April 2006 - Freeradius-Devel - lists.freeradius.org

RE: detail logs User-Password
by Ryan Melendez 04 Apr '06

04 Apr '06

> > My suggestion however is to have > > something a > > little more generic like the following > > > > detail auth_log { > > detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail- > > %Y%m%d.txt > > detailperm = 0600 > > detailstrip = User-Password > > detailstrip = 3GPP-IMSI > > detailstrip = Other-Random-Attribute > > } > > > > This easily lets people strip out whatever attributes they want, > > not only > > passwords. > > Throwing in my $0.02 USD, I think that Peter's approach is the best > method. > > There is a need, and this addresses backwards and forwards > compatibility. I'm > against hardcoding the Attribute name in the code. I've successfully implemented the "log_pass = yes/no" method. This patch compares with PW_PASSWORD. I agree Peter's approach is more scalable, but I'm not confident I know how to responsibly handle x number of config options. Is there another module that accepts an unknown number of config options I can take a peek at? Thanks, Ryan

2 1

multiple ldap modules and same nas ip
by Angelica Delgado 04 Apr '06

04 Apr '06

Hello, It is possible to have multiple ldap modules for the same nas ip in user file? Thanks. Angelica

2 1

RE: detail logs User-Password
by Ryan Melendez 04 Apr '06

04 Apr '06

> Personally, I don't see a lot of value in it. But if the patch is > simple & the config is easy, I have no objections to it going in. If someone would rather send plain text over the wire rather than storing plain text passwords, logging the password gives up the main advantage for many in using PAP over CHAP. > Question: are there *other* attributes which should be suppressed? > If so, the configuration should take a list of attributes to censor, > rather than just "logpass=yes/no" I don't know of any others, but suggestions are welcome. I'm going to go the single-line-option route unless someone chimes in. Thanks, Ryan

3 2

module programming
by Mingyur Koblensky 04 Apr '06

04 Apr '06

Hi, i would like to develop an authentication method based on EAP... I've look around a bit but didn't find nothing, is there any ? should i write here my doubts ? thank you, kky

2 3

detail logs User-Password
by Ryan Melendez 04 Apr '06

04 Apr '06

Hello, I've seen a couple of email in the list discussing the fact that User-Password is logged by the detail module. I have to change this behavior, but hope to get the change in future releases so I wanted to know where you guys stand. (so I don't have to patch) I plan on adding a config option for the detail module: logpass = yes/no In rlm_detail have the a/v pair associated with PW_PASSWORD skipped if logpass is set to no. Alternatively, output this line to the log: User-Password = <censored> Personally, I think any password attribute should not be logged, but there might be some history/backwards compatibility I'm unaware of. I welcome any comments or suggestions. Thanks, Ryan

2 1

multiple lap modules
by Angelica Delgado 01 Apr '06

01 Apr '06

Hello all, I am trying to setup cisco webvpn with ldap and I want to configure a ldap module for each vpn. The problem is that I get the same NAS ip from all the vpns. I enabled Calling-Station Id and NAS-Port attribute at the webvpn module but freeradius does not display it on its logs. If there is something I need to enable on the system in order to receive NAS-PORT and Calling-Station on the radius packet. Thanks in advance, Angelica

2 3