In short,
- You need to specify a password hash format instead of
Cleartext-Password, and
- You need to set
auth_goodpass and auth_badpass to 'no' to prevent logging passwords.
Specifying a hash format
As described in the rlm_pap man page, there are a number of password hash settings that can be used instead of Cleartext-Password. Let us take a simple example, MD5-Password:
#bob Cleartext-Password := "hello"
bob MD5-Password:= "7d793037a0760186574b0282f2f435e7"
Reply-Message := "Hello, %{User-Name}"
You can easily generate an md5 password hash like such:
$ echo -n world | md5sum | awk '{print $1}'
7d793037a0760186574b0282f2f435e7
$
When we test this against our server we see it authenticates:
$ radtest bob world localhost 1 testing123
Sent Access-Request Id 214 from 0.0.0.0:34920 to 127.0.0.1:1812 length 73
User-Name = "bob"
User-Password = "world"
NAS-IP-Address = 127.0.1.1
NAS-Port = 1
Message-Authenticator = 0x00
Cleartext-Password = "world"
Received Access-Accept Id 214 from 127.0.0.1:1812 to 127.0.0.1:34920 length 32
Reply-Message = "Hello, bob"
You can also specify your hash with the generic Password-With-Header option:
#bob Cleartext-Password := "hello"
bob Password-With-Header := "{md5}7d793037a0760186574b0282f2f435e7"
Reply-Message := "Hello, %{User-Name}"
This has the same effect as the MD5-Password version did. The list of accepted headers is on that rlm_pap man page.
One of the most interesting headers available is Crypt-Password because it will run password hashes through libcrypt and therefore will work with whatever hashes you find in /etc/shadow. For example, on a Debian system, yescrypt hashes:
bob Crypt-Password := "$y$j9T$2fOq6bdva3zoX6OfH.JvY0$PbUGbp1U.UXFAnGrkDrYnLZEDK.PXO/HXDsBn4mCsM8"
Reply-Message := "Hello, %{User-Name}"
(Password in this case is a38sgena)
Disabling logging of passwords
In order to disable logging of passwords, find the auth_goodpass and auth_badpass selections within the radiusd.conf file:
# Log passwords with the authentication requests.
# auth_badpass - logs password if it's rejected
# auth_goodpass - logs password if it's correct
#
# allowed values: {no, yes}
#
auth_badpass = no
auth_goodpass = no
Make sure those are set to 'no' and your logging will stop including passwords.
