I have a RADIUS server with a custom authentication method. I have a Mysql-Database with passwords of a Django CMS which are hashed in PBKDF2_SHA256, so I had to write a custom authentication script. My RADIUS auth sections looks like the following:

authorize {
    update control {
         Auth-Type := `/usr/bin/php -f /usr/djangologin/cpauth.php %{User-Name} %{User-Password}`

The script checks the password with the python passlib return true or false and so the RADIUS returns Access-Accept or Accept-Reject.

Now I have to set up an LDAP-server because one of our new software (Ulteo) does not support RADIUS authentication.

I have never worked with LDAP before. Before I try to reach the impossible, this are my main questions:

1. I did not found out, how passwords are stored exactly. How are they encrypted? I know that they are stored in /etc/shadow. Are they encrypted in MD5 or SHA256/512?
2. Is it possible to use the RADIUS as an authentication method for the LDAP-server? E.g. the User wants to authenticate against the LDAP server. The LDAP server looks for the username and pass it though the RADIUS. On success, the RADIUS returns Access-Accept and the LDAP-server confirms the successful login.
3. If 2. is not possible: Is there a way to create a custom authentication method like I created it for the RADIUS? Is there a better way to archieve my goal?

Thank you!

  • I found out there is a pbkdf2-sha[1|256|512] plugin on github: github.com/hamano/openldap-pbkdf2 But I cannot install the plugin since I do not find the OPENLDAP_BUILD_DIR. I searched for the subfolder "slapd-modules" but got an empty result. May anyone help me installing the plugin?
    – Drudge
    Jan 11 '15 at 17:05

In most LDAP servers, the password is stored in the directory the server is hosting. I think it would be easiest to store the passwords in LDAP and authenticate RADIUS and everything else against LDAP. However, e.g. OpenLDAP supports SASL, so you can authenticate LDAP against something else, typically Kerberos.

  • Thanks for your reply. I agree that it would be easier to use the LDAP as the primary source for the user management. I support a conference which takes places 4 days each year. We have a webspace where the user can register theirselves and this is stored in a Django database. The passwords there are stored in pbkdf2_sha256. Because we only power up our servers at the conference for one week (RADIUS, firewall, captive portal, storage,...) it is not possible for us to use a 24/7 reachable LDAP server. Our webspace does not allow an LDAP server. That's why I need a solution for the problem above
    – Drudge
    Jan 11 '15 at 18:38
  • I have a python script for the RADIUS that takes the provided username and hashed pkbdf2_sha256 password and returns true or false for the login. Is it possible to integrate this script somehow in the LDAP authentication routine?
    – Drudge
    Jan 11 '15 at 18:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.