Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Looking over Cisco's documentation, and RFC 1994 (PPP CHAP authentication), my initial guess is "no", because CHAP requires a cleartext password to rehash every time it sends a challenge.

Is this true? If so, is there another way to configure CHAP so it doesn't use the easily-decoded type 7 passwords?

The Cisco device in question uses local authentication, not a TACACS+ or RADIUS server. Would using RADIUS eliminate the problem or just move it to the RADIUS server?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Indeed, CHAP needs a cleartext password.

Moving authentication to a Radius server would not eliminate the need of cleartext passwords, but at least all passwords would be stored into a central and secured repository.

share|improve this answer
    
Thank you! <4 more characters> –  romandas Jun 22 '11 at 0:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.