user/2860: pppd improperly escaping backslashes >Number: 2860
>Category: user
>Synopsis: pppd improperly escaping backslashes
>Confidential: no
net
>Environment:
System : OpenBSD 3.1
Architecture: OpenBSD.i386
Machine : i386
>Description:
In order to properly authenticate using MS-CHAP, given a DOMAIN and a USER, it's recommended by the README.MSCHAP80 file included with the original pppd source that you use the form "DOMAIN\\USER". However, it seems that with the way pppd parses the options and chap-secrets file, this is impossible.
For example, if you set "user" as "FOO\\cwage" with a corresponding entry in chap-secrets, pppd sends the following:
Aug 5 20:20:37 jlo pppd[2913]: sent [CHAP Response id=0x2 <0000000000000000000000000000000000000000000000005550fa9a55381ad33e500b46bbd5fda5e493ed99059f41ae01>, name = "FOO\\\\cwage"]
However, if you set "user" as "FOO\cwage", instead, it sends:
Aug 5 20:21:52 jlo pppd[3764]: sent [CHAP Response id=0x1 <000000000000000000000000000000000000000000000000355cc605fcaa52911f1a95ad7354c74cdcb8cae75294bf8201>, name = "FOOcwage"]
I have tried various combinations of backslashes in order to get the proper behaviour, however nothing seems to be able to yield "FOO\cwage" or "FOO\\cwage", making authentication impossible. I have even tried using \134, and had no luck.
>How-To-Repeat:
Put either: user "FOO\\bar" or name "FOO\\bar" in /etc/ppp/options with a corresponding user and secret in /etc/ppp/chap-secrets.
Initiate a pppd session with something that uses MS-CHAP authentication. I was using "pptp" from the ports tree, to do this, with: /usr/local/sbin/pptp <IP>. With "debug" on in /etc/ppp/options, you can clearly see that pppd sends a username different from that specified in /etc/ppp/options.
>Fix:
Unknown. I suspect the code in options.c:
http://www.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/pppd/options.c , however I am not proficient enough with C to troubleshoot it effectively.
>Release-Note:
Received on Thu Nov 7 15:48:39 2002
This archive was generated by hypermail 2.1.8
: Wed Aug 23 2006 - 13:29:36 EDT
|