<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.6000.16546" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>Seems like I am getting closer possibly, but I see
an error in radius.log -- could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to
allow.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Basically, I go to login to my pam_radius host,
user exists in local password file with no pass, user/pass in RADIUS/LDAP,
and when I login the SSH session immediately exits and I see the below in
radius.log. If I use a login not in the local password file, but it is in
RADIUS/LDAP then I get an access denied and no mention of the
below error. </FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>I am not even starting TLS so why is it even
complaining about it??? I am also curious what this means -- rlm_exec:
Wait=yes but no output defined. Did you mean output=none?</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Appreciate any help. Thanks!</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Tue Dec 18 19:32:48 2007 : Info: rlm_exec: Wait=yes
but no output defined. Did you mean output=none?<BR>Tue Dec 18 19:32:48 2007 :
Info: Ready to process requests.<BR>Tue Dec 18 19:33:06 2007 : Error: rlm_ldap:
could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow<BR>Tue Dec 18 19:33:06
2007 : Error: rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to
allow<BR>Tue Dec 18 19:35:55 2007 : Error: rlm_ldap: could not set
LDAP_OPT_X_TLS_REQUIRE_CERT option to allow<BR>Tue Dec 18 19:36:03 2007 : Error:
rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV> </DIV>
<BLOCKQUOTE dir=ltr
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=email.fish@gmail.com href="mailto:email.fish@gmail.com">Jeff
Fishbaugh</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A
title=freeradius-users@lists.freeradius.org
href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</A>
</DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Tuesday, December 18, 2007 2:13
PM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> Help w/ pam radius</DIV>
<DIV><BR></DIV>
<DIV><FONT face=Arial size=2>
<DIV><FONT face=Arial size=2>
<DIV><FONT face=Arial size=2>Hello:</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>I am having trouble getting pam_radius working
and was wondering if someone might be of help since </FONT><FONT face=Arial
size=2>I followed the INSTALL instructions as well as a howto (as
provided by the Wikid folks) and I am still coming up short getting
it working.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Here are some of my details</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>- My PAM is such it is by service (Fedora 7 --
0.99.7.1-5.1)....sshd being what I am most interested in, the default config
for it looks like the below on a host I want talking to radius. What does
this need to look like in terms of the pam_radius_auth.so related stanzas to
get it working? Neither the INSTALL instructions or a howto I found would
work.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV>/etc/pam.d/sshd (default below)</DIV>
<DIV> </DIV>
<DIV><FONT face=Arial
size=2>#%PAM-1.0<BR>auth
include system-auth<BR>account
required pam_nologin.so<BR>account
include system-auth<BR>password
include system-auth<BR>session
optional pam_keyinit.so force
revoke<BR>session include
system-auth<BR>session required
pam_loginuid.so</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>- My Radius box runs freeradius
(freeradius-1.1.7-3.1) with LDAP (fedora-ds) backending it with the
user/pass info, got it working for Cisco's but have yet to get PAM
working. I just get 'Access denied' -- tried the later with a user
defined on the host with no password or with a password and won't
work.</FONT></DIV>
<DIV> </DIV>
<DIV>Pretty simple, no huntgroups or anythig like that just plain and simple
binding against LDAP.</DIV>
<DIV> </DIV>
<DIV>I think what I am looking for are...</DIV>
<DIV> </DIV>
<DIV>1- Pam configuration on the host (ie- /etc/pam.d/sshd)</DIV>
<DIV>2- Pam configuration requirements as far as the radius server is
concerned. Be helpful to see what all I might need that I am possibly missing
in conf files.</DIV>
<DIV> </DIV>
<DIV>Thank you!</DIV></FONT></DIV></FONT></DIV></BLOCKQUOTE></BODY></HTML>