Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to configure ssh with my custom radius server for authentication.

So what i want is, First it should authenticate with current ssh login (unix login) and then prompt user for second password for radius.

I am setting up /etc/pam.d/sshd as follows

auth        required    pam_unix.so debug

**auth       sufficient   /lib/security/pam_radius_auth.so  debug conf=/home/pam_radius try_first_pass**

But then my first authentication does not happen at all. It immediately goes for radius.

As per pam_radius ..try_first_pass

....If there was no previous password, or the previous password fails authentication, prompt the user with "Enter RADIUS password: ", and ask for another password. Try this password, and return success/failure as appropriate.

share|improve this question
add comment

2 Answers

I can't reply to the comments of the other answer, but have you tried setting both auth lines to required instead of having radius be set as sufficient?

share|improve this answer
    
That's a good place to start. They are both required, after all; just radius is not to be considered sufficient. –  apenwarr Feb 16 '10 at 19:10
add comment

i think your ssh login fails and then directly goes to the radius authentication. what happens when you enter a radius passwort? when my guess is correct your auth should fail, no matter whether you enter a correct or false password for your radius auth.

to debug this problem a bit more, please post your debug output.

you should disable your radius auth to be sure your ssh auth is working.

share|improve this answer
    
Hi, Thanks for reply. What i want is other-way. if pam_unix login is successful then go for radius. (That is 2 factor authentication) (I also tried changing "auth required" to "requisite") In my case, it does not do first authentication with pam_unix at all. It immediately goes to radius. 1. If i remove radius from stack. It does do unix authentication . 2. If i remove pam_unix, same behaviour as mentioned. It goes to radius auth 3. If I keep pam_unix AFTER radius, If radius auth fails, it does unix auth. (What i want is other way round. First do unixAuth, if success, do radius auth.) –  Jigar Shah Jan 25 '10 at 6:00
    
"what happens when you enter a radius password" - It passes. "you should disable your radius auth to be sure your ssh auth is working." - yes it works. In curx, problem is, when pam_unix is first, It does not go through pam_unix (or it does but no debug. I have enabled debug. Posting them) –  Jigar Shah Jan 25 '10 at 6:41
    
/var/log/secure Jan 25 12:26:28 jigarnb sshd[10686]: pam_radius_auth: Got user name jigar Jan 25 12:26:28 jigarnb sshd[10686]: pam_radius_auth: Got password <****> Jan 25 12:26:28 jigarnb sshd[10686]: pam_radius_auth: Sending RADIUS request code 1 Jan 25 12:26:28 jigarnb sshd[10686]: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned 8089344. Jan 25 12:26:28 jigarnb sshd[10686]: pam_radius_auth: Got RADIUS response code 3 Jan 25 12:26:28 jigarnb sshd[10686]: pam_radius_auth: authentication failed –  Jigar Shah Jan 25 '10 at 6:58
    
Jan 25 12:26:28 jigarnb sshd[10686]: Accepted password for jigar from 192.168.0.39 port 5604 ssh2 Jan 25 12:26:28 jigarnb sshd[10686]: pam_unix(sshd:session): session opened for user jigar by (uid=0) –  Jigar Shah Jan 25 '10 at 6:59
    
As of logs, It says "It tried with radius, but failed so used unix" But why ? My unix stack is at the top ? Why it tried with radius first ? –  Jigar Shah Jan 25 '10 at 7:40
show 9 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.