pppd PAM use and combining with CHAP/MSCHAP

Question

Managed to successfully configure pppd to use PAM (/etc/pam.d/ppp) for authentication steps (used login option in addition to auth). However, this seems to work only for PAP (require pap, refuse chap).

When switching to require chap/mschap the PAM method no longer works. I just get an error in the log: "User X cannot authenticate with CHAP". Any way to make it work? Because how I understand it, PAP is clear text while (MS)CHAP implementations support challenge/response or encryption methods (hence more secure).

Answer 1

ppp + pam + chap will not work, i'm afraid. normally the app is asking pam "please authenticate username with password " and pam itself handles the way the passwords are stored in the backend (cleartext, encrypted, or whatever). with chap the user's password already comes in in hashed form which cannot be reverted back to cleartext. but this would be required for pam to work...