LinuxQuestions.org
Visit the LQ Articles and Editorials section
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 09-29-2009, 03:41 AM   #1
lastmanstand
LQ Newbie
 
Registered: Jun 2009
Posts: 7

Rep: Reputation: 0
PAM_SSH and Freeradius2


Hi all,

Has anyone managed to find the solution on how to use PAM with FreeRadius to authenticate SSH where from "radiusd -X", you get some like below: -

rad_recv: Access-Request packet from host 127.0.0.1 port 6239, id=149, length=88
User-Name = "sqltest"
User-Password = "\010\n\r\177INCORRECT"
NAS-IP-Address = 127.0.0.1
NAS-Identifier = "sshd"
NAS-Port = 5214
NAS-Port-Type = Virtual
Service-Type = Authenticate-Only
Calling-Station-Id = "10.0.0.10"
.
.
.
Found Auth-Type = PAP
+- entering group PAP {...}
[pap] login attempt with password "? INCORRECT"
[pap] Using clear text password "testpwd"
[pap] Passwords don't match
++[pap] returns reject
Failed to authenticate the user.
WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS!
Using Post-Auth-Type Reject
+- entering group REJECT {...}

If you refer to the 2nd bold-ed sentence, you'll see that radius server is able to receive the password ("testpwd") but somehow could not make use of it to authenticate. Anyone has any idea how to "prioritize" the password sequence of whether it's possible?

I saw there's quite a lot of old threads either to have a central DB from radius server or from passwd file. From the looks of it, there's no issue using passwd file but problem arises when all user account is stored in radius server (this only applies to users file and not to a database). I also found old threads from the developer (Alan Dekok) that it is not the issue with PAM_Radius_Auth but PAM and SSH itself (refer to http://www.nabble.com/file-detail-td2481517.html). Some went unanswered.http://www.linuxquestions.org/questi...cation-495115/

Alan DeKok suggested to take a look on PAM mailing list to find how to rectify or to understand how PAM works.

BTW, my system config are: -
1. RHEL5
2. MySQL v5.0.86
3. FreeRadius 2.1.7

Please accept my apology for my naiveness and "noobness" if I stated anything mis-appropriate or stupid.

Last edited by lastmanstand; 09-29-2009 at 04:07 AM.
 
Old 09-29-2009, 04:30 AM   #2
lastmanstand
LQ Newbie
 
Registered: Jun 2009
Posts: 7

Original Poster
Rep: Reputation: 0
Additional thread from the developer (Alan DeKok) for your info...

http://lists.freeradius.org/pipermai.../msg00424.html
 
  


Reply

Tags
freeradius, pam


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



All times are GMT -5. The time now is 01:15 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration