2008/2/14, A.L.M.Buxey@lboro.ac.uk <A.L.M.Buxey@lboro.ac.uk>:
Hi,
But, I don't understand, how can be shown it if password is encrypted in LDAP and I am using EAP-TTLS, is not the password into the tunnel?. I am using securew2 with PAP from windows clients. Does it mean that password could be sniffed when radius is not running in debug mode??
the server KNOWS the password. therefore it is showing it. thats how it can do the LDAP stuff...it HAS to know the password to make the LDAP attempt successful. the password will always be available in a raw format in the server engine. if you dont like passwords, move to a challenge/response system - eg MSCHAPv2
i wouldnt lose sleep over it. when the server is not running in debug mode, the only way of sniffing the password is via a few changes to the FreeRADIUS source code. in general practice that password is buried in a TTLS tunnel. its not readable by anything other than the RADIUS server. think of the information flow and process.
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Thanks Alan for your explanation, now I've got it. -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -