pam radius for ssh guide - Revision history

Nighthawk: /* troubleshooting */

2017-10-15T14:41:16Z

‎troubleshooting

Nighthawk: /* links */

2017-10-15T14:29:50Z

‎links

Nighthawk: /* links */

2017-10-15T14:29:30Z

‎links

Nighthawk: /* links */

2017-10-15T14:29:15Z

‎links

Nighthawk: /* configure the radius client */

2017-10-15T14:28:20Z

‎configure the radius client

Nighthawk: /* configure the radius client */

2017-10-15T14:23:59Z

‎configure the radius client

Nighthawk: /* configure the radius client */

2017-10-15T14:22:59Z

‎configure the radius client

Nighthawk at 14:13, 15 October 2017

2017-10-15T14:13:34Z

Nighthawk: Created page with "==version info for this guide== gentoo package names and versions:
sys-libs/pam version 1.2.1
sys-auth/pam_radius version 1.3.17-r1
net-dialup/freeradius 3.0.14 ..."

2017-10-15T13:56:46Z

Created page with "==version info for this guide== gentoo package names and versions: sys-libs/pam version 1.2.1 sys-auth/pam_radius version 1.3.17-r1 net-dialup/freeradius 3.0.14 ..."

New page

==version info for this guide==
gentoo package names and versions:
 sys-libs/pam version 1.2.1
 sys-auth/pam_radius version 1.3.17-r1
 net-dialup/freeradius 3.0.14

==configuring the radius server==
1) install freeradius via your distributions package manager
2) define radius client in /etc/raddb/clients.conf
 example syntax...
client NAME {
ipaddr = IPADDRESS
secret = SECRET
}
3) Define a User and Password in /etc/raddb/users

I don't like cleartext passwords, so I used an encrypted hash as follows...

# '''radcrypt --md5 abc123'''
$1$orQvjGWz$wkQftz9uR4nmvT5V6vD7.0

where abc123 is an example password

the user jsmith was configured to utilize this password hash by adding a line to /etc/raddb/users
jsmith Crypt-Password := "$1$orQvjGWz$wkQftz9uR4nmvT5V6vD7.0"

4) start your radius server via your distro's mechanism

for gentoo it is /etc/init.d/radiusd start

Alan DeKok-2 is right. I had the same problem. The issue was that pam does multiple checks when you login. In my case, these are controlled by pam.d/sshd because I am trying to authenticate ssh.

specifically this check...
account, which checks for validity of the user account.

from the line that reads...
account include system-remote-login

What happens is the system checks to see if the account exists in preauth. Somehow that fails and my password is set to a string including "INCORRECT". When I create the account locally with useradd, then radius auth began succeeding. Next, I will look into a way to get around creating a local account.

pam version...

sys-libs/pam Installed versions: 1.2.1

@@ Line 84: / Line 84: @@
 ==links==
-[http://www.dslreports.com/forum/r26973260-FreeRADIUS-encrypted-passwords http://www.dslreports.com/forum/r26973260-FreeRADIUS-encrypted-passwords]
+[http://wiki.freeradius.org/guide/Basic-configuration-HOWTO Basic configuration HOWTO]
-<br>[http://wiki.freeradius.org/guide/Basic-configuration-HOWTO Basic configuration HOWTO]
+<br>[http://www.dslreports.com/forum/r26973260-FreeRADIUS-encrypted-passwords http://www.dslreports.com/forum/r26973260-FreeRADIUS-encrypted-passwords]
 <br>[https://99linux.wordpress.com/2013/05/03/ssh-authentication-using-pam-and-radius-in-linux/ https://99linux.wordpress.com/2013/05/03/ssh-authentication-using-pam-and-radius-in-linux]

@@ Line 85: / Line 85: @@
 ==links==
 [http://www.dslreports.com/forum/r26973260-FreeRADIUS-encrypted-passwords http://www.dslreports.com/forum/r26973260-FreeRADIUS-encrypted-passwords]
-[http://wiki.freeradius.org/guide/Basic-configuration-HOWTO Basic configuration HOWTO]
+<br>[http://wiki.freeradius.org/guide/Basic-configuration-HOWTO Basic configuration HOWTO]
-[https://99linux.wordpress.com/2013/05/03/ssh-authentication-using-pam-and-radius-in-linux/ https://99linux.wordpress.com/2013/05/03/ssh-authentication-using-pam-and-radius-in-linux]
+<br>[https://99linux.wordpress.com/2013/05/03/ssh-authentication-using-pam-and-radius-in-linux/ https://99linux.wordpress.com/2013/05/03/ssh-authentication-using-pam-and-radius-in-linux]

@@ Line 84: / Line 84: @@
 ==links==
-[http://www.dslreports.com/forum/r26973260-FreeRADIUS-encrypted-passwords]
+[http://www.dslreports.com/forum/r26973260-FreeRADIUS-encrypted-passwords http://www.dslreports.com/forum/r26973260-FreeRADIUS-encrypted-passwords]
-[http://wiki.freeradius.org/guide/Basic-configuration-HOWTO]
+[http://wiki.freeradius.org/guide/Basic-configuration-HOWTO Basic configuration HOWTO]
-[https://99linux.wordpress.com/2013/05/03/ssh-authentication-using-pam-and-radius-in-linux/]
+[https://99linux.wordpress.com/2013/05/03/ssh-authentication-using-pam-and-radius-in-linux/ https://99linux.wordpress.com/2013/05/03/ssh-authentication-using-pam-and-radius-in-linux]

← Older revision		Revision as of 14:28, 15 October 2017
Line 63:		Line 63:

	192.168.1.20 testing123 3		192.168.1.20 testing123 3
		+
		+	==test==
		+	ssh to your pam_radius client device using an account (that exists locally) using the radius password.

	==troubleshooting==		==troubleshooting==

@@ Line 33: / Line 33: @@
 ) install the pam_radius module for your distro
-) configure pam to use radius module by editing /etc/pamd.d/sshd file
+<br>2) configure pam to use radius module by editing /etc/pamd.d/sshd file
 add a line as that reads...

@@ Line 69: / Line 69: @@
 ==troubleshooting==
-specifically this check...
+work in progress...
-account, which checks for validity of the user account.
-−
-from the line that reads...
-account    include      system-remote-login
-−
-What happens is the system checks to see if the account exists in preauth.  Somehow that fails and my password is set to a string including "INCORRECT".  When I create the account locally with useradd, then radius auth began succeeding.  Next, I will look into a way to get around creating a local account.
-−
-pam version...
-−
-sys-libs/pam Installed versions:  1.2.1
 ==links==

@@ Line 49: / Line 49: @@
 This configuration example is a work in progress. It required the user account to exist locally. The account line above requires it. It also allows you to still login with local credentials.
 for more info on how the pam configuration files work, read the [https://linux.die.net/man/8/pam pam manpage]
 ==troubleshooting==

@@ Line 5: / Line 5: @@
 <br>net-dialup/freeradius 3.0.14
-==configuring the radius server==
+==configuring the radius server(freeradius)==
 ) install freeradius via your distributions package manager
 ) define radius client in /etc/raddb/clients.conf
@@ Line 29: / Line 29: @@
 for gentoo it is /etc/init.d/radiusd start
 Alan DeKok-2 is right.  I had the same problem.  The issue was that pam does multiple checks when you login. In my case, these are controlled by pam.d/sshd because I am trying to authenticate ssh.
@@ Line 47: / Line 68: @@
 sys-libs/pam Installed versions:  1.2.1

pam radius for ssh guide - Revision history

Nighthawk: /* troubleshooting */

Nighthawk: /* links */

Nighthawk: /* links */

Nighthawk: /* links */

Nighthawk: /* configure the radius client */

Nighthawk: /* configure the radius client */

Nighthawk: /* configure the radius client */

Nighthawk at 14:13, 15 October 2017

Nighthawk: Created page with "==version info for this guide== gentoo package names and versions: sys-libs/pam version 1.2.1 sys-auth/pam_radius version 1.3.17-r1 net-dialup/freeradius 3.0.14 ..."

Nighthawk: Created page with "==version info for this guide== gentoo package names and versions:
sys-libs/pam version 1.2.1
sys-auth/pam_radius version 1.3.17-r1
net-dialup/freeradius 3.0.14 ..."