Chapter 10

Pop quiz – EAP

1. Ignore the links; you may even go as far deleting them for sanity's sake. EAP works as is on a new installation. The less you change on the EAP configuration the better.
2. The EAP-TTLS/PAP method makes use of the inner-tunnel virtual server instead of the default virtual server when authenticating users. Make sure you also specify the use of the ldap module in the inner-tunnel virtual server. These virtual servers are independent from each other.
3. No, when you bind as a user you need to send the user's cleartext password to the LDAP server. When you use PEAP/MSCHAPv2 there is no way to get a cleartext password out of the transaction.
4. No lies here! The Universal Password feature allows the ldap module to get passwords in cleartext from the LDAP server. There are a few rules to follow in order to get this password. The connection to the LDAP server has to be a secure connection with a special privileged user binding to it to run the queries. The password_attribute...