I do have to set up a RADIUS server for authentication with a captive portal of pfSense. Unfortunately, all passwords in the RADIUS' database are hashed with a certain algorithm. I do use a MySQL-database.
Since the user are submitting their passwords in plaintext to the RADIUS-server, I do wonder whether I can hash the submitted passwort on the RADIUS-server and checking the existence of the username and hashed password afterwards.
If it is avoidable, I don't want to hash the password on the client-side. pfSense's captive portal is currently the only application using the RADIUS-server. But if I want to extend my infrastructure, I would have to implement the hashing-algorithm on every client.
Is there in general a possiblity to modify the RADIUS-server this way? Maybe with modifying the core? Unfortunately I don't in which file the submitted data are looked up in the database.
Does anyone have a tip for me where I do have to look?
(I do use Ubuntu Server 12.04 x86, freeradius, freeradius-mysql)