> Is there any way to squish the user password in the -xx output?  Are there any hidden/undocumented setting for radiusd.conf that do that?

radiusd -Xx | sed -e "s/\([pP]\)assword.*/\1assword <masked>/"

This is a tweak from something Alan suggested to me…  It gets rid of most of the passwords (it leaves the password rlm_ldap uses to bind and it removed some other info. – but I think it’s pretty close to what you want)..