Re: Windows IPSec/L2TP VPN client and Linux server with RADIUS, and PPP.
Phil sent me his dictionary files and the radiusclient.conf file.
I compared the files to mine.
I kept my radiusclient.conf and dictionary file and used Phil's
This file is in a different format to the one supplied with freeradius.
I had tried that format before, but what I was doing wrong was:
When it should have been:
I got the "$INCLUDE" directive by the following comment in the top of
the dictionary.ascend file included in the radiusclient1 Debian package:
# Ascend dictionary.
# Enable by putting the line "$INCLUDE dictionary.ascend" into
# the main dictionary file.
# Version: 1.00 21-Jul-1997 Jens Glaser <email@example.com>
Also after doing more testing it is very important to include the full
path to the dictionary file in the INCLUDE directive.
Just having "INCLUDE dictionary.microsoft" does not work.
So that comment is wrong on so many levels...
Talk about mis-information!
I'm still not sure why it didn't work in the past when I copied the
contents of the dictionary.microsoft file directly into the main
dictionary file, but I guess there must have been some mistake I made
since I manually generated that file by modifying the freeradius one.
Testing by inlining this good file still works (but I won't be doing
that, I just wanted to satisfy my curiousity).
I'll do more comparisons to the various dictionary.microsoft files
and if I find anything I'll post just to add some completion to this
topic if anyone else is searching in the future.
Also, once the correct strings were coming into RADIUS, the VPN still
Even though the radius log said:
rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = MS-CHAP'
modcall[authorize]: module "mschap" returns ok for request 16
Later on it still failed saying:
modcall: group authorize returns ok for request 8
rad_check_password: Found Auth-Type Local
auth: type Local
auth: No User-Password or CHAP-Password attribute in the request
auth: Failed to validate the user.
I had to delete the entries from the MySQL database that set
Auth-Type = Local
So basically I just truncated the radgroupcheck and usergroup tables
again since they are unnecessary.
Now it works for PAP, CHAP, MS-CHAP, and MS-CHAPv2.
So I re-enabled the following directives in the /etc/ppp/options.l2tpd
file to only allow MS-CHAPv2:
Note that it also works if I enable require-mppe, but I'm not really
interested in the extra overhead this produces for no gain that I can
Thanks for your help everybody.