Michael Schwartzkopff wrote:
Hi,
If I use OpenLDAP to authorize / authenticate my users, what kinds of
passwords can I store in LDAP?
That question is inverted. The Radius auth type defines what data you
*need* for that auth type, and thus what crypt you need to store.
PAP - needs plaintext, unix crypt, sha crypt, md5 crypt[1]
CHAP - needs plaintext
MS-CHAP - needs plaintext, nthash, lmhash[2]
EAP-PEAP with MS-CHAPv2 inner - as per MS-CHAP[2]
If you have the choice, storing "clear" gives you the most options
PROVIDED that the radius server has appropriate permissions to extract
that cleartext password and provide it to the auth type modules.
Howver, note
1. The LDAP module has the ability to provide authentication for PAP
requests and ONLY PAP by making an LDAP simple bind against the LDAP
server. In this case, the contents of the LDAP crypt are only relevant
to the LDAP server BUT you are limited to PAP.
2. MS-CHAP can also be provided by the "ntlm_auth" helper option of
the mschap module
clear, crypt, SSHA, SMD5, MD5, SHA, NTHASH, LMHASH?
Is this controlled by the password_header configuation or does this only strip
the header of the password?
Is there any difference if use the EAP module?
Yes, it is totally different. EAP negotiates mechanisms. Some of those
happen to be the same algorithms as non-EAP radius (e.g. MS-CHAP),
others happen to be 2-level mechanisms whose inner is the same algorithm
(e.g. EAP-PEAP + MS-CHAP inner, EAP-TTLS + PAP inner) but EAP itself
requires no secrets. The negotiated mechanisms do.
If you tell us what you're trying to do we may be able to be more helpful
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
