Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using pptpd and pppd on a Debian linux host to provide VPN capabilities to mobile phones. I would like to use my OpenLDAP server for authentication and authorization purposes (instead of keeping users and cleartext passwords in /etc/ppp/chap-secrets). Is that possible?

I have normal unix login working via libpam-ldap, does that help?

I've read some stuff about using FreeRADIUS in between pppd and OpenLDAP, but it sounds to me like overkill.

share|improve this question
up vote 0 down vote accepted

The MSCHAPv2 authentication requires the server to have cleartext passwords. I dont't think you can get around that if your clients are mobile phones - you need certificates for the other strong authentication methods.

I had once a setup pptpd->FreeRADIUS->MySQL running. The pppd has no direct ldap plugin AFAIK, so you absolutely need to employ RADIUS in between. And you need cleartext passwords somewhere - I would not feel that good storing them in LDAP, but it should be possible.

share|improve this answer
    
Thanks, that clarifies it! I might look into L2TP instead then. – Hank May 3 '11 at 7:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .