Michael Schwartzkopff wrote:
Hi,
If I use OpenLDAP to authorize / authenticate my users, what kinds of passwords can I store in LDAP?
That question is inverted. The Radius auth type defines what data you *need* for that auth type, and thus what crypt you need to store. PAP - needs plaintext, unix crypt, sha crypt, md5 crypt[1] CHAP - needs plaintext MS-CHAP - needs plaintext, nthash, lmhash[2] EAP-PEAP with MS-CHAPv2 inner - as per MS-CHAP[2] If you have the choice, storing "clear" gives you the most options PROVIDED that the radius server has appropriate permissions to extract that cleartext password and provide it to the auth type modules. Howver, note 1. The LDAP module has the ability to provide authentication for PAP requests and ONLY PAP by making an LDAP simple bind against the LDAP server. In this case, the contents of the LDAP crypt are only relevant to the LDAP server BUT you are limited to PAP. 2. MS-CHAP can also be provided by the "ntlm_auth" helper option of the mschap module
clear, crypt, SSHA, SMD5, MD5, SHA, NTHASH, LMHASH?
Is this controlled by the password_header configuation or does this only strip the header of the password?
Is there any difference if use the EAP module?
Yes, it is totally different. EAP negotiates mechanisms. Some of those happen to be the same algorithms as non-EAP radius (e.g. MS-CHAP), others happen to be 2-level mechanisms whose inner is the same algorithm (e.g. EAP-PEAP + MS-CHAP inner, EAP-TTLS + PAP inner) but EAP itself requires no secrets. The negotiated mechanisms do. If you tell us what you're trying to do we may be able to be more helpful