On 9 Apr 2014, at 20:14, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On 9 Apr 2014, at 20:04, John McCarthy <midactsmystery@gmail.com> wrote:
On 09/04/14 13:38, Phil Mayers wrote:
1. Use MSCHAP which needs NTLMv1
http://wiki.freeradius.org/guide/FreeRADIUS-Active-Directory-Integration-HOW...
in the picture here, is the NTLM traffic from the FreeRADIUS server to the Active Directory server encrypted? if not, can it be?
2. Use TTLS/PAP, and check passwords via Kerberos/LDAP bind.
Is this way recommended? the part about using PAP scares me. (Clear-text password in local configuration file (PAP)) - http://wiki.freeradius.org/glossary/Authentication
It's not in a local configuration file if it's being sent to an AD server.
Hmm do you work for a *.edu? Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2