Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a Windows Server 2012 Active Directory Infrastructure that consists of two domain controllers. Bound to the Active Directory Domain is a Mac OS X Mavericks Server 10.9.3. The server runs Profile Manager and VPN Services. My Active Directory users are able to authenticate to the Profile Manager, but not the VPN.

I have found several threads on other forums of other users reporting similar issues, here is just one of many references:

It appears as though the issue is related to a CHAP authentication failure.

  • Can anyone suggest what next troubleshooting steps I might take?
  • Is there a way to liberalize the authentication mechanism to include MS-CHAPv2?

Here is an excerpt of the transaction from the logs. Please note the domain has been changed to

Jun 6 15:25:03 vpnd[10317]: Incoming call... Address given to client = Jun 6 15:25:03 pppd[10677]: publish_entry SCDSet() failed: Success! Jun 6 15:25:03 --- last message repeated 2 times --- Jun 6 15:25:03 pppd[10677]: pppd 2.4.2 (Apple version 727.90.1) started by root, uid 0 Jun 6 15:25:03 pppd[10677]: L2TP incoming call in progress from ''... Jun 6 15:25:03 racoon[257]: pfkey DELETE received: ESP[4500]->[4500] spi=25137226(0x17f904a) Jun 6 15:25:04 pppd[10677]: L2TP connection established. Jun 6 15:25:04 profile-manager kernel[0]: ppp0: is now delegating en0 (type 0x6, family 2, sub-family 0) Jun 6 15:25:04 pppd[10677]: Connect: ppp0 <--> socket[34:18] Jun 6 15:25:04 pppd[10677]: CHAP peer authentication failed for alex Jun 6 15:25:04 pppd[10677]: Connection terminated. Jun 6 15:25:04 pppd[10677]: L2TP disconnecting... Jun 6 15:25:04 pppd[10677]: L2TP disconnected Jun 6 15:25:04 vpnd[10317]: --> Client with address = has hung up

share|improve this question

CHAP requires that plaintext password be accessible to the authentication server. Active Directory doesn't store plaintext passwords by default, so CHAP won't work.

It would appear that you can modify the VPN server configuration file ( to use the MS-CHAPv2 authentication protocol. Given the weakness of the protocol I can't really recommend using it. Your only alternatives are EAP with either RSA tokens or Kerberos. Since you've got an Active Directory environment already I think getting your OS X VPN server joined to the domain and attempting to use Kerberos is probably your best bet. (Having said that, though, it's something I have less than no experience with and can't give you any kind of step-by-step direction.)

share|improve this answer
Thanks for the info. The interesting thing is every other OS X Service can be authenticated by AD accounts with no problem. The OS X Server is bound to AD. I inspected the contents of the for the AuthenticatorProtocol key which is indeed set to MSCHAPv2. So I suspect the issue is very specific to the PPP authentication phase. – dean Jun 7 '14 at 2:37
I changed the AuthenticatorProtocol to PAP just for the purpose of systematic fault isolation and it works. EAP however, does not. – dean Jun 7 '14 at 3:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.