Encoding for CHAP in config files (for changing password in VSAN Free)

[thx1200]

Hello! Been using VSAN Free and it's working great. I need to change the password for my CHAP authentication. I had successfully changed the admin password before by directly editing the starwind.cfg file using the BASE64 encoding of the MD5 hash as outlined in this topic: viewtopic.php?f=5&t=6001&p=33727&hilit= ... ZDg#p33727. However, the CHAP password does not seem to use the same encoding. I've done several tests by setting a password in a trial version of VSAN (so I can use the GUI) and the encoded password in the starwind.cfg and disk_HA.swdsk does not match a BASE64 of MD5 hash. It's the wrong length and the pattern is completely different.

What encoding does the CHAP password use? Or is there a PowerShell way to set the CHAP password on an existing credential?

Examples (passwords are just test text):

<permission target="" chapLocalName="local1" chapLocalSecret="0bN9tnol7ALzLoh65eIyB4Yw==" chapPeerName="peer1" chapPeerSecret="0b7TOVRKXRvdi3nHt71v8h6w=="/>

<authentication type="MCHAP">
<MCHAP name="peer1" secret="0b7TOVRKXRvdi3nHt71v8h6w=="/>
<CHAP login="local1" passwd="0bN9tnol7ALzLoh65eIyB4Yw=="/>
</authentication>

[yaroslav (staff)]

Try the following path Password string value -> md5 = 128 bit hash in hex format -> from hex value to base64 value.

[thx1200]

Hmm not sure if I follow. I'm using PowerShell. So basically I'm doing this:

$bytes = $utf8.GetBytes($password) # Returns byte array
$hash = $md5.ComputeHash($bytes) # Returns byte array
[Convert]::ToBase64String($hash) # returns string

There isn't really an opportunity to convert any of this into hex representation because the password is just an array of bytes (not a string) until it's ultimately converted back into a string with Base64 encoding. ToBase64String can't take a string as input. I tried forcing it, by converting the hash byte array to a hex string, then that back into another byte array, but that wasn't it either.

Is UTF-8 the right text encoding? I also tried ASCII and UTF-16. Does Starwind pad <16 character passwords to exactly 16 characters? CHAP, I believe, requires 12-16 character length. I'm not sure what happens if you don't use all 16.

[yaroslav (staff)]

I had a word with dev team. You can't set up CHAP through the config files; you can use ACL (https://www.starwindsoftware.com/blog/a ... -it-works/) as a workaround instead.

[thx1200]

Thanks for the info, I'll look more into ACL tonight.

Just FYI, the CHAP config I copied from the trial license instance does indeed work on VSAN free. So whatever that encoding format is, seems to be portable and is honored by VSAN free.

CHAP is kind of old, so the ACL config might be better going forward. Ideally I'd like to use both, for defense in depth.

[yaroslav (staff)]

Good luck with your project!
Thanks for sharing the workaround.