On Nov 1, 2019, at 6:56 PM, dump@gmx.info wrote:
I'm using freeradius 3 almost in standard config with mysql as storing facility. I have PEAP an EAP active. Usually EAP via TLS or TTLS/PAP is used, because the passphrases could be stored in SHA-1 encryption. PEAP is sometimes necessary for me too but it uses MS-CHAPv2 which needs cleartext-PW. Due to this I would like to restrict authentication vis MS-CHAPv2 and reactivate it when needed.
You can reject authentications that use MS-CHAPv2. But you can't really do much in the way of negotiation via the configuration files.
I would prefer to do it via the radcheck-table for quickly activating and deactivate is easily. I read that it's possible via users-file, but I can't find any useful information/manual to me what to fill into the radcheck tables.
May somebody have the idea or manual I need to follow/read?
The best way to do it is to comment out the "peap" subsection of the "eap" module. The server will then take care of negotiating an EAP type *other* than PEAP. Alan DeKok.