Local credentials used when radius server is available sshd pam_radius

Question

I have pam_radius setup and it works (centos6, pam_radius: 1.4.0-2.el6), i can authenticate via the radius server using ssh. What i am trying to accomplish is that when the radius server is unavailable to fall back to a local account. The two passwords are different (local vs AD) as AD has a more strict password change policy. I tried a few things: /etc/pam.d/sshd

auth sufficient pam_radius_auth.so debug
auth include password-auth

Now this works as long as the radius server (as defined in "/etc/pam_radius.conf") is unavailable (used a faulty IP in pam_radius.conf).
The challenge starts when the radius server is actually available, i am able to login using both the radius and the local authentication credentials.
I have two questions.

1. I am in misunderstanding of the (PAM) module failure, failure could maybe also be failure to authenticate like a wrong password,or when the user is not a valid or present on the AD server. What is meant with module failure?
2. Is there a way to set this up like i would like to have it set up? i.e only fall back to local authentication when the radius server connection fails?

Or.. maybe the normal method is to not have local passwords and use a fallback account that is not a AD account, so that when all things fail this account could be used. the question then becomes how to prevent people using this account when radius is available.

Answer 1

1. I am in misunderstanding of the (PAM) module failure, failure could maybe also be failure to authenticate like a wrong password,or when the user is not a valid or present on the AD server. What is meant with module failure?

Failure in this context means "the module returned any status other than success". The list of errors can be found in man pam.conf, or in /usr/include/security/_pam_types.h.

The most common case of failure is failure to authenticate.

2. Is there a way to set this up like i would like to have it set up? i.e only fall back to local authentication when the radius server connection fails?

If you want behavior specific to a certain type of error, there are two requirements:

1. You must use the more advanced PAM syntax.
2. You must know the exact error code that you require special handling for.

Problem #1 is tricky but surmountable. Problem #2 requires more research. Either the module must document the exact errors it will return and in which circumstances, or you'll have to figure it out yourself. The latter typically involves digging through the source code.

Researching the exact behaviors of this PAM module exceeds the immediate scope of the question, and I'm a little short on time at the moment besides. :)