Recommendations for manging user password
Thank you all for responding to my first post in getting FreeRadius set up and working on a Solaris 10 box. I am working on creating the (non-priviledged) user environment that will run the server. I have successfully set up a working Radius server to work with a FirePass VPN appliance.. FirePass uses PAP for authentication.. however I have authenticated using both local and PAP. <code> "charlie" Auth-Type := Local, User-Password == "hello" Reply-Message = "Hello, %u" "charles" Auth-Type := PAP, User-Password == "hello" Reply-Message = "Hello, %u" </code> This works like this: -- FirePass appliaance has a SSL login page. -- User enters creditials -> validates against FreeRadius -- User is shown a "static" page on the FirePass Server with a Static Link. I will have about 75 users and need to set up password aging.. Using system (non-shell) accounts with IDs in /etc/password could be an option I did read the "Expired" thread and I can write a script to update that field if necessary.. My Goal --- let the user know their password has expired --- let them change it themselves.. --- age the password for 90 days --- I really don't want a MySQL database ( I don't know MySQL but could learn if I have to) I am hoping someone can point me in the right direction.. Charles
thekat wrote:
FirePass uses PAP for authentication.. however I have authenticated using both local and PAP.
<code> "charlie" Auth-Type := Local, User-Password == "hello"
Don't set Auth-Type. Use Cleartext-Password, not User-Password. See the FAQ.
I will have about 75 users and need to set up password aging.. Using system (non-shell) accounts with IDs in /etc/password could be an option I did read the "Expired" thread and I can write a script to update that field if necessary..
My Goal --- let the user know their password has expired
That is an issue for the web page. You need to tell them *before* the password has expired.
--- let them change it themselves..
You'll need a separate script for this.
--- age the password for 90 days --- I really don't want a MySQL database ( I don't know MySQL but could learn if I have to)
You can use system accounts for this. Alan DeKok.
Alan.. Thx for the reply.. after some chatting with the developers.. We already have an Oracle instance in place for the User /Passwd.. If we can use Oracle to talk "PAP" to FirePass this puts all the user management back on the already set up Oracle instance.. I will post back.. Much Thanks Charles On Fri, May 2, 2008 at 4:31 AM, Alan DeKok <aland@deployingradius.com> wrote:
thekat wrote:
FirePass uses PAP for authentication.. however I have authenticated using both local and PAP.
<code> "charlie" Auth-Type := Local, User-Password == "hello"
Don't set Auth-Type. Use Cleartext-Password, not User-Password. See the FAQ.
I will have about 75 users and need to set up password aging.. Using system (non-shell) accounts with IDs in /etc/password could be an option I did read the "Expired" thread and I can write a script to update that field if necessary..
My Goal --- let the user know their password has expired
That is an issue for the web page. You need to tell them *before* the password has expired.
--- let them change it themselves..
You'll need a separate script for this.
--- age the password for 90 days --- I really don't want a MySQL database ( I don't know MySQL but could learn if I have to)
You can use system accounts for this.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hey Charles, On Thu, May 1, 2008 at 11:02 PM, thekat <thekewlcat@gmail.com> wrote:
My Goal --- let the user know their password has expired --- let them change it themselves.. --- age the password for 90 days --- I really don't want a MySQL database ( I don't know MySQL but could learn if I have to)
I am hoping someone can point me in the right direction..
You may find the daloRADIUS software a good solution for managing a freeradius deployment based on a database (mysql/oracle/postgresql/etc), which eases up administration (you obviously don't need to posses any mysql skills). It hasn't been tested with Oracle but if you're willing to give it a chance I will devote my free time to help you getting it installed and running. Any feedback is welcome, goodluck. Regards, Liran Tal.
participants (3)
-
Alan DeKok -
Liran Tal -
thekat