Norman Zhang wrote: > My current radius installation permits radius daemon read-only access to > /etc/shadow. But this introduces security risks.
Such as? > -rw-r--r-- 1 root root 6514 Nov 18 16:52 /etc/shadow > > I have been told to consider MySQL back-end. Is there a way to pull the > existing local users/passwords in MySQL? Or I have recreate every user > plus password in MySQL? You can manually write a program that runs as root to pull user/password information from /etc/shadow, and copy it to an SQL database. But you will be providing the RADIUS server with... access to the username && password. Which is what happens when you let it read /etc/shadow. i.e. If you're worried about letting your RADIUS server read /etc/shadow, you shouldn't be giving it *any* information about users or passwords. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html