freeradius-1.1.1 + mschap + ldap with encrypted password
Hi all, I've configured freeradius-1.1.1 to do eap-tls and peap to authenticate windows wireless users against an ldap. The problem now is that I have to authenticate doing peap against an ldap which has userpassword encrypted ( and is a point that I can't change unless it is impossible to do ). I know that when I'm using peap what I finally use is mschapv2 and that this protocol makes a challenge ( with username, password and somestuff ) that the user must response. As my ldap-user-passwords are encrypted and microsoft clients make the response with a clear-test password, it couldn't work. At least that's what I've understood ( and my knowledge about this is very limited, so correct me if I'm wrong ). My question is if there is anyway to make it work configuring ntlm_auth ? Thanks in advance.
wekz wrote:
The problem now is that I have to authenticate doing peap against an ldap which has userpassword encrypted ( and is a point that I can't change unless it is impossible to do ).
Unless your password is encrypted as an NT or LM hash, it's impossible. If your "LDAP server" is an AD server, it's impossible.
correct me if I'm wrong ). My question is if there is anyway to make it work configuring ntlm_auth ?
If you have a domain controller, you can indeed use ntlm_auth - merely install samba, configure it, join the domain and uncomment the ntlm_auth line in the "mschap" module, modifying the configuration (CAREFULLY!) if need be.
Ok that's what I imagined. There's no domain controller involved and no AD so I can't use peap. Maybe pap. Thanks Phil. 2006/8/2, Phil Mayers <p.mayers@imperial.ac.uk >:
wekz wrote:
The problem now is that I have to authenticate doing peap against an ldap which has userpassword encrypted ( and is a point that I can't change unless it is impossible to do ).
Unless your password is encrypted as an NT or LM hash, it's impossible. If your "LDAP server" is an AD server, it's impossible.
correct me if I'm wrong ). My question is if there is anyway to make it work configuring ntlm_auth ?
If you have a domain controller, you can indeed use ntlm_auth - merely install samba, configure it, join the domain and uncomment the ntlm_auth line in the "mschap" module, modifying the configuration (CAREFULLY!) if need be. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Phil Mayers -
wekz