-CHAPv2authentication support. .PPThis module validates a user with MS-CHAP or MS-CHAPv2 authentication.If called in Authorize, it will look for MS-CHAP Challenge/Responseattributes in the Acess-Request and adds an Auth-Typeattribute set to MS-CHAP in the Config-Items list unless Auth-Type has already set..PPThe module can authenticate the MS-CHAP session via plain-textpasswords (User-Password attribute), or NT passwords (NT-Passwordattribute).  The module cannot perform authentication against an NTdomain..PPThe module also enforces the SMB-Account-Ctrl attribute.  See theSamba documentation for the meaning of SMB account control.  Themodule does not read Samba password files.  Instead, the fIrlm_passwd\fPmodule can be used to read a Samba password file, and supply anNT-Password attribute which this module can use..PPThe main configuration items to be aware of are:.IP authtypeThis is the string used to set the authtype.  Normally it should beleft to the default value of MS-CHAP..IP use_mppeUnless this is set to 'no', FreeRADIUS will add MS-CHAP-MPPE-Keys forMS-CHAPv1 and MS-MPPE-Recv-Key/MS-MPPE-Send-Key for MS-CHAPv2.  Thedefault is 'yes'..IP require_encryptionIf MPPE is enabled, setting this attribute to 'yes' will cause theMS-MPPE-Encryption-Policy attribute to be set to require encryption.The default is 'no'..IP require_strongIf MPPE is enabled, setting this attribute to 'yes' will cause theMS-MPPE-Encryption-Types attribute to be set to require a 128 bit key.The default is 'no'..IP with_ntdomain_hackWindows clients send User-Name in the form of "DOMAIN\\User", but send thechallenge/response based only on the User portion.  Setting this valueto yes, enables a work-around for this error.  The default is 'no'..PP.SH CONFIGURATION.DSmodules {  ....br  mschap {.br	authtype = MS-CHAP.br	use_mppe = yes	.br  }.br  ....br}.br ....brauthorize {  ....br  mschap.br  ....br} ....brauthenticate {  ....br  mschap.br  ....br}.DE.PP.SH SECTIONS.BR authorization,.BR authentication.PP.SH FILES.I /etc/raddb/radiusd.conf.PP.SH "SEE ALSO".BR radiusd (8),.BR radiusd.conf (5).SH AUTHORChris Parker, cparker@segv.org