Re: (ASCEND) Ethernet -> Answer -> PPP Options -> Recv Auth=PAP

[Mitchell Arnone <mitchell.arnone@occ.treas.gov>]

There are a number of schools of thought on the amount of risk with using 
PAP vs CHAP.  However, Windows clients to suppot PAP but you don't turn it 
on at the client.  If you configure the TNT answer defaults>>PPP-answer to 
PAP-PPP-Auth, the the Windows client will talk PAP.

What happens is that the client will attempt to negotiate a session using 
CHAP and, if that fails, it will try PAP.  To verify this, just configure 
the client to write MSDUN access to a log file and then follow the sequence 
of events.

Mitch
-------------
Original Text
From: "Phillip Vandry" <vandry@mlink.net>, on 6/3/99 9:37 AM:
To: SMTP@DC2@OCC["Cyril Jaouich" <twiggy@twiggy.spider.org>]
Cc: SMTP@DC2@OCC["Shaun Ledford" <shaun@ms.com>], 
SMTP@DC2@OCC[<ascend-users@bungi.com>]

> > The only solution is to disable CHAP.
> 
> 	Well the problem is an M$ problem, non-windows dial-in will be
> okay with Either because they can be set to PAP first, but Microsoft has
> MS-CHAP (a CHAP version) that will be used before the configured
> authentication protocol. AFAIK there is no way to disable MS-CHAP auth in
> windows products, we ran into the same problem with having Cisco ISDN
> CHAP customers and our regular user base (mostly windows).

As much as I hate to agree with Microsoft on any point, I think this
is reasonable. Barring explicit configuration, a client should indeed
select a crypted algorithm (better from its point of view) over a
non crypted one if it's given the choice!

It's the PPP protocol that would have needed a different design, i.e.
some LCP parameters getting negociated after the username is known,
not before.

-Phil
++ Ascend Users Mailing List ++
To unsubscribe:	send unsubscribe to ascend-users-request@bungi.com
To get FAQ'd:	<http://www.nealis.net/ascend/faq>

++ Ascend Users Mailing List ++
To unsubscribe:	send unsubscribe to ascend-users-request@bungi.com
To get FAQ'd:	<http://www.nealis.net/ascend/faq>