Thanks Alan, Sven.<div><br></div><div>SQL server is on the same virtual machine with freeradius. I&#39;m also creating a web application to manage users, certificates, server settings etc - it will be hosted on the same machine.</div>
<div><br></div><div>I just thought that keeping ANY passwords ANYWHERE in plaintext form is not a good idea. But then again, if someone gains access to my server then in fact he could do anything and password would not matter.<br>
<br><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div class="im">
&gt; 2 - Can I hash user passwords if I&#39;m using eap-tls?<br>
&gt; 2a - if I&#39;m using certificates for authentication, do I actually need to<br>
&gt; keep user passwords? Cause it seems that they aren&#39;t used during<br>
&gt; authentication (or I didn&#39;t find that part during debuging)<br>
<br>
</div>If 2a, then no, as the certificate is the only needed credential of a<br>
user/system, no username/password involved.<br><br></blockquote><div><br></div><div>Thats good and bad. </div><div>- Good, cause it simplifies initial implementation a bit.</div><div>- Bad, because I was counting i could do something like double authentication - user/password after cert verification.</div>
<div><br></div><div>But in that case, is there any way to &#39;disable&#39; users key in case i don&#39;t want him to access my network? </div><div>What if I need to generate new user certificate as a replacement to the old one that has been lost/stolen etc?</div>
<div><br></div><div>I can give &#39;Expiration&#39; attribute to the account, but that doesn&#39;t solve the case, as I want to give the same user a new key.</div><div><br></div><div>Any ideas?</div></div></div>