Re: Where is info about {KERBEROS} ?

[Adam Williams6 <awilliam@whitemice.org>]

>>This is simply no way of getting the password back, and to be blunt, you
>>don't want there to by any way to do that.
>If you don't allow clear-text passwords back, how do you design a system where
>you have a RADIUS daemon which requires the clear password to do CHAP (not PAP)
>authentication ?

Use M$-CHAPv2.  It is a challenge-response protocol but will work with an 
NT password hash (almost clear text).  If your PDC is samba with 
ldapsam then you simply design the ACL to permist the daemon (radius, ppp, 
whatever) to *read* the ntpassword attribute.   Recent pppd(s) support 
M$-CHAPv3, I don't know anything about radius.  I assume you could dig the 
NT hash out of ADS somehow, but I don't kow anything about ADS.

-- 
-----------------------------------------------------------
Ximian GNOME, Evolution, LTSP, and RedHat Linux + LVM & XFS
-----------------------------------------------------------