On 13.12.2022 11.15, Alexander Hartmaier via radiator wrote:
the following code works like a charm:
$message->{radius}->{request} = $p->get_attrs; \
# don't leak the TACACS+ key \
delete $message->{radius}->{request}->{TACACSPLUSKey}; \
$message->{radius}->{response} = $p->{rp}->get_attrs; \
Note that the request packet contains the cleartext TACACSPLUSKey. Can
you obscure or remove that like it happens for the User-Password?
Here's what I get with <Log FILE> + LogFormatHook that calls
Data::Dumper's Dumper($p->get_attrs):
$VAR1 = {
"Calling-Station-Id" => "testclient",
"NAS-IP-Address" => "127.0.0.1",
"NAS-Identifier" => "TACACS",
"NAS-Port-Id" => 123,
"OSC-TACACS-Action" => 1,
"OSC-TACACS-Authen-Type" => 2,
"OSC-TACACS-Privilege-Level" => 0,
"OSC-TACACS-Service" => 0,
"OSC-Version-Identifier" => 193,
"User-Name" => "mikem",
"User-Password" => "**obscured**",
"cisco-avpair" => [
"action=1",
"authen_type=2",
"priv-lvl=0",
"service=0"
]
};
Could it be that there's something in your local configuration that adds
TACACSPLUSKey in the attributes? I don't see it in my testing and I also
don't expect it to be present in the request's attribute list.
Thanks,
Heikki
--
Heikki Vatiainen
OSC, makers of Radiator
Visit radiatorsoftware.com for Radiator AAA server software
_______________________________________________
radiator mailing list
[email protected]
https://lists.open.com.au/mailman/listinfo/radiator
