embedaddon/mpd/doc/mpd66.html - view

File: [ELWIX - Embedded LightWeight unIX -] / embedaddon / mpd / doc / mpd66.html
Revision 1.1.1.3 (vendor branch): download - view: text, annotated - select for diffs - revision graph
Tue Nov 1 09:56:12 2016 UTC (7 years, 8 months ago) by misho
Branches: mpd, MAIN
CVS tags: v5_8p7, v5_8p1_cross, v5_8p1, v5_8, HEAD

mpd 5.8

1: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 3.2 Final//EN"> 2: <HTML> 3: <HEAD> 4: <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"> 5: <TITLE>Authentication</TITLE> 6: </HEAD> 7: <BODY text="#000000" bgcolor="#ffffff"> 8: 9: <A HREF="mpd.html">Mpd 5.8 User Manual</A> 10: : <A HREF="mpd64.html">Internals</A> 11: : Authentication  12: Previous: <A HREF="mpd65.html">ToDo</A>  13: Next: <A HREF="mpd67.html">Hints for developers</A> 14: 15: 16: <HR NOSHADE> 17: <H2><A NAME="66"></A>8.2. Authentication<A NAME="authentication"></A></H2> 18: This chapter describes implementation specific details of MPD. 19:  20: <dl> 21: 22: <dt>Authentication protocols - a short overview<dd>Currently MPD supports these authentication protocols: PAP, MD5-CHAP, 23: MS-CHAPv1, MS-CHAPv2 and EAP. 24: When using PAP, the password is sent as plaintext over the network, 25: therefore PAP should be avoided, if the link between the peers is 26: not secure. On the other hand, PAP allows using any kind of password 27: database on the server, even if the passwords are stored in 28: non-reversible hashed format. 29: The traditional CHAP-MD5 needs the plaintext password stored on the 30: server. The password hash is computed like this: md5(id + password 31: + challenge), where the id is incremented after each authentication 32: attempt. The challenge is generated by the server and then sent to the 33: client (peer). The peer sends the hash to the server and the server 34: genrates himself the hash using the plaintext password. If both 35: hash are the same, the authentication succeeds. 36: MS-CHAP doesen't need plaintext passwords on the server, but does 37: need the hashed password either as NT-Hash or as LAN-Manager-Hash 38: (the LAN-Manager-Hash is weak and shouldn't be used). 39: MS-CHAPv1 uses DES as hashing algorithm and is weak, therefore don't 40: use it! MS-CHAPv2 uses a peer challenge and a server 41: challenge and uses SHA1 as hashing algorithm, so it's much more 42: secure then MS-CHAPv1. MS-CHAPv2 requires the NT-Hash be available. 43: Usually UNIX systems have a different non-revertable hashing 44: algorithm for passwords, therefore it is not possible to use the 45: traditional UNIX password database if you want to use any 46: CHAP algorithm, with the exception that FreeBSD versions 5.1 and 47: later support the NT-Hash format in the password database 48: (configurable via login.conf: <code>passwd_format=nth</code>). 49: However MPD doesen't currently support authentication against 50: the UNIX password database. 51: EAP is an Extensible Authentication Protocol. Mpd supports 52: natively only the EAP-Type MD5; other EAP-Types may be used 53: in conjunction with a RADIUS server. 54: Note: in order for MPPE to work, MS-CHAPv1 or MS-CHAPv2 is 55: mandatory, because the MPPE keys are generated using the results 56: from authentication. 57: 58: 59: <dt>Authentication protocol negotiation<dd>Starting with MPD 3.14, MPD behaves more intelligently when negotiating 60: authentication protocols. MPD searches an internal list of protocols, 61: from most to least secure, until a mutually agreeable protocol is found. 62: If the link is a PPTP link, then MS-CHAP is most preferrable, otherwise 63: MD5-CHAP is most preferrable. 64: 65: </dl> 66:  67: 68: 69: <HR NOSHADE> 70: <A HREF="mpd.html">Mpd 5.8 User Manual</A> 71: : <A HREF="mpd64.html">Internals</A> 72: : Authentication  73: Previous: <A HREF="mpd65.html">ToDo</A>  74: Next: <A HREF="mpd67.html">Hints for developers</A> 75: 76: 77: 78: </BODY> 79: </HTML>