<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2800.1106" name=GENERATOR></HEAD>
<BODY>
<DIV><FONT face=Verdana size=1><SPAN class=684122818-16012006>Hi
!</SPAN></FONT></DIV>
<DIV><FONT face=Verdana size=1><SPAN
class=684122818-16012006></SPAN></FONT> </DIV>
<DIV><FONT face=Verdana size=1><SPAN class=684122818-16012006>I was asked to
create a network based authentication system for the linux servers of
my company. </SPAN></FONT></DIV>
<DIV><FONT face=Verdana size=1><SPAN class=684122818-16012006>i have chosen
radius and the FreeRadius server to authenticate Admins/ DBAs/Developers on
the servers.</SPAN></FONT></DIV>
<DIV><FONT face=Verdana size=1><SPAN
class=684122818-16012006></SPAN></FONT> </DIV>
<DIV><FONT face=Verdana size=1><SPAN class=684122818-16012006>I'm using
FreeR</SPAN></FONT><FONT face=Verdana size=1><SPAN
class=684122818-16012006>adius server and pam_radius authentication on the
servers I want to autheticate the users on.</SPAN></FONT></DIV>
<DIV><FONT face=Verdana size=1><SPAN
class=684122818-16012006></SPAN></FONT> </DIV>
<DIV><FONT face=Verdana size=1><SPAN class=684122818-16012006>I have created a
default account :</SPAN></FONT></DIV>
<DIV><FONT face=Verdana size=1><SPAN
class=684122818-16012006></SPAN></FONT> </DIV>
<DIV><FONT face=Verdana size=1><SPAN class=684122818-16012006>login :
test</SPAN></FONT></DIV>
<DIV><FONT face=Verdana size=1><SPAN class=684122818-16012006>paswd : test
</SPAN></FONT></DIV>
<DIV><FONT face=Verdana size=1><SPAN
class=684122818-16012006></SPAN></FONT> </DIV>
<DIV><FONT face=Verdana size=1><SPAN class=684122818-16012006>on the radius
server</SPAN></FONT></DIV>
<DIV><FONT face=Verdana size=1><SPAN
class=684122818-16012006></SPAN></FONT> </DIV>
<DIV><FONT face=Verdana size=1><SPAN class=684122818-16012006>As advised I ran
the FreeRasius server in the debug mode. The following shows the last lines once
I have started the server :</SPAN></FONT></DIV>
<DIV><FONT face=Verdana size=1><SPAN
class=684122818-16012006></SPAN></FONT> </DIV>
<DIV><FONT face=Verdana size=1><SPAN class=684122818-16012006>Module:
Instantiated radutmp (radutmp)<BR>Listening on authentication
*:1812<BR>Listening on accounting *:1813<BR>Ready to process
requests.</SPAN></FONT></DIV>
<DIV><FONT face=Verdana size=1></FONT> </DIV>
<DIV><FONT face=Verdana size=1><SPAN class=684122818-16012006>I have configured
my PAM module sshd in /etc/pam.d/ssh to be (on the machines I want to be
authenticate):</SPAN></FONT></DIV>
<DIV><FONT face=Verdana size=1><SPAN
class=684122818-16012006></SPAN></FONT> </DIV>
<DIV><FONT face=Verdana size=1><SPAN
class=684122818-16012006>#%PAM-1.0<BR>auth
sufficient /lib/security/pam_radius_auth.so<BR>auth
required /lib/security/pam_stack.so
service=system-auth<BR>auth
required
/lib/security/pam_nologin.so<BR>account
required /lib/security/pam_stack.so
service=system-auth<BR>password required
/lib/security/pam_stack.so service=system-auth<BR>session
required /lib/security/pam_stack.so
service=system-auth<BR>session
required
/lib/security/pam_limits.so<BR>session
optional
/lib/security/pam_console.so<BR></SPAN></FONT></DIV>
<DIV><FONT face=Verdana size=1><SPAN class=684122818-16012006>I try so ssh to
the box I want to be authenticated on : </SPAN></FONT></DIV>
<DIV><FONT face=Verdana size=1><SPAN
class=684122818-16012006></SPAN></FONT> </DIV>
<DIV><FONT face=Verdana size=1><SPAN class=684122818-16012006>ssh <A
href="mailto:test@machine_of_the_test">test@machine_of_the_test</A></SPAN></FONT></DIV>
<DIV><FONT face=Verdana size=1><SPAN
class=684122818-16012006></SPAN></FONT> </DIV>
<DIV><FONT face=Verdana size=1><SPAN class=684122818-16012006>The login name I
used is : test</SPAN></FONT></DIV>
<DIV><FONT face=Verdana size=1><SPAN class=684122818-16012006>passwd :
test</SPAN></FONT></DIV>
<DIV><FONT face=Verdana size=1><SPAN
class=684122818-16012006></SPAN></FONT> </DIV>
<DIV><FONT face=Verdana size=1><SPAN class=684122818-16012006>But when I see the
incoming request, I can't see that the login name is "test" but is : User-Name =
"NOUSER"<BR></SPAN></FONT></DIV>
<DIV><FONT face=Verdana size=1><SPAN class=684122818-16012006>What's wrong
?</SPAN></FONT></DIV>
<DIV><FONT face=Verdana size=1><SPAN
class=684122818-16012006></SPAN></FONT> </DIV>
<DIV><FONT face=Verdana size=1><SPAN class=684122818-16012006>Thank you for your
help</SPAN></FONT></DIV>
<DIV><FONT face=Verdana size=1><SPAN
class=684122818-16012006></SPAN></FONT> </DIV>
<DIV><FONT face=Verdana size=1><SPAN
class=684122818-16012006>Phil</DIV></SPAN></FONT>
<DIV><FONT face=Verdana size=1></FONT> </DIV>
<DIV><FONT face=Verdana size=1></FONT> </DIV><FONT face=Verdana
size=1><SPAN class=684122818-16012006>
<DIV><BR>rad_recv: Access-Request packet from host 172.16.51.67:18299, id=22,
length=91<BR> User-Name =
"NOUSER"<BR> User-Password =
"test"<BR> NAS-IP-Address =
127.0.0.1<BR> NAS-Identifier =
"sshd"<BR> NAS-Port =
17274<BR> NAS-Port-Type =
Virtual<BR> Service-Type =
Authenticate-Only<BR>
Calling-Station-Id = "192.168.60.76"<BR> Processing the authorize section
of radiusd.conf<BR>modcall: entering group authorize for request 0<BR>
modcall[authorize]: module "preprocess" returns ok for request 0<BR>
modcall[authorize]: module "chap" returns noop for request 0<BR>
modcall[authorize]: module "mschap" returns noop for request
0<BR> rlm_realm: No <A href="mailto:'@'">'@'</A> in User-Name
= "NOUSER", looking up realm NULL<BR> rlm_realm: No such realm
"NULL"<BR> modcall[authorize]: module "suffix" returns noop for request
0<BR> rlm_eap: No EAP-Message, not doing EAP<BR> modcall[authorize]:
module "eap" returns noop for request 0<BR> users: Matched
entry DEFAULT at line 156<BR> modcall[authorize]: module "files" returns
ok for request 0<BR>modcall: group authorize returns ok for request 0<BR>
rad_check_password: Found Auth-Type System<BR>auth: type
"System"<BR> Processing the authenticate section of
radiusd.conf<BR>modcall: entering group authenticate for request 0<BR>
modcall[authenticate]: module "unix" returns notfound for request 0<BR>modcall:
group authenticate returns notfound for request 0<BR>auth: Failed to validate
the user.<BR>Delaying request 0 for 1 seconds<BR>Finished request 0<BR>Going to
the next request<BR>--- Walking the entire request list ---<BR>Waking up in 1
seconds...<BR>--- Walking the entire request list ---<BR>Waking up in 1
seconds...<BR>--- Walking the entire request list ---<BR>Sending Access-Reject
of id 22 to 172.16.51.67:18299<BR>Waking up in 4 seconds...<BR>--- Walking the
entire request list ---<BR>Cleaning up request 0 ID 22 with timestamp
43cbe46d<BR>Nothing to do. Sleeping until we see a request.</DIV>
<DIV> </DIV>
<DIV></SPAN></FONT> </DIV>
<DIV class=Section1>
<P><B><SPAN style="FONT-SIZE: 7.5pt; FONT-FAMILY: Verdana">Philippe LE
GAL</SPAN></B><SPAN style="FONT-SIZE: 7.5pt; FONT-FAMILY: Verdana"> </SPAN></P>
<P><SPAN style="FONT-SIZE: 7.5pt; FONT-FAMILY: Verdana"></SPAN><SPAN lang=FR
style="FONT-SIZE: 7.5pt; COLOR: gray; FONT-FAMILY: Verdana; mso-ansi-language: FR">Email:
</SPAN><SPAN style="COLOR: gray"><A
href="mailto:Philippe.LeGal@emea.eu.int"><SPAN lang=FR
style="FONT-SIZE: 7.5pt; COLOR: gray; FONT-FAMILY: Verdana; mso-ansi-language: FR">Philippe.LeGal@emea.eu.int</SPAN></A></SPAN></P></DIV>
<BR>
________________________________________________________________________<BR>
This e-mail has been scanned for all known viruses by EMEA.<BR>
________________________________________________________________________<BR>
</BODY></HTML>