FreeRADIUS/pam_radius — pull request #10 by walterdejong (2014-08-06 15:44:47+00:00)
Title: SURFsara fixes and changes

Hi,

Please review and accept my changes.

Most important change is a new command-line parameter "max_challenge=#". The trouble is, there are situations in which the (or our) RADIUS server keeps responding with Access-Challenge. `pam_radius_auth` reacts by sending a new Access-Request, and the server will again respond with Access-Challenge. This goes on forever, resulting in an endless loop.
I checked RFC 2865 and it seems correct behavior; the server may request another challenge if it wishes to do so. The RFC says nothing about trying a maximum number of times, and therefore the endless loop situation exists. (Or did I miss something?)

Our RADIUS server never sends Access-Reject, it always responds with Access-Challenge. (Who knows, maybe it's a server bug, or some kind of security feature).
Pressing Ctrl-C in sudo also results in the endless loop.

The other commits fix some smaller issues. Cherry-pick if you like.

Cheers,

--Walter