[Help-gnu-radius] Adding lockout capability

[David Beards]

Hi Everyone,

I'm seeking some assistance on how I can achieve the following.

I've configured GNU RADIUS v1.2 to use authentication using the system 
method and authenticating against the standard UNIX password file.

What I would like to do for security purposes is lock users out if they 
use the incorrect password when trying to connect. From what I can see 
checking if they have failed before and clearing the fail if less than 
four attempts has been reached is easy by using Exec-Program-Wait after 
they have authenticated and using a simple shell script.

e.g. the USERS file looks like this:

DEFAULT Auth-Type = System,
                Simultaneous-Use = 1
        Exec-Program-Wait = "/usr/local/sbin/failedtest"
        Service-Type = Framed-User,
                Framed-Protocol = PPP

The question I have is how can I modify the file if a failed 
authentication occurs? At the moment if the user fails with an incorrect 
password RADIUS fails them and the "failedtest" script is never executed.

Any and all help would be appreciated.

David Beards
Technical Manager Networks and Systems
CFA
Ph: +61 3 9262 8204
Fax: +61 3 9262 8383
Mobile: +61 419 519 366