January 2011 - Freeradius-Devel - lists.freeradius.org

Missing TLS Change Cipher Spec and TLS Finished in EAP-TLS exchanges
by arno＠natisbad.org 09 Jul '11

09 Jul '11

Hi, I upgraded an internal freeradius server (Linux, Debian unstable, libssl 0.9.8) used for EAP-TLS (802.11 WPA2 access) from 2.0.5 to 2.1.3. With 2.1.3, client authentication fails in the following way (wpasupplicant on Debian unstable, working with 2.0.5): - the TLS exchange is completed from freeradius point of view. It even sends the Access-Accept message to the NAS. - from the clients point of view, the TLS exchange is not over, it expects some more data from the server which are never sent. I took two pcap traces (sent to you privately, Alan), one with 2.0.5, one with 2.1.3. It looks like the TLS Change Cipher and TLS Tinished elements of the TLS exchange are not in the EAP encapsulated TLS packets sent by the server. Compare packet #23 of 2.1.3 trace with packet #27 of 2.0.5 trace. If you use wireshark, you will notice that the SSL layer is dissected; this is because #27 has a small brother: #29. It is not sent by 2.1.3. Alan, if you have an idea or a patch, I can test it on monday. Cheers, a+

5 15

eap2 in freeradius
by Chanthearith HUON 04 Apr '11

04 Apr '11

Hi everyone, I am testing eap2 in freeradius. I run "radiusd -X", I got following error message " radiusd: symbol lookup error: /usr/lib/rlm_eap2-2.1.0.so: undefined symbol: eap_server_register_methods " Anyone, have any idea what might be wrong with the configuration? Thank in advance, Thierry

5 10

GIT Log for 2011-01-31 00:33 GMT
by aland＠deployingradius.com 31 Jan '11

31 Jan '11

commit a81bbfa827a2434d13af541c018255f86803b20e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Jan 29 15:44:25 2011 +0100 Fix compile warnings and check for !vp Files changed: src/main/xlat.c | 24 +++++++++++++----------- 1 files changed, 13 insertions(+), 11 deletions(-) ====================================================================== commit b4a881ebcf207dd99a18c8ec818b730ae5986548 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Jan 28 12:14:03 2011 +0100 Check return value of lseek correctly Files changed: src/modules/rlm_detail/rlm_detail.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit f25083667af81da787ff83d20bb967ef342a3138 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Jan 27 15:33:32 2011 +0100 Add %{string:...} for printable data Files changed: src/main/xlat.c | 37 ++++++++++++++++++++++++++++++++++++- 1 files changed, 36 insertions(+), 1 deletions(-) ====================================================================== commit 501f52a2333339bfbbea9c10d3338286b0a07f74 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Jan 27 15:33:17 2011 +0100 make fr_print_string return the string length Files changed: src/include/libradius.h | 2 +- src/lib/print.c | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) ======================================================================

1 0

exec patch for clear text items
by Marc Phillips 27 Jan '11

27 Jan '11

Thought this might be useful for others. This is a first run through on an exec patch. I'm sure it can be greatly improved. I've only tested it thus far on Linux, but I don't see why it wouldn't work on other unix platforms. Adds in an exec option for any text field. This is useful for me as I have policy that states I can't have any passwords in clear text on the file system. I have an exec that calls out to an encrypted database for password retrieval: Just have to change your clear text entry to: "exec:<your callout>" Just like in Apache for SSL passwords, but is good for any text field. It also keeps the logger from logging the return value: *** freeradius-server-2.1.10/src/main/conffile.c 2010-09-28 06:03:56.000000000 -0500 --- freeradius-server-2.1.10-exec/src/main/conffile.c 2011-01-27 09:26:07.000000000 -0600 *************** *** 921,927 **** if (!value) return -1; } ! cf_log_info(cs, "\t%s = \"%s\"", name, value ? value : "(null)"); *q = value ? strdup(value) : NULL; break; --- 921,951 ---- if (!value) return -1; } ! /* Add Callout for cleartext values */ ! if (strncmp(value,"exec:",5) == 0) { ! char *token; ! FILE *fileptr; ! char exec_return[1024]; ! memset (exec_return,0x00,sizeof(exec_return)); ! token = strtok(value,":"); ! token = strtok(NULL,":"); ! fileptr = popen(token, "r"); ! if (fileptr == NULL) { ! return -1; ! } ! while (fgets(exec_return, sizeof(exec_return)-1, fileptr) != NULL) { ! } ! /* Get rid of carrage return from command output */ ! exec_return[strlen(exec_return)-1]='\0'; ! if (exec_return == NULL) { ! return -1; ! } ! pclose(fileptr); ! value = strdup(&exec_return); ! cf_log_info(cs, "\t%s = \"return from (%s)\"", name, token ? token : "(null)"); ! } else { ! cf_log_info(cs, "\t%s = \"%s\"", name, value ? value : "(null)"); ! } *q = value ? strdup(value) : NULL; break;

1 0

Detection of duplicate Acct packets
by Rajkumar R 27 Jan '11

27 Jan '11

Hi, I would like to know if freeRadius supports detection of duplicate Accounting packets upon re-transmission. Could you please confirm on the handling for such packets, as RFC5080 states handling of Access packets. Appreciate all your inputs. Thanks, Raj ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

2 1

GIT Log for 2011-01-27 00:33 GMT
by aland＠deployingradius.com 27 Jan '11

27 Jan '11

commit c055d2840e93ee43bd8d95d1d25a01106a5d54d0 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Jan 25 17:20:54 2011 +0100 Clarify parse error for ascend attributes Printing to the same string we're reading from is a bad idea. Files changed: src/lib/valuepair.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) ====================================================================== commit 0b8c3ebf417312d0969f39d7c8b44a95b4855192 Author: B. Candler <b.candler(a)pobox.com> Date: Mon Jan 24 14:18:08 2011 +0100 This patch adds a 'key' parameter to rlm_fastusers, in the same way as rlm_files has. Closes bug #126 Files changed: src/modules/rlm_fastusers/rlm_fastusers.c | 32 +++++++++++++++++++++++++--- 1 files changed, 28 insertions(+), 4 deletions(-) ====================================================================== commit b0fa79c3021d6d39922039ea8b8256b2577223ab Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Jan 24 14:03:44 2011 +0100 Fixed mismatch Files changed: share/dictionary.redback | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) ======================================================================

1 0

A question of "fr_debug_flag"
by Cai Fa 25 Jan '11

25 Jan '11

Hi All, I upgraded my freeradius from 1 to 2. When do eap-tls authenticate, the radiusd crashed in debug mode. After debug the code, I found the following code which didn't appear in version 1. *int eaplist_add(rlm_eap_t *inst, EAP_HANDLER *handler) ...... if (fr_debug_flag) { check_handler_t *check = rad_malloc(sizeof(*check)); check->inst = inst; check->handler = handler; check->trips = handler->trips; request_data_add(request, inst, 0, check, check_handler); } ...... }* In function request_free, it would call "*this->free_opaque(this->opaque);*", this is actually "*check_handler*". The process crashed in "*rbtree_finddata()*". Could anyone tell me why add these code in new version?

2 1

GIT Log for 2011-01-21 00:33 GMT
by aland＠deployingradius.com 21 Jan '11

21 Jan '11

commit 4be493a755311607fed91ed5181628e8c2ec57a2 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Jan 20 16:01:17 2011 +0100 Add $(LIBRADIUS) to allow it to link Files changed: src/modules/rlm_eap/Makefile.in | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 2013912d296f37eec5a9677020dcfb9364a31878 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Jan 20 10:00:38 2011 +0100 Update ignore files Files changed: scripts/.gitignore | 1 + src/main/.gitignore | 1 + src/modules/rlm_opendirectory/.gitignore | 1 + src/modules/rlm_redis/.gitignore | 1 + src/tests/.gitignore | 3 +++ 5 files changed, 7 insertions(+), 0 deletions(-) ====================================================================== commit 45d230b2dd9ed3943bf5f80af353bee0dfa2eb5c Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Jan 20 09:52:20 2011 +0100 Use _sysconfdir instead of /etc It allows the config files to be placed anywhere, instead of a hard-coded path Files changed: suse/freeradius.spec | 102 +++++++++++++++++++++++++------------------------- 1 files changed, 51 insertions(+), 51 deletions(-) ====================================================================== commit b4b068abbe178aa1676e6c23b4d79894e1f068d4 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Jan 19 17:25:10 2011 +0100 Call write() rather than fwrite() It returns real errors... Files changed: src/modules/rlm_detail/rlm_detail.c | 62 ++++++++++++----------------------- 1 files changed, 21 insertions(+), 41 deletions(-) ====================================================================== commit 2ab2930c96c01f25354d209aee1d5c43e6fac183 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Jan 20 10:26:03 2011 +0100 Updated as per recent WiMAX specs Files changed: share/dictionary.wimax | 48 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 48 insertions(+), 0 deletions(-) ======================================================================

1 0

Request information for EAP TTLS
by Aman Arneja 19 Jan '11

19 Jan '11

> Hi > > I am new to Free Radius and was just wondering if some1 can help me out. I > am planning to implement an EAP TTLS client and was wondering the following > about Free Radius for my testing. > > 1.) Does Free Radius Implementation of EAP TTLS Support the following > > a.) Client auth during phase 1 > b.) Id privacy can be explicitly enabled or disables > c.) Allowing tunneled methods such as FAST, PEAP as inner methods > d.) Method chaining in phase 2 > > Thanx in advance for your help guys > > Aman Arneja > >

2 4

Re: IPV6_PKTINFO/recvfromto
by Alexander Clouter 16 Jan '11

16 Jan '11

Hi, Finally found the time to look into this, a clean v2.1.10 tree with the following cherry-picks: * e5c861665f00f1213036ba412b7092aac7159ad7 (contains bug) * fa0851d9235f04ff0d4161fc6f842857ff8d52aa The bug is fixed with the attached 0003-fix-recvpktinfo.patch, and then IPv6 is actually enabled with 0004-enable-ipv6.patch. For PKTINFO to work, Linux needs IPV6_RECVPKTINFO (or the legacy IPV6_2292PKTINFO) passed to setsockopt, however when you jump into sendmsg() cmsg->cmsg_type has to be IPV6_PKTINFO (or the legacy IPV6_2292PKTINFO); this is broken in the commit do to all the define/undef magic going on. I think I have sanitised it correctly. Cheers -- Alexander Clouter .sigmonster says: Have an adequate day.

2 1

why the freeradius server can't support eap-aka?
by zhangyan 14 Jan '11

14 Jan '11

hello, why the freeradius server can't support eap-aka, if because of license needed? Does anyone know which server can do eap-aka authentication? Thanks very much. BR, Yan -- View this message in context: http://freeradius.1045715.n5.nabble.com/why-the-freeradius-server-can-t-sup… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

2 2

rlm_redis module "patch"
by Gabriel Blanchard 13 Jan '11

13 Jan '11

Attached is two new modules. Apologies ahead of time for submitting this as a tgz. rlm_redis allows you to connect and query a redis key-store database. Basically same idea as memcached except the keys don't expire if you allow them to. http://redis.io/ rlm_redis requires a redis server instance and the hiredis libraries to be installed https://github.com/antirez/hiredis Preferably redis should be running version 2.2 as it allows you to expire keys. rlm_rediswho is a module that is similar to rlm_radwho, it obviously uses the rlm_redis module. What it does is that it basically "dumps" all the accounting data/sessions into this key store database. Once a user has so many sessions (defined by trim-count) rlm_radwho will start trimming out old data. If there is no update for said user for expiry-time, the redis server itself will expire the key. I anticipate the rlm_redis module could be used for something else, since it is _considerably_ faster than any sql module (about 100,000 queries per second) . But I thought that this was perfect for a radwho module as it allows you to expire stale sessions automatically, therefore the db won't grow an insane amount. Obviously this is all work in progress, but it appears to run stable. It compiles clean on my Mac but may need some configure script magic to make it a little more portable.

2 7

Re: dialup_admin php notice errors
by Stefan Winter 13 Jan '11

13 Jan '11

Hi, just now I have had to upgrade my dialup_admin installation to a machine running PHP5.3, and also noticed numerous PHP errors. I have fixed the code, see attached patch. It solves the following bugs/deprecated code warnings: * replace ereg -> preg_match, ereg_replace -> preg_replace, split -> preg_split for PHP5.3 compatibility * fix LIMIT not working when using MySQL * add configuration item "timezone" to make PHP 5.1+ happy and adds one (trivial, one-liner) feature: * add comparison operators "!=" and "not like" to Accounting Now, I have an almost error/warning/notice free installation. There is still something bogus around the use of mktime() someplace, but I don't use that part of dialup_admin, so I'll leave that alone. It's tested to work at my installation, and I would appreciate if the code could get into mainstream release. But it can of course use much more testing! Particularly the LDAP-related parts (user_edit a.s.o.) only got the same code massage about preg's but got no testing because that's also an unused code part for me. Doesn't help for Todd's errors, I suppose, but I find these code changes useful anyway. Greetings, Stefan Winter Am 06.01.2011 21:53, schrieb Alan DeKok: > Todd Bateman wrote: >> Is CS down or the information change? I went to try to see if that was >> the problem, but I get a connection refused. > dialup_admin hasn't used CVS for many years. > > The latest version is included in 2.1.10, but if you look at the "git" > repository, the dialup_admin code hasn't been changed in years. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

3 7

rlm_perl.c questions
by Anatoly Ivanov 11 Jan '11

11 Jan '11

Hi everybody, I have a couple of questions regarding modules/rlm_perl/rlm_perl.c: perl_detach(...): 1. Is it correct to call PERL_SYS_TERM in detach()? I am experiencing quite random and unpredictable segfaults with radius 2.1.8 and rlm_perl, and it really looks like memory allocation/multithreading error. I have very similar system running radius 2.1.7, and it works just fine. The most significant difference in rlm_perl between 2.1.7 and 2.1.8 is that PERL_SYS_TERM call. According to the documentation (http://perldoc.perl.org/perlembed.html) PERL_SYS_TERM should be called only once. In our case, it is called once per detaching thread. 2. This code: embed = rad_malloc(4*(sizeof(char *))); memset(embed, 0, sizeof(4*(sizeof(char *)))); looks like a misprint to me. Not that it would cause any real errors, but it is inaccurate anyway. Thank you, Anatoly.

3 7

freeRadius with SOAP
by Rajkumar R 10 Jan '11

10 Jan '11

Hi, I would like to use SOAP or any non-persistent connection(please suggest if any good alternatives) to send a trigger message upon a radius-acct-start message inorder to do one more level of authentication. For this, I request you to provide any examples/documents describing on the same would be helpful for me. thanks, Raj ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

1 0

Framework to support multiple BRAS specific AVPs
by Rajkumar R 10 Jan '11

10 Jan '11

Hi, Request you to clarify on my below question: Is it possible to have a different AVPs grouped (for a COA message) for different NAS vendors? If so, is it achievable with configurable settings? Appreciate your inputs. thanks, Raj ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

1 0

Re: Module Creation and Incoming request identification
by Rajkumar R 05 Jan '11

05 Jan '11

Thanks all for your inputs. Is it the account type listen section in radiusd.conf file you are referencing about(to include new module)? -Raj ________________________________________ De: freeradius-devel-bounces+lscrlstld=gmail.com(a)lists.freeradius.org [mailto:freeradius-devel-bounces+lscrlstld=gmail.com@lists.freeradius.org] Em nome de Rajkumar R Enviada em: ter?a-feira, 4 de janeiro de 2011 08:59 Para: freeradius-devel(a)lists.freeradius.org Assunto: Module Creation and Incoming request identification > 2. How do I make the new procedure(to send UDPmsg to other application) > aware that a new Acc-Start/Stop message has arrived? This is because, > sending a msg to other application should be instantaneous. You can create a perl module e call it in accounting section, it is possible to filter acct stop and start using ulang. ------------------------------ Message: 2 Date: Tue, 4 Jan 2011 12:56:54 +0000 From: Alexander Clouter <alex(a)digriz.org.uk> Subject: Re: Module Creation and Incoming request identification To: freeradius-devel(a)lists.freeradius.org Message-ID: <m1ibv7-mk8.ln1(a)chipmunk.wormnet.eu> Rajkumar R <rajkumar.r(a)aricent.com> wrote: > > I need to create a new module, which should send a UDP msg to another > application server upon a Account-Start/Stop message request from a > NAS. For this, request you to provide your inputs on the below > queries: > rlm_perl Cheers -- Alexander Clouter .sigmonster says: Today is the last day of your life so far. ------------------------------ Message: 3 Date: Wed, 5 Jan 2011 07:58:52 +1000 From: Nikki Watt <nikki.watt(a)qut.edu.au> Subject: RE: Module Creation and Incoming request identification To: FreeRadius developers mailing list <freeradius-devel(a)lists.freeradius.org> Message-ID: <6D78B4DCFF9785409FE29BE1F01B3A6BA8179461(a)QUTEXMBX03.qut.edu.au> Content-Type: text/plain; charset="us-ascii" Hi Raj, I've written a similar module for freeradius (except that it does asynchronous HTTP interaction with another server rather than UDP) by following the instructions on the freeradius wiki. There's also an excellent example module included in the freeradius source code (<freeradius source directory>/src/modules/rlm_example/rlm_example.c) that I used as a guide. If you're comfortable with the C language, perhaps that's the way to go? If not, as others have suggested, rlm_perl may be better for you. In either case, you just need to reference the module in the accounting section of your config and freeradius will call the module whenever it receives an accounting packet. Regards, Nikki Nikki Watt | Network Programmer | Network Operations Centre | ITS | Level 3, Synergy Building (88 Musk Avenue, Kelvin Grove) | Ph: 3138 6858 | nikki.watt(a)qut.edu.au<mailto:nikki.watt@qut.edu.au> | www.its.qut.edu.au<http://www.its.qut.edu.au> | CRICOS No 00213J From: freeradius-devel-bounces+nikki.watt=qut.edu.au(a)lists.freeradius.org [mailto:freeradius-devel-bounces+nikki.watt=qut.edu.au@lists.freeradius.org] On Behalf Of Rajkumar R Sent: Tuesday, 4 January 2011 8:59 PM To: freeradius-devel(a)lists.freeradius.org Subject: Module Creation and Incoming request identification Hi, I need to create a new module, which should send a UDP msg to another application server upon a Account-Start/Stop message request from a NAS. For this, request you to provide your inputs on the below queries: 1. I read in the wiki link that rlm approach to be used for creating a new module. Any examples available on the same? 2. How do I make the new procedure(to send UDPmsg to other application) aware that a new Acc-Start/Stop message has arrived? This is because, sending a msg to other application should be instantaneous. Appreciate your inputs. thanks, Raj ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

2 1

RE: Module Creation and Incoming request identification
by Rajkumar R 05 Jan '11

05 Jan '11

Could anyone please provide your inputs on this? thanks, Raj From: Rajkumar R Sent: Tuesday, January 04, 2011 4:29 PM To: 'freeradius-devel(a)lists.freeradius.org' Subject: Module Creation and Incoming request identification Hi, I need to create a new module, which should send a UDP msg to another application server upon a Account-Start/Stop message request from a NAS. For this, request you to provide your inputs on the below queries: 1. I read in the wiki link that rlm approach to be used for creating a new module. Any examples available on the same? 2. How do I make the new procedure(to send UDPmsg to other application) aware that a new Acc-Start/Stop message has arrived? This is because, sending a msg to other application should be instantaneous. Appreciate your inputs. thanks, Raj ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

1 0

Module Creation and Incoming request identification
by Rajkumar R 04 Jan '11

04 Jan '11

Hi, I need to create a new module, which should send a UDP msg to another application server upon a Account-Start/Stop message request from a NAS. For this, request you to provide your inputs on the below queries: 1. I read in the wiki link that rlm approach to be used for creating a new module. Any examples available on the same? 2. How do I make the new procedure(to send UDPmsg to other application) aware that a new Acc-Start/Stop message has arrived? This is because, sending a msg to other application should be instantaneous. Appreciate your inputs. thanks, Raj ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

4 3

proposal for using filter-id attribute for authorization with pam_radius
by Renke Brausse 03 Jan '11

03 Jan '11

Hi list, we're using for OPT authentification a Vasco Identikey server. Unfortunately the software is rather limited, e.g. it is not possible to define access rules based on groups. The server is able to perform a RADIUS password challenge but only as "PIN and OTP are correct" - not exactly the kind of authentication I expected... The only way to get something like grouping with this product is out-sourcing to the client: Vasco cann add a filter-id attribute to the response, if the client is capable of interpreting such responses it is possible to group users (though with strings on a per-user base). As we plan to use the OTP tokens to secure our SSH service I searched for a method to authorize users not only with RADIUS but additionally the feature to check for specific filter-ids in the response - it seems no one has ever implemented such a thing. Anyway, I extended pam_radius* so it is possible to use filter-ids for authentication - the patches for 1.3.17 are attached. Would an extension like this useful for the vanilla release of pam_radius? Greetings Renke *) I am _not_ a programmer, the stuff I changed should be checked/rewritten/used only as concept...

2 1