<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7651.14">
<TITLE>Splitting the password field in freeRADIUS</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<BR>
<P><FONT SIZE=2 FACE="Arial">As some of you may know, RSA SecurID servers now support RADIUS. The Auth Manager comes with the Funk RADIUS sever embedded into it, and supports a number of auth types, including EAP-OTP as well as the usual types such as CHAP.</FONT></P>
<P><FONT SIZE=2 FACE="Arial">Is it possible to front end this type of server with FreeRADIUS, so that NAS-Clients can send a tokencode prepended to, say, a Kerberos password - and have the FreeRADIUS server forward the first 6 digits of the field to the RSA server for tokencode validation - and the remaining charcters to another RADIUS server, one that front-ends a Kerberos system? Only when both fields return true is the authentication true.</FONT></P>
<P><FONT SIZE=2 FACE="Arial">Is this possible? I was looking at the various scripting options in radius.conf, and don't know of anyone who has done this. Or if it can be done. </FONT></P>
<P><FONT SIZE=2 FACE="Arial">Thank you.</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Dan.</FONT>
</P>
<BR>
<BR>
<P><FONT SIZE=2 FACE="Arial">#</FONT>
<BR><FONT SIZE=2 FACE="Arial"># Pre-accounting. Decide which accounting type to use.</FONT>
<BR><FONT SIZE=2 FACE="Arial">#</FONT>
<BR><FONT SIZE=2 FACE="Arial">preacct {</FONT>
<BR> <FONT SIZE=2 FACE="Arial">preprocess</FONT>
</P>
<P> <FONT SIZE=2 FACE="Arial">#</FONT>
<BR> <FONT SIZE=2 FACE="Arial"># Ensure that we have a semi-unique identifier for every</FONT>
<BR> <FONT SIZE=2 FACE="Arial"># request, and many NAS boxes are broken.</FONT>
<BR> <FONT SIZE=2 FACE="Arial">acct_unique</FONT>
</P>
<P> <FONT SIZE=2 FACE="Arial">#</FONT>
<BR> <FONT SIZE=2 FACE="Arial"># Look for IPASS-style 'realm/', and if not found, look for</FONT>
<BR> <FONT SIZE=2 FACE="Arial"># '@realm', and decide whether or not to proxy, based on</FONT>
<BR> <FONT SIZE=2 FACE="Arial"># that.</FONT>
<BR> <FONT SIZE=2 FACE="Arial">#</FONT>
<BR> <FONT SIZE=2 FACE="Arial"># Accounting requests are generally proxied to the same</FONT>
<BR> <FONT SIZE=2 FACE="Arial"># home server as authentication requests.</FONT>
<BR><FONT SIZE=2 FACE="Arial"># IPASS</FONT>
<BR> <FONT SIZE=2 FACE="Arial">suffix</FONT>
<BR><FONT SIZE=2 FACE="Arial"># ntdomain</FONT>
</P>
<P> <FONT SIZE=2 FACE="Arial">#</FONT>
<BR> <FONT SIZE=2 FACE="Arial"># Read the 'acct_users' file</FONT>
<BR> <FONT SIZE=2 FACE="Arial">files</FONT>
<BR><FONT SIZE=2 FACE="Arial">}</FONT>
</P>
</BODY>
</HTML>