(RADIATOR) Issues with the TACPLUS Server

[Hugh Irvine]

Hello Patrick -

Many thanks for your mail - its very nice to hear from you again -  
hope all is well.

And thanks for the detailed analysis - I'll send it on to Mike.

all the best

cheers

Hugh


On 6 Dec 2007, at 01:35, Patrik Forsberg wrote:

> Hi,
>
> Seems like I finally got the time to look closer on this and found  
> what
> was going on.
>
> There seem to be a leakage in the way ServerTACPLUS.pm uses the
> AuthorizeGroup parameters. It doesn't clean the variable for  
> attributes
> correctly and thus the attribute stay when it is supposed to send a
> clean attribute to the device.
> In this case I only had one attribute set (priv-lvl=15) which  
> stayed in
> memory while the server was running so every command I tried to get
> authorized got the attribute added to it, but when I did a reload(kill
> -HUP) it cleaned the memory of this attribute and thus finally  
> delivered
> a response that Cisco, and likely others too, could accept :)
>
> The workaround to this is to add {} at the end of every permission
> clause that aren't supposed to have a attribute.. like
> "
> AuthorizeGroup group1 permit service=shell cmd\* {priv-lvl=15}
> AuthorizeGroup group1 permit .* {}
> "
>
> Well.. issued at least temporary solved :)
>
> Regards,
> Patrik
>
>
> --
> Archive at http://www.open.com.au/archives/radiator/
> Announcements on radiator-announce at open.com.au
> To unsubscribe, email 'majordomo at open.com.au' with
> 'unsubscribe radiator' in the body of the message.



NB:

Have you read the reference manual ("doc/ref.html")?
Have you searched the mailing list archive (www.open.com.au/archives/ 
radiator)?
Have you had a quick look on Google (www.google.com)?
Have you included a copy of your configuration file (no secrets),
together with a trace 4 debug showing what is happening?
Have you checked the RadiusExpert wiki:
http://www.open.com.au/wiki/index.php/Main_Page

-- 
Radiator: the most portable, flexible and configurable RADIUS server
anywhere. Available on *NIX, *BSD, Windows, MacOS X.
Includes support for reliable RADIUS transport (RadSec),
and DIAMETER translation agent.
-
Nets: internetwork inventory and management - graphical, extensible,
flexible with hardware, software, platform and database independence.
-
CATool: Private Certificate Authority for Unix and Unix-like systems.


--
Archive at http://www.open.com.au/archives/radiator/
Announcements on radiator-announce at open.com.au
To unsubscribe, email 'majordomo at open.com.au' with
'unsubscribe radiator' in the body of the message.