FreeRADIUS MSCHAPv2 compatibility

baba

Hi i've set up a FreeRADIUS server with OpenLDAP in a docker compose environment for wifi authentication. Nebula uses MSCHAPv2, which only supports cleartext passwords or nt hashes, which are insecure. What's the best solution to use FreeRADIUS with an user directory like OpenLDAP.

//EDIT: Have a look at http://deployingradius.com/documents/protocols/compatibility.html

Thanks!

Zyxel_HsinBo

Hi, @baba

 

Nebula use PEAP with EAP-MSCHAPv2, which would be secure as the MSCHAPv2 messages are sent through a TLS-protected tunnel.

And Nebula only supports an external RADIUS server to authenticate for now, LDAP server would be unable to work.

 

If you're interested, the below FAQ is tip to set up 802.1x authentication with an external radius server on Nebula:

[NEBULA] How to configure the AP Security with WPA2 Enterprise with external server? — Zyxel Community

Thank you.