CHAP Authentication Doesn’t Work Correctly
If PAP authentication works normally,
but
users authenticating with the CHAP protocol receive errors and
denials, you do not have plain text passwords in the users file. CHAP
requires this, while PAP can take passwords from the system or from
any other source. For each user who needs CHAP authentication, you
must add the Password = changeme check item to his
individual entry, of course changing the value of the password as
appropriate.
Some people may say using CHAP is much more secure, since the user passwords are not transmitted in plain text over the connection between the user and the NAS. This is simply not true in practice. While hiding the password during transmission is beneficial, the CHAP protocol requires you to leave plain text passwords sitting in a file on a server, completely unencrypted. Obviously, it’s much more likely that a cracker will gain access to your RADIUS server, grab the users file with all of these plainly available passwords, and wreak havoc and harm on your network than it is that the same cracker would intercept one user’s password during the establishment of the connection.