<html>
<head>
<style>
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Verdana
}
</style>
</head>
<body class='hmmessage'>
Alan - <br><br>Thank you. Making the change to the inner-tunnel worked.<br><br>Regards<br>CJ<br><br>> Date: Thu, 13 Nov 2008 08:44:07 +0100<br>> From: aland@deployingradius.com<br>> To: freeradius-users@lists.freeradius.org<br>> Subject: Re: FreeRadius 2.1.1 - OpenLDAP + NT hash + PEAP<br>> <br>> CJ O wrote:<br>> > Good Afternoon -<br>> > <br>> > I've read through a lot of threads and documents and have<br>> > piced information together, however I am still having issues. We are<br>> > running an OpenLDAP with the passwords encrypted. I know that PEAP<br>> > requires the clear text password to be stored in the LDAP Server,<br>> <br>> No. See:<br>> <br>> http://deployingradius.com/documents/protocols/compatibility.html<br>> <br>> > however, I've read also that as long as FreeRadius can get the NTLM<br>> > Password from LDAP PEAP should work.<br>> > <br>> > We have also created a custom attribute call ntPasswd that hold the NTLM<br>> > Hash of the users password. I have configured FreeRadius to authenicate<br>> > to the LDAP server and set the password_attribute = ntPasswd. In the<br>> > ldap.attrmap I've added to entries checkItem LM-Password ntPasswd and<br>> > checkItem NT-Password ntPasswd.<br>> > <br>> > In eap.conf i've set default_eap_type = peap In site-enable/default<br>> > under authorize I've uncommented ldap.<br>> <br>> You need to uncomment it in raddb/sites-enabled/inner-tunnel. See the<br>> debug output. It's running the inner-tunnel method, but LDAP isn't used<br>> there.<br>> <br>> Alan DeKok.<br>> -<br>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html<br></body>
</html>