<html>
<head>
<style>
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
FONT-SIZE: 10pt;
FONT-FAMILY:Tahoma
}
</style>
</head>
<body class='hmmessage'>
the client software I'm using is SecureCRT (windows - from vandyke) its a windows SSH client.<br><br>I don't understand most of what you said here. Hence my problem.<br><br>I did configure pam_radius with "debug" option.<br>there is no output created. It's impossible to tell if things are working the way they should<br>Login-Service is set to "TCP-Clear" now, and the log file produces only this:<br><br>Mon Nov 26 12:43:45 2007 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none?<br>Mon Nov 26 12:43:45 2007 : Info: Ready to process requests.<br><br>and nothing else. No other logs anywhere, not even a failed "ssh" log in messages, warn, etc.<br><br>Maybe I should restate, clearly, what I'm trying to do. and see if it's possible, or makes sense.<br><br>we need a regular user using SSH client such as SecureCRT, or Putty, etc without modification, to login<br>via SSH to a linux server, and have the server use Radius for authentication.<br><br>These are "local" users with shell access. The radius would be local.<br>So instead of using the local password file, we want to use Radius.<br><br>Eventually the server they're logging into will point their radius to another radius server (also linux) running on the network.<br><br>I have no idea what I'm doing, so I'm grasping at straws.<br>You said to read the documentation, which, there wasn't much of in this regard, but I did anyhow.<br><br>Then you said to read pam_radius_auth, which I did, and attempted to implement.<br><br>Thankfully, logins using the local password file still works.<br><br>Using everything in the defaults without changing the user file doesn't make sense, because that's what we want to use for authentication,<br>only, in our case, it'd be on a central server instead of local, but I want to get local testing working first, just to make sure I understand it all.<br><br>at this point, I don't understand any of it, and yelling at me for doing the wrong things isn't helping.<br><br>you've seen my configuration files. I don't know how it should work, because I have no idea how it should look.<br><br>I'd appreciate a little bit of help here, some hints, some sample configs, would really really help.<br><br>I mean, if it's even possible to do what we're trying to do.<br><br>> Date: Mon, 26 Nov 2007 20:33:13 +0100<br>> From: aland@deployingradius.com<br>> To: freeradius-users@lists.freeradius.org<br>> Subject: Re: local ssh authentication via radius possible?<br>> <br>> Dan Gahlinger wrote:<br>> > The SSH documentation doesnt say anything about using radius or<br>> > configuring the Radius users file.<br>> > why would it? that makes no sense.<br>> <br>> Because you haven't said which RADIUS client you're using. Maybe SSH<br>> has a RADIUS plugin...<br>> <br>> > The pam_radius_auth documentation, while useful, makes no mention of the<br>> > radius users file.<br>> <br>> Of course not. It's a client. The "users" file is only for the server.<br>> <br>> > I have not been "careful" to hide or keep anything. I just didn't think<br>> > the log output was useful<br>> > but, since I'm new to this, here you go (from the most recent attempt):<br>> <br>> The FAQ, README, INSTALL, and many messages on this list make it clear<br>> that running in debugging mode, and posting the output to this list, is<br>> the only way to solve many problems.<br>> <br>> > Mon Nov 26 11:15:30 2007 : Info: rlm_exec: Wait=yes but no output<br>> > defined. Did you mean output=none?<br>> > Mon Nov 26 11:15:30 2007 : Error: /etc/raddb/users[143]: Parse error<br>> > (reply) for entry testing: Expected end of line or comma<br>> <br>> You edited the "users" file, and broke it.<br>> <br>> > and here it is from the previous attempt at using "ssh" as a login-service:<br>> <br>> Which isn't documented as a permitted Login-Service for the server.<br>> And it isn't documented as being necessary for the pam_radius_auth module.<br>> <br>> > I will check the dictionary and see how "tcp clear" should be entered.<br>> > However, your email suggests that this is not the correct avenue to<br>> > pursue, and as such, I'm lost, again.<br>> <br>> Perhaps you could explain why you're so fixated on setting<br>> Login-Service? The pam_radius_auth documentation doesn't say that it's<br>> needed.<br>> <br>> > everything else is straight out of the box, I even used the sample<br>> > secrets to keep it simple.<br>> > I want as few variables as possible while testing this.<br>> <br>> Try starting the server without changing ANYTHING. When you log in<br>> over SSH, does the PAM module send a RADIUS request? Does the server<br>> receive it?<br>> <br>> You seem to have wandered down a configuration path that isn't<br>> required, and you're doing things that aren't documented. Stop trying<br>> to do complicated things, and go back to the default configurations and<br>> simple tests.<br>> <br>> Alan DeKok.<br>> -<br>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html<br><br /><hr />Have fun while connecting on Messenger! <a href='http://entertainment.sympatico.msn.ca/WindowsLiveMessenger' target='_new'>Click here to learn more.</a></body>
</html>