I have a cisco router providing an SSL VPN server which is talking to freeradius, which in turn uses pam and two pam modules (sss & yubico) to provide two factor authentication for the VPN.
All is good in the world and it does work, except that for this to work i need to concatenate the user's password and the yubikey token together into one response. My users would prefer a two stage password and challenge response (mostly for reasons of 'its too confusing'). Can this be done ?
At the moment i've got one radius authentication config section which specifies to use the pam radius module as backend. I'm very new to radius but i think i could use the pam module twice in two separate "phases" and give a differing pam_auth each time, so that two different pam config files are used, with each backed onto a single pam module (IPA on one, yubikey on the other) ? I'd be relying on pam twice because freeradius supports neither yubikey nor sss out the box (i know it supports ldap but i want sss to gain dns SRV record failover etc).
I'm not sure if this is even possible, and i've not had any luck finding somewhere that it's documented ?
freeradius obviously has a lot of config files, but if any are crucial to know i can post them up.