good to hear this.
There are always security concerns. Only others.
With using PAP the password transmitted over the wire is encrypted using
the RADIUS secret. This is why you should choose a good RADIUS secret
which is at least as long as the usual passwords.
With MSCHAPv2 the password is not transmitted. But the password hash is
used. Usually this is ok, since the password is also hashed in active
directory. This way you can use the password from active directory.
Now comes the problem and thus the other security concerns:
If you are authenticating with two factors like:
<AD-Password> + <OTP>
Using MSCHAPv2 is not possible, since you would have to store the
password encrypted - not hashed.
Then privacyIDEA would have to READ the password from AD, decrypt it to
HASH( ADpassword + OTP)
HASH(ADpassword + OTP) != HASH(ADPassword) + HASH(OTP)
But you DO NOT WANT to store the password in an encrypted way.
OK, if you are using privacyIDEA OTP PIN (not the AD password) like
<OTP PIN> + <OTP>
then you have the same thing. privacyIDEA can save the OTP PINs (which
are also passwords) in an encrypted a.k.a. decryptable way.
You may think about it, if you like it at this point.
But even if we do so, there is another only small problem:
We do not know, which hash was calculated by the client side:
The user could have entered either PIN + OTPvalue1 or PIN + OTPvalue2
So we do not know which of the many possible hashes the user had used.
So the protocol gets a bit more complicated (complicated not
This could be implemented but it is simply not implemented at the moment
(Please again note: You would have to store the passwords decrypteable)
The next security concern is, that you really really do not want to use
RSA SecurID ;-)
I do not elaborate on this ;-)
So the questions are:
* Do you want a really strong 2nd factor or only a weak one.
* Would you want to use AD-Password or OTP-PIN (which is also a
* Are you more concerned about someone stealing the RADIUS Secret,
sniffing your network and getting the OTP PIN or about backdoors,
delivery chains of preseeded proprietary tokens etc. etc.
As mentioned, yes it is a security concern. But as always it is your
decision which risks you are willing to take and I can only point out
If your VPN supports a two step authentication like
* first authenticating against one RADIUS and
* then against another
you can do it like:
1. Authenticate with AD-Password via MSCHAPv2 against NPS
2. Authenticate with OTP via PAP against FreeRADIUS
But then again a security concern: Some customers do not like their
users to use their LDAP password in the wild! Since the risk of shoulder
surfing (either by human eye or camera) when entering the AD password
could be seen as higher.
I hope I gave you some input on making up your mind.
Anyway: If you are really into MSCHAPv2 we can also talk about this.
I am looking forward to your response.