Re-4: Authentication problems

DISCUSSION Ludovic MARCILLY 2 participants 2 messages Sep 12, 2006 PPP protocol drivers and compressors

lore

Share & tools

lore

Ludovic MARCILLY

author

2006-09-12 12:21 UTC #0 lore raw

Ok. So if i want my client to authenticate with CHAP, i have to put these options in my config file on the client side:

refuse-pap
refuse-eap
refuse-mschap
refuse-mschap-v2

Am i right? I will test it now in order to be sure.

Thanks a lot for your help. I have difficulties to understand the require and refuse options.

-------- Original Message --------

Subject: Re: Re-2: Authentication problems (12-sept.-2006 13:21)
From:    James Carlson <[email protected]>
To:      [email protected]

Quoted 18 lines

Quoted 8 lines · Gilles Espinasse
Quoted 4 lines
So i can't put these options in the config file on the client side? If i understand, he server ask the client for PAP, CHAP or MS-CHAP method to authenticate? The client doesn't choose authentication method? Is it right?
If one authentication is not configured on the client side, pppd will answer
with a nak on the request and could offer another authentication method if available (that the server may or not accept).
"Configured" in this case means that pppd has access to credentials -- a user name and pass phrase or shared secret for a given authentication protocol -- and that it's not told _not_ to use them.
On the authenticatee ("client") side, all that you can do is agree to the peer's request or suggest an alternative; you can't demand to be identified with a given protocol.

Quoted 9 lines

Authentication must work that way. Allowing the authenticatee to specify the means of validation is insecure.
On the other side, if you're setting up a "server," you use the 'require-pap' keyword (note that "+pap" is obsolescent) to say that the peers must use PAP to identify themselves.
Signature · 1 line
James Carlson         42.703N 71.076W         <[email protected]>

To: [email protected]
[email protected]
Cc: [email protected]

James Carlson

2006-09-12 12:27 UTC #1 lore raw

Quoted 8 lines · Ludovic MARCILLY

Ok. So if i want my client to authenticate with CHAP, i have to put these options in my config file on the client side:
refuse-pap
refuse-eap
refuse-mschap
refuse-mschap-v2
Am i right?

No.

If you want to authenticate with CHAP, then just put the right credentials into /etc/ppp/chap-secrets. That's all you need to do. For example, this in the pppd options:

user lmarcilly

and this in the /etc/ppp/chap-secrets file:

lmarcilly * "my pass phrase"

That's it. Those "refuse-*" options are there in case there's some reason you _MUST_ prevent yourself from using those other protocols when available.

They're potential workarounds for unforseen cases. They're not meant to be used in most instances.

In fact, that's true of most of the pppd options. The best configuration *BY FAR* is the one that sets the fewest options. The rest should be left to the default, which is generally chosen to be the most interoperable configuration.

Quoted 3 lines

I will test it now in order to be sure.
And if i just configure authentication on the server? For example, no require-[pap|chap|eap|mschap|mschap-v2] and no refuse-[pap|chap|eap|mschap|mschap-v2] in the config file on the client side but just enable chap on the server side. Will it work?

Yes.

Quoted 2 lines

Thanks a lot for your help. I have difficulties to understand the require and refuse options.

require = server
refuse = client

Signature · 1 line

James Carlson         42.703N 71.076W         <[email protected]>