New features were added:
+ LM support to MS-CHAP
+ support  for  SAMBA passwd files. It introduces new files smbpass.c and
  smbpass.h
+ support for MS-CHAPv2. SHA1 digest support was added (sha1.c, sha1.h)
! module is configurable via radiusd.conf and supports instances
! module supports both authorization and authentication. Authorization
  sets authentication to MS-CHAP if any NTLM-related things found.
  During authorization new attributes added to config_items:
         LM-Password - LM-encoded password
         NT-Password - NT-encoded password
         SMB-Account-CTRL - account control flags in SAMBA format
  During  authentication  these  attributes  are  checked  against  data
  provided by NAS.
- RFC 2433 text with MS-CHAPv1 removed. Microsoft attributes are covered
  by RFC 2458, MS-CHAPv2 - RFC 2759. You can obtain them from
  www.rfceditor.org

ZARAZA,
3APA3A@security.nnov.ru

Below is original README by Jay Miller

This is a partial implementation of MS-CHAP for FreeRadius.  The patch
was designed for Cistron-Radius 1.6.4, but the changes to source are
pretty minimal and should work with previous versions.  It is based on
RFC 2433, which is included with this package.

I have tested this successfully using Windows 98 and Windows 2000 with Cisco 
AS5300 terminal servers.  I have not tested it in any other environment, so 
I can't guarantee it's success everywhere.  I also don't have time to do 
much troubleshooting, though I am interested to hear about problems anyone
might have.  If you can fix a problem, then I will incorporate the fix into
the distribution.

Files included:
mschap.c        -   MS-CHAP functions
mschap.h        -   Definitions and prototypes
md4c.c, md4.h   -   RSA Data Security, Inc. MD4 Message-Digest Algorithm
desport.c,
 deskey.c,
 des.h          -   Fast DES by Phil Karn (portable C version)
rfc2433.txt     -   RFC upon which this algorithm is based


ABOUT MS-CHAP

I was driven to write this when a large customer demanded that they be
able to check "Require Encrypted Password" in their Windows Dial-up
Networking.  Testing showed me that, in Windows 2000 at least, this meant
MS-CHAP.  If you want to specify CHAP, then Windows 2000 requires you to
select "Allow unencrypted password". Duh.

MS-CHAP is similar to CHAP.  The NAS creates a challenge string and gives it 
to the client.  The client then uses the password to encrypt the challenge 
and gives it back to the NAS, who then gives them both to Radius.  Radius
performs the same encryption of the challenge string using the locally stored
password, then compares the result to the response from the client.

The difference between MS-CHAP and CHAP is in the encryption method.  CHAP
performs one MD5 hash to get the response.  MS-CHAP first encrypts the password
with MD4.  It then pads the 16-byte hash out to 21 bytes and divides this 
string into 3 parts.  Each 7-byte part is used as a key for a DES encryption
of the challenge string.  The 8-byte results are then concatonated together
into a 24-byte response.

The method just described is called NT-encryption by the RFC.  MS-CHAP is 
actually designed for compatability with Microsoft LAN Manager as well.
The response returned by the client actually contains an LM encrypted
response as well as the NT-encrypted password.  This implementation only
uses the NT-encrypted response, which seems to work fine for Windows 98
and Windows 2000.  The RFC also has a number of other specs for allowing the
user to change password and things like that.  None of that has been 
implemented here.

A useful extension of this would be in the local storage of passwords.
Theoretically you should be able to store the MD4 hash rather than the
plain text password.  Then the algorithm could pick it up at the next
step and still calculate the result.  The trouble is that MD4 produces a
binary hash.  That is, any values from 0 to 255 is a valid byte, and I
don't know how to store this in a users file.  If it can be done, then
we could add a check attribute called "MS-CHAP-Hash" instead of password
and get both an encrypted protocol and encrypted password storage at the
same time (CHAP requires plain text passwords, while Crypt-Pass requires
an unencrypted protocol).

If you find this useful, please send me a note just so I can feel good
about myself.

Jay Miller
Columbia, MO, US
jaymiller@socket.net