Index: authserv.conf
===================================================================
RCS file: /cvsroot/NoCatAuth/authserv.conf,v
retrieving revision 1.1.1.1
retrieving revision 1.1.1.1.2.1
diff -u -r1.1.1.1 -r1.1.1.1.2.1
--- authserv.conf 23 Jun 2003 03:02:53 -0000 1.1.1.1
+++ authserv.conf 14 Jul 2003 16:13:43 -0000 1.1.1.1.2.1
@@ -230,6 +230,10 @@
#
# LocalGateway 192.168.1.7
+# RedirectTime -- Seconds to wait before redirecting after
+# login.
+RedirectTime = 5
+
# Auth service template names. See the individual templates
# for details on what each one does.
#
Index: gateway.conf
===================================================================
RCS file: /cvsroot/NoCatAuth/gateway.conf,v
retrieving revision 1.1.1.1
retrieving revision 1.5
diff -u -r1.1.1.1 -r1.5
--- gateway.conf 23 Jun 2003 03:02:53 -0000 1.1.1.1
+++ gateway.conf 25 Jun 2003 03:59:06 -0000 1.5
@@ -268,13 +268,14 @@
###### Other Common Gateway Options. (stuff you probably won't have to change)
#
-# ResetCmd, PermitCmd, DenyCmd -- Shell commands to reset,
+# ResetCmd, PermitCmd, DenyCmd, StatsCmd -- Shell commands to reset,
# open and close the firewall. You probably don't need to
# change these.
#
# ResetCmd initialize.fw
# PermitCmd access.fw permit $MAC $IP $Class
# DenyCmd access.fw deny $MAC $IP $Class
+# StatsCmd stats.fw $MAC $IP
##
# GatewayPort - The TCP port to bind the gateway
@@ -284,6 +285,11 @@
# GatewayPort 5280
##
+# GatewayAddr - The IP address to bind the gateway
+# service to.
+# GatewayAddr 127.0.0.1
+
+##
# PGPKeyPath -- The directory in which PGP keys are stored.
# NoCat tries to find this in the pgp/ directory above
# the bin/ parent directory. Set this only if you put it
@@ -314,5 +320,67 @@
# MaxMissedARP 2
#
# IdleTimeout 300
+
+
+##### Accounting method
+#
+# DataSource -- specifies what to authenticate against.
+# Possible values are DBI, RADIUS, File, Log, None
+#
+
+AccountingMethod None
+
+##### Accounting update timeout
+# Default 5 minutes. Set to 0 to disable.
+#
+
+AccountingUpdateInterval 300
+
+## File accounting support
+#
+# FileAccounting_Path /var/log/nocat_accounting.log
+
+## RADIUS support. Requires Authen::Radius to be installed from the CPAN.
+#
+# Right now, this support is totally experimental. Please send bug reports
+# and patches. The admin tools don't fully work with RADIUS support at the moment.
+#
+# The RADIUS_Host may by in a number of different formats and is required:
+#
+# RADIUS_Host radius.nocat.net
+# RADIUS_Host radius1.nocat.net,radius2.nocat.net,radius3.nocat.net
+# RADIUS_Host radius1.nocat.net:1645,radius2.nocat.net:1812,radius3.nocat.net
+#
+# The previous three examples are 1 host and multiple hosts (can be any number of
+# hosts separated by a comma) and finally with ports provided after a colon. (If
+# no port number is supplied, it uses the Authen::Radius default of the radius
+# service in /etc/services or 1645. Mixing entries with and without ports is
+# fine.) These examples require a RADIUS_Secret in the format:
+#
+# RADIUS_Secret sHHHH
+#
+# The other format is to use the RADIUS_Host with a secret after
+# the hostname seperated by a * such as the examples below. This
+# allows for different secrets on different hosts.
+#
+# RADIUS_Host radius1.nocat.net*secret1,radius2.nocat.net*secret2,radius3.nocat.net*secret3
+#
+# Alternatively, ports can also be used on any number of entries.
+# If the secret is not present, it uses the RADIUS_Secret.
+#
+# RADIUS_Host radius1.nocat.net:1645*secret1,radius2.nocat.net:1812,radius3.nocat.net*secret3
+#
+# RADIUS_TimeOut is optional and defaults to the Authen::Radius
+# default timeout.
+#
+# RADIUS_TimeOut 5
+#
+# Finally, RADIUS_Order controls the order in which RADIUS
+# servers are used. The acceptable values are "Ordered"
+# (the default) and Random (which will share the load
+# among the servers.
+#
+# RADIUS_Order Random
+# **** End RADIUS Configuration ****
### Fin!
Index: bin/checkrad
===================================================================
RCS file: bin/checkrad
diff -N bin/checkrad
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ bin/checkrad 5 Oct 2003 18:38:43 -0000 1.1
@@ -0,0 +1,23 @@
+#!/usr/bin/perl
+
+require HTTP::Request;
+require LWP::UserAgent;
+
+my $debug = true;
+
+# 192.168.0.1 0 foo 01058159212184670
+my ($nas, $user, $session) = @ARGV;
+
+my $request = HTTP::Request->new(GET => "http://$nas:5280/status");
+my $ua = LWP::UserAgent->new;
+my $response = $ua->request($request);
+
+#my $pattern = qr/foo/g;
+foreach ($response->content)
+{
+ print "DEBUG: $_" if $debug;
+ #exit 0 if /$pattern/;
+ exit 0 if /$session/;
+}
+
+exit 1;
Index: bin/gateway
===================================================================
RCS file: /cvsroot/NoCatAuth/bin/gateway,v
retrieving revision 1.1.1.1
retrieving revision 1.2
diff -u -r1.1.1.1 -r1.2
--- bin/gateway 23 Jun 2003 03:02:53 -0000 1.1.1.1
+++ bin/gateway 23 Jun 2003 03:04:18 -0000 1.2
@@ -79,7 +79,8 @@
END {
unless (getppid) {
- NoCat->log( 0, "Resetting firewall to initial settings." );
- NoCat->firewall->reset;
+ #NoCat->log( 0, "Resetting firewall to initial settings." );
+ #NoCat->firewall->reset;
+ $server->stop;
}
}
Index: cgi-bin/login
===================================================================
RCS file: /cvsroot/NoCatAuth/cgi-bin/login,v
retrieving revision 1.1.1.1
retrieving revision 1.2.2.2
diff -u -r1.1.1.1 -r1.2.2.2
--- cgi-bin/login 23 Jun 2003 03:02:53 -0000 1.1.1.1
+++ cgi-bin/login 14 Jul 2003 16:13:43 -0000 1.2.2.2
@@ -67,11 +67,16 @@
my $user = $authserv->user->fetch( $params->{user} );
$authserv->display( LoginForm => "LoginBadUser" ) unless $user->id;
- $authserv->display( LoginForm => "LoginBadPass" ) unless $user->authenticate( $params->{pass} );
+ $authserv->display( LoginForm => $user->reply_message ? $user->reply_message : "LoginBadPass" )
+ unless $user->authenticate( $params->{pass} , $authserv->gateway_ip );
# Set the service class based on the user's authorization (if any).
my $member = join( " ", $user->groups );
$params->{member} = $member if $member;
+
+ # Set the session timeout based on user's authorization (if any).
+ $params->{sessiontimeout} = $user->session_timeout;
+ $params->{idletimeout} = $user->idle_timeout;
}
# Finally, notify the gateway (and the user) as to the outcome.
Index: etc/checkrad.patch
===================================================================
RCS file: etc/checkrad.patch
diff -N etc/checkrad.patch
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ etc/checkrad.patch 5 Oct 2003 18:46:35 -0000 1.1
@@ -0,0 +1,32 @@
+--- checkrad.pl.in.old Sun Oct 5 11:42:15 2003
++++ checkrad.pl.in Sun Oct 5 11:42:22 2003
+@@ -1161,6 +1161,20 @@
+ ($login eq "$ARGV[3]\@$realm") ? 1 : 0;
+ }
+
++sub exec_extern
++{
++ my ($extern) = ($ARGV[0] =~ /^exec\|(.*)/);
++ my @args = @ARGV;
++ shift @args;
++
++ print LOG " exec extern $extern " . join(' ', @args) . "\n" if ($debug);
++ $ret = system($extern, @args) >> 8;
++ print LOG " exec extern returned $ret\n" if ($debug);
++ $ret = 2 if ($ret > 1);
++
++ return $ret;
++}
++
+
+ ###############################################################################
+
+@@ -1230,6 +1244,8 @@
+ $ret = &bay_finger;
+ } elsif ($ARGV[0] eq 'cisco_l2tp'){
+ $ret = &cisco_l2tp_snmp;
++} elsif ($ARGV[0] =~ /^exec\|/){
++ $ret = &exec_extern;
+ } elsif ($ARGV[0] eq 'other') {
+ $ret = 1;
+ } else {
Index: etc/clients.conf.sample
===================================================================
RCS file: etc/clients.conf.sample
diff -N etc/clients.conf.sample
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ etc/clients.conf.sample 5 Oct 2003 18:50:40 -0000 1.1
@@ -0,0 +1,11 @@
+#
+# SAPMLE: clients.conf - client configuration directives
+#
+#######################################################################
+
+client 192.168.0.1 {
+ secret = nocat
+ shortname = nocat
+ nastype = exec|/usr/local/nocat/bin/checknocat.pl
+}
+
Index: etc/dictionary.nocat
===================================================================
RCS file: etc/dictionary.nocat
diff -N etc/dictionary.nocat
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ etc/dictionary.nocat 27 Jun 2003 02:51:52 -0000 1.1
@@ -0,0 +1,16 @@
+#
+# The NoCat Vendor-Specific dictionary.
+#
+# For a complete list of Private Enterprise Codes, see:
+#
+# http://www.isi.edu/in-notes/iana/assignments/enterprise-numbers
+#
+
+VENDOR NoCat 32767
+
+BEGIN-VENDOR NoCat
+
+ATTRIBUTE NoCat-Groups 1 string # Space delimited list of groups
+ATTRIBUTE NoCat-Groups-Admin 2 string # Space delimited list of groups user is admin of
+
+END-VENDOR NoCat
Index: htdocs/login_ok.html
===================================================================
RCS file: /cvsroot/NoCatAuth/htdocs/login_ok.html,v
retrieving revision 1.1.1.1
retrieving revision 1.1.1.1.2.1
diff -u -r1.1.1.1 -r1.1.1.1.2.1
--- htdocs/login_ok.html 23 Jun 2003 03:02:53 -0000 1.1.1.1
+++ htdocs/login_ok.html 14 Jul 2003 16:13:43 -0000 1.1.1.1.2.1
@@ -1,7 +1,7 @@
Welcome, $user!
-
+