Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've installed and configured a radius server upon my localhost - it is delegating auth to a remote LDAP server.

Initially things look good: I can test via the console:

# export user=skemp
# export pass=xxx
# radtest $user $pass localhost 1812 $secret
Sending Access-Request of id 185 to 127.0.0.1 port 1812
    User-Name = "skemp"
    User-Password = "xxx"
    NAS-IP-Address = 192.168.1.168
    NAS-Port = 1812
rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=185,

Similarly I can use the login tool to do the same thing:

bash-4.0# /usr/libexec/auth/login_radius -d -s login $user radius
Password: $pass
authorize

However remote logins via SSH are failing, and so are invokations of "login" started by root. Looking at /var/log/radiusd.log I see no actual log of success/failure which I do see when using either of the previous tools.

Instead sshd is just logging:

 sshd[23938]: Failed publickey for skemp from 192.168.1.9
 sshd[23938]: Failed keyboard-interactive for skemp from 192.168.1.9 port 36259 ssh2
 sshd[23938]: Failed password for skemp from 192.168.1.9 port 36259 ssh2

In /etc/login.conf I have this:

# Default allowed authentication styles
auth-defaults:auth=radius:

...

radius:\
    :auth=radius:\
    :radius-server=localhost:\
    :radius-port=1812:\
    :radius-timeout=1:\
    :radius-retries=5:
share|improve this question

1 Answer 1

I had similar issues with configuring OpenBSD to deligate authentications to a ldap server. The only way I could get it to work was by adding a user to the local db, e.g.

useradd -s /bin/ksh -L ldap new_user

In your case, it would be something like

useradd -s /bin/ksh -L radius new_user2

However, since you have to manually create a user entry for each machine that is using ldap for authentication, it would undermine the need for a centralized ldap authentication server. I am also out of ideas.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.