Linking mikrotik hotspot to freeradius using CHAP

I’m trying to setup CHAP authentification on our free radius server. By default, it is using PAP which for our purpose is highly inefficient. We are connecting to the server via a mikrotik router which has http-chap enabled that pases through chap id and challenge data to a external hotspor URL. Plaintext data is passed fine using PAP, however whenever chap is selected on the microtik router, the freeradius server doesn’t achnowledge any login requests when set to debug mode. After reading up freeradius doccumentation, it notes how CHAP works which i understand, however i can’t find how it is configured.

If someone could assist in showing me where CHAP needs to be enabled that would be great. In the default mikrotik php login form, a javascript method shown below handles the CHAP authentification from an external hotspot.

<form name="sendin" action="<?php echo $_SESSION['linkloginonly']; ?>" 

    method="post">
            <input type="hidden" name="username" />
            <input type="hidden" name="password" />
            <input type="hidden" name="dst" value="<?php echo $_SESSION['linkorig']; ?>" />
            <input type="hidden" name="popup" value="true" />
        </form>

        <script type="text/javascript" src="./md5.js"></script>
        <script type="text/javascript">
        <!--
            function doLogin() {
                    <?php if(strlen($_SESSION['chapid']) < 1) echo "return true;\n"; ?>
            document.sendin.username.value = document.login.username.value;
            document.sendin.password.value = hexMD5('<?php echo $chapid; ?>' + document.login.password.value + '<?php echo $_SESSION['chapchallenge']; ?>');
            document.sendin.submit();
            return false;
            }

Are your passwords stored as cleartext or as hashes?
Because of how it works, CHAP requires your database to store cleartext passwords (or I suppose reversible encryption which is kind of silly for such an application)

My $0.02’s worth:

Honestly, I don’t like CHAP because in my opinion, it’s a bigger risk that the password database is compromised and the users’ information is stolen. With PAP, the token is encrypted between the NAS and the RADIUS server, and you can encrypt the user ↔ NAS channel also. CHAP’s model is to distrust the comms between the user/NAS and to distrust the NAS…

So - vulnerability to packet sniffing vs. vulnerability of the entire vault of user data - which one is a more tempting target?

I prefer to store hashes and use PAP.

(And if your password store is Active Directory, then you have no option to use CHAP because that’s definitely storing hashes)