Freeradius PEAP/MSCHAPv2 against Apple OpenDirectory

Moe D. moenster at
Fri Feb 12 15:35:11 CET 2010

Hello List!


I got a
machine up and running Freeradius 2.1.0 with SSL support to secure a Wireless
LAN. In our school’s network we (have to) use an Apple Mac OS X 10.4 Server
with Samba as the PDC. Samba stores the user information using the
OpenDirectory on the same server – using the NTLM password hashes… so far,
there should be no problem for Freeradius using LDAP to connect to the OD an
retrieve the NTLM hash to authenticate the wireless clients. 


But: The
Apple version of Samba/OD doesn’t store the password hashes in a single
attribute like “ntPassword” but has an attribute authAuthority wherein I can
find the password hash along with other data. 

It looks as


root at schulserver.intern: 



Is there a possibility of modifying the LDAP return value (e.g. by a regex) so
that I only get the hash? I’ve searched the web for over two weeks now, but
haven’t found an answer, that satisfies me.


I know, I
also could use ntlm_auth for authentication, but as far as I can see, I
couldn’t select a user group to be granted access. Either all users that Samba
knows or none. Via LDAP/OP I could select a single group (e.g. named
“WirelessAccess”) that will be successfully granted access to the Wireless. Or
am I mistaken at that point?



Any help
would be greatly appreciated!


Thanks in

Windows 7 - Alles was Du brauchst und noch viel mehr!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <>

More information about the Freeradius-Users mailing list