NTLMv2 with FreeRADIUS

[Arran Cudbard-Bell]

On 9 Apr 2014, at 20:04, John McCarthy <midactsmystery at gmail.com> wrote:

> On 09/04/14 13:38, Phil Mayers  wrote:
> > 1. Use MSCHAP which needs NTLMv1
> 
> http://wiki.freeradius.org/guide/FreeRADIUS-Active-Directory-Integration-HOWTO
> 
> in the picture here, is the NTLM traffic from the FreeRADIUS server to the Active Directory server encrypted? if not, can it be?
> 
> > 2. Use TTLS/PAP, and check passwords via Kerberos/LDAP bind. 
> 
> Is this way recommended? the part about using PAP scares me. (Clear-text password in local configuration file (PAP)) - http://wiki.freeradius.org/glossary/Authentication

It's not in a local configuration file if it's being sent to an AD server.

Arran Cudbard-Bell <a.cudbardb at freeradius.org>
FreeRADIUS Development Team

FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 881 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://lists.freeradius.org/mailman/private/freeradius-users/attachments/20140409/f6572968/attachment.pgp>