Alternatives to PAP for Radius auth on IOS XE devices?

[J P]

I'm using Microsoft NPS on Windows 2012 to do Radius authentication and authorization for Cisco 3650 switches.  I'm wondering if it's possible configure anything better than PAP back to NPS for SSH/console sessions.  I've seen documentation for CHAP/CHAPv2 for PPP sessions, but I didn't think that applied to infrastructure logon.

Thanks for your time,

Jeremy 

[Nadav]

Radius either authenticates with PAP by asking for a username and password, or CHAP for a message challenge. Cisco opts for username and password and not CHAP for login.  I wouldn't rely on the security of CHAP to be honest, it's probably far weaker than you may think.

Your best bet is to implement TACACS, it is far more secure and refined. There are free and commercial implementations.