Hi all,
Here is a patch for the AuthTACACSPLUS package (attached to this mail).
Before, the authentication type was selected according to the version of
the package (except CHAP).
I added a keyword in order to force the authentication type. Here is an
example of a radiator config file:
<Handler Realm=HOSTING.ALL, NAS-Port-Type=Async>
RewriteUsername s/\@HOSTING\.ALL$//
AuthByPolicy ContinueUntilAccept
<AuthBy DBFILE>
Filename %D/files/users-hosting
NoDefault
AddToReply Service-Type = Administrative-User
</AuthBy>
<AuthBy TACACSPLUS>
Host 192.168.0.1
Key topsecret
AuthType ASCII
Timeout 3
AddToReply \
Service-Type = Administrative-User, \
cisco-avpair = "rtelnet:*=*"
</AuthBy>
</Handler>
AuthType ASCII|CHAP|PAP
Customer are authenticated using the DB file, and all technical staff
can also be authenticated (for support) by using their usual
login/pass on the tacacsplus server.
Regards,
--
Jean-Claude Christophe / [EMAIL PROTECTED]
*** Radius/AuthTACACSPLUS.pm.old Thu Jul 18 00:03:44 2002
--- Radius/AuthTACACSPLUS.pm Thu Jul 18 00:04:17 2002
***************
*** 6,13 ****
# with an AuthType of TACACSPLUS is found in the config file
#
# This module can check an TACACSPLUS user password, but cant do any
! # check or reply items. Cant handle CHAP, only PAP
! # Accounting packets ar ignored.
#
# Author: Mike McCauley ([EMAIL PROTECTED])
# Copyright (C) 1997 Open System Consultants
--- 6,13 ----
# with an AuthType of TACACSPLUS is found in the config file
#
# This module can check an TACACSPLUS user password, but cant do any
! # check or reply items. It can handle CHAP, PAP or ASCII authentication
! # type. Accounting packets are ignored.
#
# Author: Mike McCauley ([EMAIL PROTECTED])
# Copyright (C) 1997 Open System Consultants
***************
*** 20,29 ****
use strict;
%Radius::AuthTACACSPLUS::ConfigKeywords =
! ('Host' => 'string',
! 'Key' => 'string',
! 'Port' => 'string',
! 'Timeout' => 'integer'
);
#####################################################################
--- 20,30 ----
use strict;
%Radius::AuthTACACSPLUS::ConfigKeywords =
! ('AuthType' => 'string',
! 'Host' => 'string',
! 'Key' => 'string',
! 'Port' => 'string',
! 'Timeout' => 'integer'
);
#####################################################################
***************
*** 90,97 ****
if ($p->code eq 'Access-Request')
{
my $tac = new Authen::TacacsPlus(Host=>$self->{Host},
! Key=>$self->{Key},
! Timeout=>$self->{Timeout},
Port=>$self->{Port});
if (!$tac)
--- 91,98 ----
if ($p->code eq 'Access-Request')
{
my $tac = new Authen::TacacsPlus(Host=>$self->{Host},
! Key=>$self->{Key},
! Timeout=>$self->{Timeout},
Port=>$self->{Port});
if (!$tac)
***************
*** 103,109 ****
$user_name =~ s/@[^@]*$//
if $self->{UsernameMatchesWithoutRealm};
! my ($tac_result, $result, $reason, $attr, $submitted_pw);
# See if they want to do it by CHAP
if (defined ($attr = $p->getAttrByNum($Radius::Radius::CHAP_PASSWORD)))
--- 104,110 ----
$user_name =~ s/@[^@]*$//
if $self->{UsernameMatchesWithoutRealm};
! my ($tac_result, $result, $reason, $attr, $submitted_pw, $authtype);
# See if they want to do it by CHAP
if (defined ($attr = $p->getAttrByNum($Radius::Radius::CHAP_PASSWORD)))
***************
*** 141,156 ****
($Radius::Radius::USER_PASSWORD))
{
# The submitted password is encoded plaintext,
! # decode it to get th eplaintext back
$submitted_pw = $p->decodedPassword();
# Version 0.16 and better can handle PAP, else take the
! # old version defauilt, which is ASCII
$tac_result = $tac->authen
! ($user_name,
! $submitted_pw,
! $Authen::TacacsPlus::VERSION > 0.15
! ? &Authen::TacacsPlus::TAC_PLUS_AUTHEN_TYPE_PAP
! : undef);
}
if ($tac_result)
{
--- 142,184 ----
($Radius::Radius::USER_PASSWORD))
{
# The submitted password is encoded plaintext,
! # decode it to get the plaintext back
$submitted_pw = $p->decodedPassword();
# Version 0.16 and better can handle PAP, else take the
! # old version default, which is ASCII
! # The authentication type can be override with 'AuthType'
! # to prevent Radiator choosing the type from the version of
! # the TacacsPlus package.
! if (defined($self->{AuthType}))
! {
! if ($self->{AuthType} =~ /PAP/i)
! {
! $authtype = &Authen::TacacsPlus::TAC_PLUS_AUTHEN_TYPE_PAP;
! }
! elsif ($self->{AuthType} =~ /ASCII/i)
! {
! $authtype = &Authen::TacacsPlus::TAC_PLUS_AUTHEN_TYPE_ASCII;
! }
! elsif ($self->{AuthType} =~ /CHAP/i)
! {
! $self->log($main::LOG_ERR, "There is no CHAP challenge in the
request.");
! }
! else
! {
! $self->log($main::LOG_ERR, "Unknown TacacsPlus authentication
type. Remove it and let Radiator guess it.");
! }
! }
! if (!defined($authtype))
! {
! # $authtype is undefined or incorrect -> try to guess it
! $authtype = $Authen::TacacsPlus::VERSION > 0.15
! ? &Authen::TacacsPlus::TAC_PLUS_AUTHEN_TYPE_PAP
! : &Authen::TacacsPlus::TAC_PLUS_AUTHEN_TYPE_ASCII;
! }
$tac_result = $tac->authen
! ($user_name,
! $submitted_pw,
! $authtype);
}
if ($tac_result)
{
