Freeradius and 2 Factor Authentication

Aaron Smith Aaron.Smith at
Thu Jun 2 21:44:31 CEST 2016

Well at least I was able to research the issue correctly!  To be clear, I'm not looking to find a way to make MSchapv2 to work.  The end goal is to have a VPN solution that would allow Windows, Mac, and iOS users to connect securely, with a minimum of fuss.  Tall order I know.  :)  I was looking at IKEv2 as it seemed to be supported natively on at least Windows and iOS, but windows clients insisted on using EAP-MSChapv2 for it.  I suspect iOS does the same.  SSTP works great for windows clients (and can do PAP), and I've heard rumors of third party clients for MAC OS, but I'm coming up empty on iOS clients that do SSTP.  OPenVPN is a possible alternative, but the certificate aspect sounds like a management nightmare.

We actually have a commercial OTP solution via SafeNet, but it's a bit long in the tooth and also only supports PAP.  However, I opened a ticket today and their newer versions actually support MSChapv2 so that might be the way to go if converting our token licenses isn't too ridiculous in cost.

Aaron Smith
System Administrator  
Information Services 
Kalamazoo College
1200 Academy Street, Kalamazoo, MI 49006
(269) 337-7496
 Aaron.Smith at

-----Original Message-----
From: Freeradius-Users [ at] On Behalf Of Cornelius Kölbel
Sent: Thursday, June 02, 2016 3:25 PM
To: freeradius-users at
Subject: Re: Freeradius and 2 Factor Authentication

Hi Aaron,

you are right about the hashed password.

The implementations I know use RADIUS with PAP. Yes, that password is transmitted encrypted, so the FreeRADIUS module can decrypt it and forward it to linotp/privacyidea.

With the corresponding effort the mschapv2 protocol could be investigated to enhance the backend functionality.
I say "investigate mschapv2" since I am not even sure if it will work
out: since the server sends a challenge initially which is based on the password hash. And if the server initially picks the wrong password, the client probably will end the authentication handshake.
And even if you manage to achieve this: You still have to store the users password (knowledge, 1st factor) in a decryptable manner.

So the question is if you are more happy with an decryptable password in the user database or with a week encrypted password between the VPN server and the RADIUS server.

Are you using the Windows domain password or a token PIN?

Kind regards

Am Donnerstag, den 02.06.2016, 18:52 +0000 schrieb Aaron Smith:
> Doesn't matter how awesome SecureID is if you don't have the budget for it.  :)    I think the issue stems from an initial misunderstanding (on my part) of authentication in Freeradius.  I was thinking that Freeradius would be able to negotiate MSChapv2 and then give the password that the user supplied to a module or perl script to be authenticated by the OTP server.  I was thinking this because if I configure my windows 7 client to create an IKEv2 tunnel using EAP-MSCHAPv2, it will work just fine with Freeradius and a plain old user in the Users file.  I figured "Well, it can see my password to compare it to THAT, so it must HAVe the password".  After further reading, though, I think what it gets after negotiating MSchapv2 is a hashed password, so it snags the password from the users file, hashes THAT and then compares the hashes.  So it has no way of giving the plain text password to anything at all, thus limiting the types of authentication that will work to those that provide plain text passwords to begin with.  
> -----------------------------------
> Aaron Smith
> System Administrator
> Information Services
> Kalamazoo College
> 1200 Academy Street, Kalamazoo, MI 49006
> (269) 337-7496
>  Aaron.Smith at
> -----Original Message-----
> From: Freeradius-Users [ at] On Behalf Of Arran Cudbard-Bell
> Sent: Thursday, June 02, 2016 2:10 PM
> To: FreeRadius users mailing list
> Subject: Re: Freeradius and 2 Factor Authentication
> > On Jun 2, 2016, at 1:26 PM, Aaron Smith <Aaron.Smith at> wrote:
> > 
> > SecureId is pretty expensive, and it looks like Yubikey is hardware only.
> But awesome.
> >  Our users prefer a software based token.
> Meh.  Honestly, with NFC/USB, using a hardware token is simpler, press the button and it all just works.
> > SMSOtp might work, but although MOST of our users prefer software tokens, we do have some that prefer the hardware KT type tokens.
> You shouldn't have any issues getting it working with Google authenticator.  The only time you have difficulty is when there needs to be more of a conversation.
> >  I've been working on this for a while now, trying a ton of different freeradius permutations and have pretty much decided that it's impossible to use Freeradius
> Sounds like a protocol limitation to me.  So more accurately it's not possible to use RADIUS or EAP authentication with the OTP solutions you're trying because they're fundamentally incompatible?
> -Arran
> -
> List info/subscribe/unsubscribe? See

Cornelius Kölbel
cornelius.koelbel at
+49 151 2960 1417

NetKnights GmbH
Landgraf-Karl-Str. 19, 34131 Kassel, Germany
Tel: +49 561 3166797, Fax: +49 561 3166798

Amtsgericht Kassel, HRB 16405
Geschäftsführer: Cornelius Kölbel

More information about the Freeradius-Users mailing list