Remove authenticate section.

You should be using the PAP module, which does all of this.

diff --git a/raddb/README.rst b/raddb/README.rst
index 5bb956d..35f564d 100644 (file)
--- a/raddb/README.rst
+++ b/raddb/README.rst
@@ -187,6 +187,22 @@ It is otherwise unchanged.  You chould be able to copy your old
 ``eap.conf`` file directly to ``mods-enabled/eap``.
 
 
+Unix
+----
+
+The unix module does not have an "authenticate" section.  So you
+cannot set "Auth-Type := System".  The "unix" module has also been
+deleted from the examples in sites-available/.  Listing it there has
+been deprecated for many years.
+
+The PAP module can do crypt authentication.  It should be used instead
+of Unix authentication.
+
+The Unix module still can pull the passwords from /etc/passwd, or
+/etc/shadow.  This is done by listing it in the "authorize" section,
+as is done in the sites-available/ examples.
+
+
 RadSec
 ------
 

diff --git a/raddb/sites-available/default b/raddb/sites-available/default
index fde87b5..5c00490 100644 (file)
--- a/raddb/sites-available/default
+++ b/raddb/sites-available/default
@@ -435,19 +435,6 @@ authenticate {
        #  Pluggable Authentication Modules.
 #      pam
 
-       #
-       #  See 'man getpwent' for information on how the 'unix'
-       #  module checks the users password.  Note that packets
-       #  containing CHAP-Password attributes CANNOT be authenticated
-       #  against /etc/passwd!  See the FAQ for details.
-       #
-       #  For normal "crypt" authentication, the "pap" module should
-       #  be used instead of the "unix" module.  The "unix" module should
-       #  be used for authentication ONLY for compatibility with legacy
-       #  FreeRADIUS configurations.
-       #
-       unix
-
        #  Uncomment it if you want to use ldap for authentication
        #
        #  Note that this means "check plain-text password against

diff --git a/raddb/sites-available/inner-tunnel b/raddb/sites-available/inner-tunnel
index ce53e4f..65fba74 100644 (file)
--- a/raddb/sites-available/inner-tunnel
+++ b/raddb/sites-available/inner-tunnel
@@ -214,14 +214,6 @@ authenticate {
        #  Pluggable Authentication Modules.
 #      pam
 
-       #
-       #  See 'man getpwent' for information on how the 'unix'
-       #  module checks the users password.  Note that packets
-       #  containing CHAP-Password attributes CANNOT be authenticated
-       #  against /etc/passwd!  See the FAQ for details.
-       #  
-       unix
-
        # Uncomment it if you want to use ldap for authentication
        #
        # Note that this means "check plain-text password against

diff --git a/src/modules/rlm_unix/rlm_unix.c b/src/modules/rlm_unix/rlm_unix.c
index 16a0260..ce6f1e3 100644 (file)
--- a/src/modules/rlm_unix/rlm_unix.c
+++ b/src/modules/rlm_unix/rlm_unix.c
@@ -162,8 +162,7 @@ static int unix_instantiate(CONF_SECTION *conf, void **instance)
  *     Pull the users password from where-ever, and add it to
  *     the given vp list.
  */
-static int unix_getpw(UNUSED void *instance, REQUEST *request,
-                     VALUE_PAIR **vp_list)
+static rlm_rcode_t unix_authorize(UNUSED void *instance, REQUEST *request)
 {
        const char      *name;
        const char      *encrypted_pass;
@@ -304,76 +303,13 @@ static int unix_getpw(UNUSED void *instance, REQUEST *request,
        vp = pairmake("Crypt-Password", encrypted_pass, T_OP_SET);
        if (!vp) return RLM_MODULE_FAIL;
 
-       pairmove(vp_list, &vp);
-       pairfree(&vp);          /* might not be NULL; */
+       pairadd(&request->config_items, vp);
 
        return RLM_MODULE_UPDATED;
 }
 
 
 /*
- *     Pull the users password from where-ever, and add it to
- *     the given vp list.
- */
-static rlm_rcode_t unix_authorize(void *instance, REQUEST *request)
-{
-       return unix_getpw(instance, request, &request->config_items);
-}
-
-/*
- *     Pull the users password from where-ever, and add it to
- *     the given vp list.
- */
-static rlm_rcode_t unix_authenticate(void *instance, REQUEST *request)
-{
-#ifdef OSFSIA
-       char            *info[2];
-       char            *progname = "radius";
-       SIAENTITY       *ent = NULL;
-
-       info[0] = progname;
-       info[1] = NULL;
-       if (sia_ses_init (&ent, 1, info, NULL, name, NULL, 0, NULL) !=
-           SIASUCCESS)
-               return RLM_MODULE_NOTFOUND;
-       if ((ret = sia_ses_authent (NULL, passwd, ent)) != SIASUCCESS) {
-               if (ret & SIASTOP)
-                       sia_ses_release (&ent);
-               return RLM_MODULE_NOTFOUND;
-       }
-       if (sia_ses_estab (NULL, ent) != SIASUCCESS) {
-               sia_ses_release (&ent);
-               return RLM_MODULE_NOTFOUND;
-       }
-#else  /* OSFSIA */
-       int rcode;
-       VALUE_PAIR *vp = NULL;
-
-       if (!request->password ||
-           (request->password->da->attr != PW_USER_PASSWORD)) {
-               radlog_request(L_AUTH, 0, request, "Attribute \"User-Password\" is required for authentication.");
-               return RLM_MODULE_INVALID;
-       }
-
-       rcode = unix_getpw(instance, request, &vp);
-       if (rcode != RLM_MODULE_UPDATED) return rcode;
-
-       /*
-        *      0 means "ok"
-        */
-       if (fr_crypt_check((char *) request->password->vp_strvalue,
-                            (char *) vp->vp_strvalue) != 0) {
-               radlog_request(L_AUTH, 0, request, "invalid password \"%s\"",
-                              request->password->vp_strvalue);
-               return RLM_MODULE_REJECT;
-       }
-#endif /* OSFFIA */
-
-       return RLM_MODULE_OK;
-}
-
-
-/*
  *     UUencode 4 bits base64. We use this to turn a 4 byte field
  *     (an IP address) into 6 bytes of ASCII. This is used for the
  *     wtmp file if we didn't find a short name in the naslist file.
@@ -584,7 +520,7 @@ module_t rlm_unix = {
        unix_instantiate,               /* instantiation */
        unix_detach,                    /* detach */
        {
-               unix_authenticate,    /* authentication */
+               NULL,               /* authentication */
                unix_authorize,       /* authorization */
                NULL,            /* preaccounting */
                unix_accounting,      /* accounting */