Re: Radius Auth and Insecurity Outputs

2010-04-20 Thread Nicholas Marriott
Yeah I agree, I think we should pick something sensible and document it in security(8). Most people use "*" for disabled, how about something like "*nocheck"? On Tue, Apr 20, 2010 at 09:39:43AM -0400, Ted Unangst wrote: > On Tue, Apr 20, 2010 at 7:04 AM, Alexander Hall wrote: > >> Set the encry

Re: Radius Auth and Insecurity Outputs

2010-04-20 Thread Ted Unangst
On Tue, Apr 20, 2010 at 7:04 AM, Alexander Hall wrote: >> Set the encrypted password to * >> > > Thank you Stuart for not recommending hacking away on /etc/security but > instad provide the "correct" answer. :-) > > And while the awk-literate audience might have noticed that any > 13-c

Re: Radius Auth and Insecurity Outputs

2010-04-20 Thread Stuart Henderson
On 2010/04/20 13:04, Alexander Hall wrote: > On 04/20/10 08:37, Stuart Henderson wrote: > > On 2010-04-19, Andrew Klettke wrote: > >> Hello all, > >> > >> I'm having a (cosmetic) problem with a couple of OpenBSD boxes that are > >> using RADIUS authentication. > >> > >> When I install the OS, I c

Re: Radius Auth and Insecurity Outputs

2010-04-20 Thread Alexander Hall
On 04/20/10 08:37, Stuart Henderson wrote: > On 2010-04-19, Andrew Klettke wrote: >> Hello all, >> >> I'm having a (cosmetic) problem with a couple of OpenBSD boxes that are >> using RADIUS authentication. >> >> When I install the OS, I create a local user with local authentication. >> After the

Re: Radius Auth and Insecurity Outputs

2010-04-19 Thread Stuart Henderson
On 2010-04-19, Andrew Klettke wrote: > Hello all, > > I'm having a (cosmetic) problem with a couple of OpenBSD boxes that are > using RADIUS authentication. > > When I install the OS, I create a local user with local authentication. > After the box's network config is all done, I then change the

Re: Radius Auth and Insecurity Outputs

2010-04-19 Thread Nicholas Marriott
Or just set the password to skey for radius users too? On Mon, Apr 19, 2010 at 06:04:22PM -0400, Ted Unangst wrote: > On Mon, Apr 19, 2010 at 5:42 PM, Andrew Klettke > wrote: > > You mean the "*" field? I've replaced that with "radius", as you suggested, > > so it looks like so: > > (removed):ra

Re: Radius Auth and Insecurity Outputs

2010-04-19 Thread Bryan Irvine
On Mon, Apr 19, 2010 at 3:09 PM, Andrew Klettke wrote: > Thanks again Ted, > > This is an ugly hack (and one that I'll have to keep performing with these > types of installs), but if it's the only way to get /etc/security to stop > complaining, then I guess that's what I'll have to do. Hi Andrew

Re: Radius Auth and Insecurity Outputs

2010-04-19 Thread Andrew Klettke
Thanks again Ted, This is an ugly hack (and one that I'll have to keep performing with these types of installs), but if it's the only way to get /etc/security to stop complaining, then I guess that's what I'll have to do. Thanks, Andrew Klettke Optic Fusion NOC 253-830-2943 Subscribe to Opt

Re: Radius Auth and Insecurity Outputs

2010-04-19 Thread Ted Unangst
On Mon, Apr 19, 2010 at 5:42 PM, Andrew Klettke wrote: > You mean the "*" field? I've replaced that with "radius", as you suggested, > so it looks like so: > (removed):radius:1000:10:radius:0:0:nocstaff:/home/(removed):/bin/ksh > > It works, the user can log in fine still; however, OpenBSD still i

Re: Radius Auth and Insecurity Outputs

2010-04-19 Thread Andrew Klettke
Ted, You mean the "*" field? I've replaced that with "radius", as you suggested, so it looks like so: (removed):radius:1000:10:radius:0:0:nocstaff:/home/(removed):/bin/ksh It works, the user can log in fine still; however, OpenBSD still isn't happy about it: Checking the /etc/master.passwd

Re: Radius Auth and Insecurity Outputs

2010-04-19 Thread Ted Unangst
On Mon, Apr 19, 2010 at 3:14 PM, Andrew Klettke wrote: > When I install the OS, I create a local user with local authentication. > After the box's network config is all done, I then change the login class of > the user to so I can use RADIUS, by modifying /etc/master.passwd with > `vipw', so it lo

Radius Auth and Insecurity Outputs

2010-04-19 Thread Andrew Klettke
Hello all, I'm having a (cosmetic) problem with a couple of OpenBSD boxes that are using RADIUS authentication. When I install the OS, I create a local user with local authentication. After the box's network config is all done, I then change the login class of the user to so I can use RADIUS