<html>
<head>
<style>
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
FONT-SIZE: 10pt;
FONT-FAMILY:Tahoma
}
</style>
</head>
<body class='hmmessage'>
I'm not fighting you at all.<br><br>All of your answers previously were "read the documentation, it's there".<br>well, it's not. definitely not.<br><br>the pam_radius_auth link you gave me states:<br>In the per-application configuration add:<br>auth sufficient /lib/security/pam_radius_auth.so<br>AFTER<br>auth sufficient /lib/security/pam_securetty.so<br>and BEFORE:<br>auth required /lib/security/pam_unix_auth.so<br><br>take a look at my config - /etc/pam.d/sshd<br><br>#%PAM-1.0<br>auth requisite pam_nologin.so<br>auth sufficient /lib/security/pam_radius_auth.so debug<br>auth include common-auth<br>account sufficient /lib/security/pam_radius_auth.so<br>account include common-account<br>password include common-password<br>session required pam_loginuid.so<br>session include common-session<br># Enable the following line to get resmgr support for<br># ssh sessions (see /usr/share/doc/packages/resmgr/README)<br>#session optional pam_resmgr.so fake_ttyname<br><br>pam_securetty is never referenced, except in /etc/pam.d/login<br>so should it be in sshd or login, or both?<br><br>it doesn't seem to make any difference.<br><br>a "Default" radiusd install with NO changes (except server file as follows:<br>127.0.0.1 testing123 3<br><br>users in password file can login, but it doesn't seem to be using radius.<br><br>the documentation for pam is as clear as mud. did it mean to modify the login file like this:<br><br>#%PAM-1.0<br>auth requisite pam_nologin.so<br>auth [user_unknown=ignore success=ok ignore=ignore auth_err=die default=bad] pam_securetty.so<br>auth sufficient /lib/security/pam_radius_auth.so debug<br>auth include common-auth<br>account include common-account<br>password include common-password<br>session required pam_loginuid.so<br>session include common-session<br>session required pam_lastlog.so nowtmp <br>session required pam_resmgr.so<br>session optional pam_mail.so standard<br>session optional pam_ck_connector.so<br><br>because that doesnt make any difference either. same result as with just sshd above<br><br>I now have a "vanilla" radiusd config (with the one change to server file above), and trying to figure out the pam config.<br>the documentation also states:<br>"The pam configuration can be:"<br>...<br>auth sufficient /lib/security/pam_radius_auth.so [options]<br>...<br>account sufficient /lib/security/pam_radius_auth.so<br><br>which is the first time the account directive is mentioned.<br><br>so you now have my entire config, back to basics, trying to figure out the pam stuff...<br>logins work, but they're not using radius. and there's nothing in the logs. even with "debug" option specified.<br>Dan.<br><br>> Date: Mon, 26 Nov 2007 21:51:34 +0100<br>> From: aland@deployingradius.com<br>> To: freeradius-users@lists.freeradius.org<br>> Subject: Re: local ssh authentication via radius possible?<br>> <br>> Dan Gahlinger wrote:<br>> > I don't understand most of what you said here. Hence my problem.<br>> <br>> The problem is that you're trying to configure 4-5 separate things at<br>> the same time, without understanding how most of them work. As a<br>> result, you're frustrated, and not making progress.<br>> <br>> > Mon Nov 26 12:43:45 2007 : Info: rlm_exec: Wait=yes but no output<br>> > defined. Did you mean output=none?<br>> > Mon Nov 26 12:43:45 2007 : Info: Ready to process requests.<br>> > <br>> > and nothing else. No other logs anywhere, not even a failed "ssh" log in<br>> > messages, warn, etc.<br>> <br>> i.e. PAM isn't using RADIUS for authentication. Fix that. Read the<br>> PAM documentation.<br>> <br>> > we need a regular user using SSH client such as SecureCRT, or Putty, etc<br>> > without modification, to login<br>> > via SSH to a linux server, and have the server use Radius for<br>> > authentication.<br>> > <br>> > These are "local" users with shell access. The radius would be local.<br>> > So instead of using the local password file, we want to use Radius.<br>> <br>> That will work, but they will need a uid/gid etc. in /etc/passwd.<br>> <br>> > Using everything in the defaults without changing the user file doesn't<br>> > make sense, because that's what we want to use for authentication,<br>> > only, in our case, it'd be on a central server instead of local, but I<br>> > want to get local testing working first, just to make sure I understand<br>> > it all.<br>> <br>> Which is why I said to use the defaults. If you don't know what it's<br>> doing, then DON'T CHANGE ANTYTHING. The default configuration WORKS.<br>> Every change you've made has broken it.<br>> <br>> > at this point, I don't understand any of it, and yelling at me for doing<br>> > the wrong things isn't helping.<br>> <br>> No, I'm telling you that making random changes won't work. I'm<br>> telling you that making changes that aren't recommended in the<br>> documentation is not a good idea. I'm telling you that reading the<br>> documentation and following it's recommendations is a good idea.<br>> <br>> > you've seen my configuration files. I don't know how it should work,<br>> > because I have no idea how it should look.<br>> <br>> They should look like the samples. It's not hard.<br>> <br>> > I'd appreciate a little bit of help here, some hints, some sample<br>> > configs, would really really help.<br>> <br>> The sample configurations work.<br>> <br>> However, it's clear that for whatever reason, SSH isn't using PAM,<br>> *or*, PAM isn't using the pam_radius_auth module, *or* the<br>> pam_radius_auth module isn't configured to use the correct RADIUS server.<br>> <br>> As a result, the RADIUS server isn't receiving login requests. As a<br>> result of that, no amount of fighting with the RADIUS configuration will<br>> help. So all of the time you put into configuring "Login-Server" was<br>> wasted.<br>> <br>> > I mean, if it's even possible to do what we're trying to do.<br>> <br>> Yes.<br>> <br>> I will also note that I asked a number of questions in my last<br>> message, and you haven't answered any of them. Either you didn't<br>> understand them, or you don't think they're important.<br>> <br>> Part of the reason this is so difficult for you is that you are<br>> fighting every attempt by anyone to help you. You're stuck on one<br>> particular mind-set that is preventing anyone from helping you, and<br>> preventing you from solving the problem. Until you give up that<br>> mindset, and let people help you, you won't solve the problem. You'll<br>> only get more and more frustrated.<br>> <br>> Alan DeKok.<br>> -<br>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html<br><br /><hr />Send a smile, make someone laugh, have some fun! <a href='http://www.freemessengeremoticons.ca/?icid=EMENCA122' target='_new'>Start now!</a></body>
</html>