<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi Tobias,<div class=""><br class=""></div><div class="">Unfortunately IKEv2 is a requirement, and they have requested username/password authentication because they don't like the "struggles" of installed a CA cert and a client cert.</div><div class=""><br class=""></div><div class="">Currently the authentication is done with MSCHAPv2 which requires SS to have a plain text copy of the password in order to create the Challenge hash, I understand that.... however, what if SS was able to retrieve the plain text password from another source other than a local config file, eg Amazon's SecretsManager for example? Is this something that is available or that you guys could write (at a price Im sure)?</div><div class=""><br class=""><div class="">
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;">Regards,<br class=""><br class=""><b class="">Christian Salway <br class=""></b>IT Consultant<br class="">Tel: 07463 331432<br class=""><a href="mailto:christian.salway@naimuri.com" class="">christian.salway@naimuri.com</a><br class=""></div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><a href="http://www.naimuri.com" class=""><br class="Apple-interchange-newline" style="color: rgb(0, 105, 217); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: underline;"><span style="color: rgb(0, 105, 217); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: underline;"><span><img apple-inline="yes" id="E7B83633-978D-4A8A-B0FE-51B415D21883" src="cid:35E087B0-19E1-4B6D-9410-B6F791DC7FF1" class=""></span>
</span></a></div><a href="http://www.naimuri.com" class="">
</a></div><div><br class=""><blockquote type="cite" class=""><div class="">On 9 May 2018, at 13:12, Tobias Brunner <<a href="mailto:tobias@strongswan.org" class="">tobias@strongswan.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">Hi Christian,<br class=""><br class=""><blockquote type="cite" class="">Is there a way to authenticate against local Linux users?<br class=""></blockquote><br class="">Not with Windows or Apple clients, unless you use IKEv1 (see [1] and [2]).<br class=""><br class="">Regards,<br class="">Tobias<br class=""><br class="">[1] <a href="https://wiki.strongswan.org/projects/strongswan/wiki/XAuthPAM" class="">https://wiki.strongswan.org/projects/strongswan/wiki/XAuthPAM</a><br class="">[2] <a href="https://wiki.strongswan.org/projects/strongswan/wiki/Eap-gtc" class="">https://wiki.strongswan.org/projects/strongswan/wiki/Eap-gtc</a><br class=""></div></div></blockquote></div><br class=""></div></body></html>