5

I am trying to configure ssh with my custom radius server for authentication.

So what i want is, First it should authenticate with current ssh login (unix login) and then prompt user for second password for radius.

I am setting up /etc/pam.d/sshd as follows

auth        required    pam_unix.so debug

**auth       sufficient   /lib/security/pam_radius_auth.so  debug conf=/home/pam_radius try_first_pass**

But then my first authentication does not happen at all. It immediately goes for radius.

As per pam_radius ..try_first_pass

....If there was no previous password, or the previous password fails authentication, prompt the user with "Enter RADIUS password: ", and ask for another password. Try this password, and return success/failure as appropriate.

2 Answers 2

1

I can't reply to the comments of the other answer, but have you tried setting both auth lines to required instead of having radius be set as sufficient?

1
  • That's a good place to start. They are both required, after all; just radius is not to be considered sufficient.
    – apenwarr
    Feb 16, 2010 at 19:10
0

i think your ssh login fails and then directly goes to the radius authentication. what happens when you enter a radius passwort? when my guess is correct your auth should fail, no matter whether you enter a correct or false password for your radius auth.

to debug this problem a bit more, please post your debug output.

you should disable your radius auth to be sure your ssh auth is working.

14
  • Hi, Thanks for reply. What i want is other-way. if pam_unix login is successful then go for radius. (That is 2 factor authentication) (I also tried changing "auth required" to "requisite") In my case, it does not do first authentication with pam_unix at all. It immediately goes to radius. 1. If i remove radius from stack. It does do unix authentication . 2. If i remove pam_unix, same behaviour as mentioned. It goes to radius auth 3. If I keep pam_unix AFTER radius, If radius auth fails, it does unix auth. (What i want is other way round. First do unixAuth, if success, do radius auth.)
    – Jigar Shah
    Jan 25, 2010 at 6:00
  • "what happens when you enter a radius password" - It passes. "you should disable your radius auth to be sure your ssh auth is working." - yes it works. In curx, problem is, when pam_unix is first, It does not go through pam_unix (or it does but no debug. I have enabled debug. Posting them)
    – Jigar Shah
    Jan 25, 2010 at 6:41
  • /var/log/secure Jan 25 12:26:28 jigarnb sshd[10686]: pam_radius_auth: Got user name jigar Jan 25 12:26:28 jigarnb sshd[10686]: pam_radius_auth: Got password <****> Jan 25 12:26:28 jigarnb sshd[10686]: pam_radius_auth: Sending RADIUS request code 1 Jan 25 12:26:28 jigarnb sshd[10686]: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned 8089344. Jan 25 12:26:28 jigarnb sshd[10686]: pam_radius_auth: Got RADIUS response code 3 Jan 25 12:26:28 jigarnb sshd[10686]: pam_radius_auth: authentication failed
    – Jigar Shah
    Jan 25, 2010 at 6:58
  • Jan 25 12:26:28 jigarnb sshd[10686]: Accepted password for jigar from 192.168.0.39 port 5604 ssh2 Jan 25 12:26:28 jigarnb sshd[10686]: pam_unix(sshd:session): session opened for user jigar by (uid=0)
    – Jigar Shah
    Jan 25, 2010 at 6:59
  • As of logs, It says "It tried with radius, but failed so used unix" But why ? My unix stack is at the top ? Why it tried with radius first ?
    – Jigar Shah
    Jan 25, 2010 at 7:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .