Re: Suppress radpostauth password logging with unlang variable reference

--===============6205298085012656522==
Content-Type: multipart/signed;
	boundary="Apple-Mail=_6567BE7E-470C-4F31-8CCC-A48D8B9FDBD5";
	protocol="application/pgp-signature";
	micalg=pgp-sha256


--Apple-Mail=_6567BE7E-470C-4F31-8CCC-A48D8B9FDBD5
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii

On M
>=20
> PostgreSQL datastore is logging passwords in plain text in the
> 'radpostauth' table for accepted and rejected requests. This is
> occurring even when 'auth_goodpass' and 'auth_badpass' are set to 'no'
> - which this looks to be only relevant to logging to radius.log.

  Yes.

> I could comment out '-sql' in the 'post-auth' section of the server or
> amend the queries.conf for sql to remove the password. However, for
> flexibility/simplicity I have looked into using unlang to suppress the
> attribute.
>=20
> I would like to use the variable reference from radiusd.conf for
> auth_goodpass/auth_badpass to control whether the User-Password is
> suppressed ideally for efficiency.
>=20
> The unlang is as follows in the 'post-auth' section of the default =
server:
>=20
>     if (${log.auth_goodpass}) {
>        -sql
>    }
>    else {
>        suppress {
>            User-Password
>        }
>        -sql
>    }

  That won't work.  You can't just invent syntax and have it do what you =
want.

> This throws the below error:
>=20
> /etc/freeradius/sites-enabled/default[919]: Parse error in condition
> /etc/freeradius/sites-enabled/default[919]: (${log.auth_goodpass}) {
> /etc/freeradius/sites-enabled/default[919]:  ^ Expected a module =
return code

  You have to check for a specific value:

	if ("${log.auth_goodpass}" =3D=3D "yes") {
		...

  You also can't use a "suppress" block in the middle of an unlang =
processing section.  You have to use "update" to remove User-Password =
from the request:

	update request {
		User-Password !* ANY
	}

  Since the password isn't used for anything after post-auth, it's safe =
to delete it.

  Alan DeKok.


--Apple-Mail=_6567BE7E-470C-4F31-8CCC-A48D8B9FDBD5
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename=signature.asc
Content-Type: application/pgp-signature;
	name=signature.asc
Content-Description: Message signed with OpenPGP

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEIUl02elqcIsf1zM0v3SJ0h7dTTMFAmoHdpEACgkQv3SJ0h7d
TTMQFw//ZnDSh7noHsTPuYm3bkRpTpeVYYUoV0FefWSTRCUmhJzC1hH1Og1fZlxZ
s7L0fEAsA4D4a3ikYSIuVqBJ6Hy0OWXkqRPajZR7Ot/efOgoNXCsLGeb8rTvKuke
DsdcgtSj+BCP3gijCkmWcOmpZIMTTL2hJ65OnIO02o1WZiuw/W6wwCGH/unY8cD1
IaBdAPuIxifChHlFg6Nr9KoBypJFtfSXMxAaWo8tNDtjTMsnr3IS2N7mtEJzM3YU
P4qzbGx55Myfa7jFYnBkXSmg3IFRr5yM3J49uhH683ZXubd4i4dROqgg2JgCvhUf
p2tCK5WUGSNKEVl4KWqE9b0qS1ME1Z0d635Wx+VRGscW3gQ/ecM6e+s1xSaiUaL4
lR0eZzG8A7qcYVEjKdGfFZQWpvEjWcy9Qdlocpk34l8jOZV3d+h256YXj/W9eLbo
ZlAuk+GfCkOzH4tUckoFb8wp4vALhLiOR3YyYa3SDo6TljxjcEz37FCXYNxsnUTv
OmxBKu7vaTRz8ATfClEkPSfbNK/vRd22Spvr4e1SqTiPY++gcSr85icJoyzPMAkI
J2vjqfWJr23DCN0ws3NcnJYD+/pymK4s+sOYAeiM18foVka0dgThtvaNcZ3AktFQ
5OOl26meZ4W7KBVqQz5z5yG3GFIApOdX/YrkkPhJOppEAknnmkI=
=eOX7
-----END PGP SIGNATURE-----

--Apple-Mail=_6567BE7E-470C-4F31-8CCC-A48D8B9FDBD5--

--===============6205298085012656522==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

--===============6205298085012656522==--