Re: Radius authentication and storing passwords in cleartext

To: Eric Bourkland <eric.bourkland@trustedconcepts.com>

Subject: Re: Radius authentication and storing passwords in cleartext

From: Matt Kassawara <battery@writeme.com>

Date: Fri, 24 Jul 2009 08:19:23 -0600

Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:sender:received:in-reply-to :references:date:x-google-sender-auth:message-id:subject:from:to:cc :content-type; bh=v8hnaI8Dyqs6/Qeq2M1D4ZRZ60nvQ2+7khsHTYfQOvw=; b=I18P1Xz6sLMpXZXGmdJ0Q054NTwKM5KdVyMoXx8ADgFsIGIbb7nGjSmnQXkp6Yjtcz uDCnSiIW6Lp4wXP1JOLYGk21VBHeqjBj1kNas5tB2Qbf0YetViSGTFl6kXt07RWIbQBK Jjeb2SSDZniGtadqglIfV/Hh3ExdAKI6U//h8=

Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type; b=S9jpDFPEkKyGMGXJVIJ5VpuG/xgpmBZ1Aec329VnV5d2V73/0xTOY0CHR7VfDa87gO ViOfpOerTtR0iC/UY2qunOo/56dUDyTnYPH7FamNEDs7Wzh4GdDIBWCOzPhG8e3jRNnI ahRzBjun7JWEBg6vyEhSdAJMbVBJK9qYcGu+o=

In-reply-to: <284134.15731248376428007.JavaMail.root@tci01.managed.contegix.com>

References: <284134.15731248376428007.JavaMail.root@tci01.managed.contegix.com>

Using slapd.conf... password-hash {CLEARTEXT}

Using cn=config... olcPasswordHash {CLEARTEXT}

See the slapd.conf manual for details.

On Thu, Jul 23, 2009 at 1:13 PM, Eric Bourkland <eric.bourkland@trustedconcepts.com> wrote:

I have zimbra openLDAP v2.3.43 running on RHEL4.7 ES and I am trying to connect our freeRadius server to authenitcate against LDAP. I have also being trying to stand up plane openLDAP v2.4.17 to see if I can get that to work.
Free Radius requires PEAP/CHAPv2 to authenticate, which means it needs to be handed a clear text password in order to work. Yes, I know in general this is not a good idea.
How can I configure openLDAP to store passwords (userpassword attribute) in cleartext.
Or at the very least create a script that will be able to take the encrypted password and store it in cleartext as another attribute.

Thanks,