unix module authentication doesn't work.....

Walter Tautz <wtautz@cs.uwaterloo.ca> · Tue, 22 Aug 2006 16:35:33 -0400 (EDT)

Hi, I have a freeradius server running on Ubuntu/Dapper/i386 platform.
Version: 1.1.0-1ubuntu2

I have a client which is Ubuntu/Dapper/amd64 architecture. I have

installed libpam-radius-auth and set it up with the server. 

Version: 1.3.16-4. NOTE. 64 bit AMD architecture.

What I am trying to do: 

======================

Use the /etc/shadow,/etc/passwd file
on the server for user authenticatication.

I have configure (on the client)
/etc/pam.d/common-auth with contents:

auth    sufficient      pam_unix.so nullok_secure
auth    required        pam_radius_auth.so debug

I setup /etc/pam_radius_auth.conf with 

IPaddress_of_server secret-string  3

where the secret string is typable by keyboard.

I added the relevant data to the server for this client.

Do I need to use the users file /etc/freeradius/users and put the user
in that? Doesn't seem to help.

Below I have included two logs, from the client, server and my radiusd.conf file
(no comments for the latter file).

------------ Log of /var/log/auth.log on client ------------
Aug 22 15:24:37 fe104 sshd[1745]: Invalid user test-walter from 129.97.15.20
Aug 22 15:24:37 fe104 sshd[1745]: Failed none for invalid user test-walter from 129.97.15.20 port 753 ssh2
Aug 22 15:24:41 fe104 sshd[1745]: (pam_unix) check pass; user unknown Aug 22 15:24:41 fe104 sshd[1745]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cscf.cs.uwaterloo.ca
Aug 22 15:24:41 fe104 sshd[1745]: pam_radius_auth: Got user name test-walter
Aug 22 15:24:41 fe104 sshd[1745]: pam_radius_auth: Got password ^H ^M\177INCORRECT
Aug 22 15:24:41 fe104 sshd[1745]: pam_radius_auth: Sending RADIUS request code 1
Aug 22 15:24:41 fe104 sshd[1745]: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned -1409445184.
Aug 22 15:24:43 fe104 sshd[1745]: pam_radius_auth: Got RADIUS response code 3
Aug 22 15:24:43 fe104 sshd[1745]: pam_radius_auth: authentication failed
Aug 22 15:24:45 fe104 sshd[1745]: Failed password for invalid user test-walter from 129.97.15.20 port 753 ssh2
Aug 22 15:26:35 fe104 sshd[1745]: fatal: Timeout before authentication for 129.97.15.20

-------- radius -X log on server -----------------------------------
Starting - reading configuration files ...
reread_config:  reading radiusd.conf
Config:   including file: /etc/freeradius/proxy.conf
Config:   including file: /etc/freeradius/clients.conf
Config:   including file: /etc/freeradius/snmp.conf
Config:   including file: /etc/freeradius/eap.conf
Config:   including file: /etc/freeradius/sql.conf
 main: prefix = "/usr"
 main: localstatedir = "/var"
 main: logdir = "/var/log/freeradius"
 main: libdir = "/usr/lib/freeradius"
 main: radacctdir = "/var/log/freeradius/radacct"
 main: hostname_lookups = no
 main: max_request_time = 30
 main: cleanup_delay = 5
 main: max_requests = 1024
 main: delete_blocked_requests = 0
 main: port = 0
 main: allow_core_dumps = no
 main: log_stripped_names = no
 main: log_file = "/var/log/freeradius/radius.log"
 main: log_auth = no
 main: log_auth_badpass = yes
 main: log_auth_goodpass = yes
 main: pidfile = "/var/run/freeradius/freeradius.pid"
 main: user = "freerad"
 main: group = "freerad"
 main: usercollide = no
 main: lower_user = "no"
 main: lower_pass = "no"
 main: nospace_user = "no"
 main: nospace_pass = "no"
 main: checkrad = "/usr/sbin/checkrad"
 main: proxy_requests = no
 proxy: retry_delay = 5
 proxy: retry_count = 3
 proxy: synchronous = no
 proxy: default_fallback = yes
 proxy: dead_time = 120
 proxy: post_proxy_authorize = no
 proxy: wake_all_if_all_dead = no
 security: max_attributes = 200
 security: reject_delay = 1
 security: status_server = no
 main: debug_level = 0
read_config_files:  reading dictionary
read_config_files:  reading naslist
Using deprecated naslist file.  Support for this will go away soon.
read_config_files:  reading clients
read_config_files:  reading realms
radiusd:  entering modules setup
Module: Library search path is /usr/lib/freeradius
Module: Loaded exec
 exec: wait = yes
 exec: program = "(null)"
 exec: input_pairs = "request"
 exec: output_pairs = "(null)"
 exec: packet_type = "(null)"
rlm_exec: Wait=yes but no output defined. Did you mean output=none?

Module: Instantiated exec (exec) 

Module: Loaded expr 

Module: Instantiated expr (expr) 

Module: Loaded PAP

 pap: encryption_scheme = "md5"

Module: Instantiated pap (pap) 

Module: Loaded CHAP 

Module: Instantiated chap (chap) 

Module: Loaded MS-CHAP

 mschap: use_mppe = yes
 mschap: require_encryption = no
 mschap: require_strong = no
 mschap: with_ntdomain_hack = no
 mschap: passwd = "(null)"
 mschap: authtype = "MS-CHAP"
 mschap: ntlm_auth = "(null)"

Module: Instantiated mschap (mschap) 

Module: Loaded System

 unix: cache = no
 unix: passwd = "/etc/passwd"
 unix: shadow = "/etc/shadow"
 unix: group = "/etc/group"
 unix: radwtmp = "NULL"
 unix: usegroup = no
 unix: cache_reload = 600

Module: Instantiated unix (unix) 

Module: Loaded eap

 eap: default_eap_type = "md5"
 eap: timer_expire = 60
 eap: ignore_unknown_eap_types = no
 eap: cisco_accounting_username_bug = no
rlm_eap: Loaded and initialized type md5
rlm_eap: Loaded and initialized type leap
 gtc: challenge = "Password: "
 gtc: auth_type = "PAP"
rlm_eap: Loaded and initialized type gtc
 mschapv2: with_ntdomain_hack = no
rlm_eap: Loaded and initialized type mschapv2

Module: Instantiated eap (eap) 

Module: Loaded preprocess

 preprocess: huntgroups = "/etc/freeradius/huntgroups"
 preprocess: hints = "/etc/freeradius/hints"
 preprocess: with_ascend_hack = no
 preprocess: ascend_channels_per_line = 23
 preprocess: with_ntdomain_hack = no
 preprocess: with_specialix_jetstream_hack = no
 preprocess: with_cisco_vsa_hack = no

Module: Instantiated preprocess (preprocess) 

Module: Loaded realm

 realm: format = "suffix"
 realm: delimiter = "@"
 realm: ignore_default = no
 realm: ignore_null = no

Module: Instantiated realm (suffix) 

Module: Loaded files

 files: usersfile = "/etc/freeradius/users"
 files: acctusersfile = "/etc/freeradius/acct_users"
 files: preproxy_usersfile = "/etc/freeradius/preproxy_users"
 files: compat = "no"

Module: Instantiated files (files) 

Module: Loaded Acct-Unique-Session-Id

 acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"

Module: Instantiated acct_unique (acct_unique) 

Module: Loaded detail

 detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d"
 detail: detailperm = 384
 detail: dirperm = 493
 detail: locking = no

Module: Instantiated detail (detail) 

Module: Loaded radutmp

 radutmp: filename = "/var/log/freeradius/radutmp"
 radutmp: username = "%{User-Name}"
 radutmp: case_sensitive = yes
 radutmp: check_with_nas = yes
 radutmp: perm = 384
 radutmp: callerid = yes

Module: Instantiated radutmp (radutmp) 

Listening on authentication *:1812

Listening on accounting *:1813
Ready to process requests.
rad_recv: Access-Request packet from host 129.97.152.227:2770, id=124, length=102
	User-Name = "test-walter"
	User-Password = "\010\n\rINCORRECT"
	NAS-IP-Address = 129.97.152.227
	NAS-Identifier = "ssh"
	NAS-Port = 1745
	NAS-Port-Type = Virtual
	Service-Type = Authenticate-Only
	Calling-Station-Id = "cscf.cs.uwaterloo.ca"
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 0
  modcall[authorize]: module "preprocess" returns ok for request 0
  modcall[authorize]: module "chap" returns noop for request 0
  modcall[authorize]: module "mschap" returns noop for request 0
    rlm_realm: No '@' in User-Name = "test-walter", looking up realm NULL
    rlm_realm: No such realm "NULL"
  modcall[authorize]: module "suffix" returns noop for request 0
  rlm_eap: No EAP-Message, not doing EAP
  modcall[authorize]: module "eap" returns noop for request 0
    users: Matched entry DEFAULT at line 152
  modcall[authorize]: module "files" returns ok for request 0
modcall: leaving group authorize (returns ok) for request 0
  rad_check_password:  Found Auth-Type System
auth: type "System"
  Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 0
rlm_unix: [test-walter]: invalid password
  modcall[authenticate]: module "unix" returns reject for request 0
modcall: leaving group authenticate (returns reject) for request 0
auth: Failed to validate the user.
  WARNING: Unprintable characters in the password. ?  Double-check the shared secret on the server and the NAS!
Delaying request 0 for 1 seconds
Finished request 0
Going to the next request
--- Walking the entire request list ---
Waking up in 1 seconds...
--- Walking the entire request list ---
Waking up in 1 seconds...
--- Walking the entire request list ---
Sending Access-Reject of id 124 to 129.97.152.227 port 2770
Waking up in 4 seconds...
--- Walking the entire request list ---
Cleaning up request 0 ID 124 with timestamp 44eb54e1
Nothing to do.  Sleeping until we see a request.
---------------------- end of radius -X log -------------------

my radiusd.conf (egrep -v '^	 *#|^$' /etc/freeradius/radiusd.conf:

prefix = /usr
exec_prefix = /usr
sysconfdir = /etc
localstatedir = /var
sbindir = ${exec_prefix}/sbin
logdir = /var/log/freeradius
raddbdir = /etc/freeradius
radacctdir = ${logdir}/radacct
confdir = ${raddbdir}
run_dir = ${localstatedir}/run/freeradius
log_file = ${logdir}/radius.log
libdir = /usr/lib/freeradius
pidfile = ${run_dir}/freeradius.pid
user = freerad
group = freerad
max_request_time = 30
delete_blocked_requests = no
cleanup_delay = 5
max_requests = 1024
bind_address = *
port = 0
hostname_lookups = no
allow_core_dumps = no
regular_expressions	= yes
extended_expressions	= yes
log_stripped_names = no
log_auth = no
log_auth_badpass = yes
log_auth_goodpass = yes
usercollide = no
lower_user = no
lower_pass = no
nospace_user = no
nospace_pass = no
checkrad = ${sbindir}/checkrad
security {
	max_attributes = 200
	reject_delay = 1
	status_server = no
}
proxy_requests  = no
$INCLUDE  ${confdir}/proxy.conf
$INCLUDE  ${confdir}/clients.conf
snmp	= no
$INCLUDE  ${confdir}/snmp.conf
thread pool {
	start_servers = 5
	max_servers = 32
	min_spare_servers = 3
	max_spare_servers = 10
	max_requests_per_server = 0
}
modules {
	pap {
		encryption_scheme = md5
	}
	chap {
		authtype = CHAP
	}
	pam {
		pam_auth = radiusd
	}
	unix {
		cache = no
		cache_reload = 600
		passwd = /etc/passwd
		shadow = /etc/shadow
		group = /etc/group
	}
$INCLUDE ${confdir}/eap.conf
	mschap {
		authtype = MS-CHAP

	}
	ldap {
		server = "ldap.your.domain"
		basedn = "o=My Org,c=UA"
		filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"
		start_tls = no
		access_attr = "dialupAccess"
		dictionary_mapping = ${raddbdir}/ldap.attrmap
		ldap_connections_number = 5
		timeout = 4
		timelimit = 3
		net_timeout = 1
	}
	realm IPASS {
		format = prefix
		delimiter = "/"
		ignore_default = no
		ignore_null = no
	}
	realm suffix {
		format = suffix
		delimiter = "@"
		ignore_default = no
		ignore_null = no
	}
	realm realmpercent {
		format = suffix
		delimiter = "%"
		ignore_default = no
		ignore_null = no
	}
	realm ntdomain {
		format = prefix
		delimiter = "\\"
		ignore_default = no
		ignore_null = no
	}
	checkval {
		item-name = Calling-Station-Id
		check-name = Calling-Station-Id
		data-type = string
	}

	preprocess {
		huntgroups = ${confdir}/huntgroups
		hints = ${confdir}/hints
		with_ascend_hack = no
		ascend_channels_per_line = 23
		with_ntdomain_hack = no
		with_specialix_jetstream_hack = no
		with_cisco_vsa_hack = no
	}
	files {
		usersfile = ${confdir}/users
		acctusersfile = ${confdir}/acct_users
		preproxy_usersfile = ${confdir}/preproxy_users
		compat = no
	}
	detail {
		detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d
		detailperm = 0600
	}
	acct_unique {
		key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
	}
	$INCLUDE  ${confdir}/sql.conf

	radutmp {
		filename = ${logdir}/radutmp
		username = %{User-Name}
		case_sensitive = yes
		check_with_nas = yes
		perm = 0600
		callerid = "yes"
	}
	radutmp sradutmp {
		filename = ${logdir}/sradutmp
		perm = 0644
		callerid = "no"
	}
	attr_filter {
		attrsfile = ${confdir}/attrs
	}
	counter daily {
		filename = ${raddbdir}/db.daily
		key = User-Name
		count-attribute = Acct-Session-Time
		reset = daily
		counter-name = Daily-Session-Time
		check-name = Max-Daily-Session
		allowed-servicetype = Framed-User
		cache-size = 5000
	}
	sqlcounter dailycounter {
		counter-name = Daily-Session-Time
		check-name = Max-Daily-Session
		sqlmod-inst = sql
		key = User-Name
		reset = daily
		query = "SELECT SUM(AcctSessionTime - \
		 GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \
		 FROM radacct WHERE UserName='%{%k}' AND \
		 UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'"
	}
	sqlcounter monthlycounter {
		counter-name = Monthly-Session-Time
		check-name = Max-Monthly-Session
		sqlmod-inst = sql
		key = User-Name
		reset = monthly
		query = "SELECT SUM(AcctSessionTime - \
		 GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \
		 FROM radacct WHERE UserName='%{%k}' AND \
		 UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'"
	}
	always fail {
		rcode = fail
	}
	always reject {
		rcode = reject
	}
	always ok {
		rcode = ok
		simulcount = 0
		mpp = no
	}
	expr {
	}
	digest {
	}
	exec {
		wait = yes
		input_pairs = request
	}
	exec echo {
		wait = yes
		program = "/bin/echo %{User-Name}"
		input_pairs = request
		output_pairs = reply
	}
	ippool main_pool {
		range-start = 192.168.1.1
		range-stop = 192.168.3.254
		netmask = 255.255.255.0
		cache-size = 800
		session-db = ${raddbdir}/db.ippool
		ip-index = ${raddbdir}/db.ipindex
		override = no
		maximum-timeout = 0
	}
}
instantiate {
	exec
	expr
}
authorize {
	preprocess

	chap
	mschap
	suffix
	eap
	files
}
authenticate {
	Auth-Type PAP {
		pap
	}
	Auth-Type CHAP {
		chap
	}
	Auth-Type MS-CHAP {
		mschap
	}
	unix
	eap
}
preacct {
	preprocess
	acct_unique
	suffix
	files
}
accounting {
	detail
	unix
	radutmp
}
session {
	radutmp
}
post-auth {
}
pre-proxy {
}
post-proxy {
	eap
}
----------------end of /etc/freeradius/radiusd.conf -------------------------------