Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using pptpd and pppd on a Debian linux host to provide VPN capabilities to mobile phones. I would like to use my OpenLDAP server for authentication and authorization purposes (instead of keeping users and cleartext passwords in /etc/ppp/chap-secrets). Is that possible?

I have normal unix login working via libpam-ldap, does that help?

I've read some stuff about using FreeRADIUS in between pppd and OpenLDAP, but it sounds to me like overkill.

share|improve this question
up vote 0 down vote accepted

The MSCHAPv2 authentication requires the server to have cleartext passwords. I dont't think you can get around that if your clients are mobile phones - you need certificates for the other strong authentication methods.

I had once a setup pptpd->FreeRADIUS->MySQL running. The pppd has no direct ldap plugin AFAIK, so you absolutely need to employ RADIUS in between. And you need cleartext passwords somewhere - I would not feel that good storing them in LDAP, but it should be possible.

share|improve this answer
Thanks, that clarifies it! I might look into L2TP instead then. – Hank May 3 '11 at 7:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.