Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Looking over Cisco's documentation, and RFC 1994 (PPP CHAP authentication), my initial guess is "no", because CHAP requires a cleartext password to rehash every time it sends a challenge.

Is this true? If so, is there another way to configure CHAP so it doesn't use the easily-decoded type 7 passwords?

The Cisco device in question uses local authentication, not a TACACS+ or RADIUS server. Would using RADIUS eliminate the problem or just move it to the RADIUS server?

share|improve this question
up vote 1 down vote accepted

Indeed, CHAP needs a cleartext password.

Moving authentication to a Radius server would not eliminate the need of cleartext passwords, but at least all passwords would be stored into a central and secured repository.

share|improve this answer
Thank you! <4 more characters> – romandas Jun 22 '11 at 0:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.