Is it possible to use CHAP authentication with pam_radius?

[Dan Swartzendruber]

On 2019-09-26 14:18, Alan DeKok wrote:
> On Sep 26, 2019, at 2:11 PM, Dan Swartzendruber <dswartz at druber.com> 
> wrote:
>> No argument here.  Unfortunately, some of our customers are 
>> anal-retentive and have security compliance audits run, and having 
>> cleartext passwords is going to be problematic.
> 
>   The passwords aren't clear-text.  They're encrypted on the wire.
> Just like PAP.

I thought I had seen criticisms that it the encryption wasn't that 
strong.  Maybe I misunderstood...

>>  I'm wondering if I could tunnel RADIUS over TCP using an ssh tunnel?  
>> This is a very small number of customers who will care, but they have 
>> a disproportionate influence...
> 
>   The pam_radius module doesn't support TCP.
> 
>   If you care, submit a patch so that the pam_radius module does CHAP.
>  It should be ~30 LoC.

I might give that a try, thanks!