Ascend Archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: (ASCEND) ASCEND RADIUS FEATURE REQUEST
On Fri, 10 Oct 1997 ascend@digistar.com wrote:
> please hack the code to show the password that the user mistakenly typed
> in for their password... like so:
>
> Fri Oct 10 13:03:53 1997: Authenticate: 56k-1.getonthe.net.1026, id=185: Neither User Nor Default Name: joebloggs / joesmistype
Right... so anyone who manages to get ahold of your log files can figure out
what people's passwords are simply by studying their mistypes.
No, this is not a good idea, which is why no system I'm aware of (UNIX,
RADIUS, or otherwise) logs failed passwords. Some even give the option of
not logging failed usernames (in case someone typed his password in the
usename field), a feature I take advantage of.
--
Andrew O. Smith - aos@insync.net | "Reality is that which, when you stop
Sysadmin, Insync Internet Services | believing in it, doesn't go away."
BOFH, Wielder of the sacred LART | -- Philip K. Dick
++ Ascend Users Mailing List ++
To unsubscribe: send unsubscribe to ascend-users-request@bungi.com
To get FAQ'd: <http://www.nealis.net/ascend/faq>
Follow-Ups:
References: