radiusplugin-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Radiusplugin-devel] MSCHAPv2 support?


From: Evgheni Dereveanchin
Subject: Re: [Radiusplugin-devel] MSCHAPv2 support?
Date: Mon, 29 Apr 2013 23:15:41 +0300

Hi Alexandre,

 

Both the server and client have to support the algorithm. The server sends out a salt, the client hashes the password using this salt and then sends the hash to the server. The server in turn verifies the hash.

 

In our case, the plugin has to take care of that. Neither the OpenVPN server nor the client need to know how the password was verified.

 

All mainstream RADIUS servers have support for MSCHAPv2, as well as some other safe authentication algorithms.

 

Regards,

Evgheni

From: Alexandre [mailto:address@hidden]
Sent
: 29 April 2013 22:57
To: Evgheni Dereveanchin
Subject: Re: [Radiusplugin-devel] MSCHAPv2 support?

 

Well as far as understand it it is the radius server who has to handle it not radius plugin.

On 29 Apr 2013 20:54, "Evgheni Dereveanchin" <address@hidden> wrote:

Hi list,

 

Did anyone here try to add MSCHAPv2 support to the plugin? Would be nice. This auth protocol is not very secure, but still better than sending plaintext back and forth J

 

I’ve found a reference C++ implementation in Public Domain. It is windows-based, but probably can be adapted to our needs:

http://www.codeguru.com/cpp/cpp/algorithms/checksum/article.php/c11445/Computing-a-MSCHAPv2-Client-Response.htm

I’d love it if someone could integrate this code into the plugin.

 

By the way, can someone from the maintainers of the project please advise me on the mode of development? I’d love to see patches from this list in the upstream repos. Have seen IPv6 support and other cool features that can be used by lots of people. Also, I’d like to discuss how sending client-side routes can be implemented more cleanly. Currently I just use a patch that interprets the Framed-Route attribute as external routes and pushes them to clients, but it would be better to support both at once. Let’s agree on a Vendor-Specific attribute that can be used for sending such routes.

 

Regards,

Evgheni

 


The information in this email is confidential and may be legally privileged. It is intended solely for the addressee. Any opinions expressed are mine and do not necessarily represent the opinions of the Company. Emails are susceptible to interference. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is strictly prohibited and may be unlawful. If you have received this message in error, do not open any attachments but please notify the EndavaIT Support Service Desk on (+44 (0)870 423 0187), and delete this message from your system. The sender accepts no responsibility for information, errors or omissions in this email, or for its use or misuse, or for any act committed or omitted in connection with this communication. If in doubt, please verify the authenticity of the contents with the sender. Please rely on your own virus checkers as no responsibility is taken by the sender for any damage rising out of any bug or virus infection.

Endava Limited is a company registered in England under company number 5722669 whose registered office is at 125 Old Broad Street, London, EC2N 1AR, United Kingdom. Endava Limited is the Endava group holding company and does not provide any services to clients. Each of Endava Limited and its subsidiaries is a separate legal entity and has no liability for another such entity's acts or omissions. Please refer to the “Legal” section on our website for a list of legal entities.


_______________________________________________
Radiusplugin-devel mailing list
address@hidden
https://lists.nongnu.org/mailman/listinfo/radiusplugin-devel


reply via email to

[Prev in Thread] Current Thread [Next in Thread]