NTLMv2 Is Required For Secure Networks
-
This is probably a feature request.
We are using pfSense in front of our Active Directory domain. Authentication in pfSense is implemented through RADIUS on AD. Group Policy for the domain is to "Send NTLMv2 Response Only - Refuse LM and NTLM". However, because MS-CHAPv2 in pfSense uses NTLMv1, this breaks authentication, and we have to apply an exception in group policy for the pfSense machine in order to get RADIUS to work.
In Windows RAS, there is a registry workaround to allow NTLMv2 compatibility for MS-CHAPv2 encryption (see KB2811487). I am unable to find a way to implement NTLMv2 on the pfSense machine except by installing Samba.
Samba. On an internet-facing firewall, gateway, and VPN server.
I won't do that ever.
It would be nice if pfSense could use NTLMv2 out-of-the-box.
-
Why can you not just LDAP to auth to your AD?