<HTML dir=ltr><HEAD><TITLE>Re: How to handle challenge response using PAM auth in FreeRadius</TITLE>
<META http-equiv=Content-Type content="text/html; charset=unicode">
<META content="MSHTML 6.00.3790.4589" name=GENERATOR></HEAD>
<BODY>
<DIV id=idOWAReplyText85340 dir=ltr>
<DIV dir=ltr>Hello,</DIV>
<DIV dir=ltr> </DIV>
<DIV dir=ltr><FONT face=Arial size=2>The scenario is like this :</FONT></DIV>
<DIV dir=ltr><FONT face=Arial size=2>{remote client } -----> {radius} ---> {PAM} ----> {Extern Athenticator}</FONT></DIV>
<DIV dir=ltr><FONT face=Arial size=2></FONT> </DIV>
<DIV dir=ltr><FONT face=Arial size=2>Now when the external authenticator sends challenge to PAM, </FONT><FONT face=Arial size=2>I do not see a easy way to pass the "challenge text" back to the radius.</FONT></DIV>
<DIV dir=ltr><FONT face=Arial size=2></FONT> </DIV>
<DIV dir=ltr><FONT face=Arial size=2>Please note that <FONT face="Times New Roman">pam_sm_authenticate allows either SUCCESS or FAILURE return</FONT></FONT></DIV>
<DIV dir=ltr><FONT size=2>but not "Challnege text" return.</FONT></DIV>
<DIV dir=ltr><FONT size=2></FONT> </DIV>
<DIV dir=ltr><FONT size=2>Thanks,</FONT></DIV>
<DIV dir=ltr> </DIV></DIV>
<DIV dir=ltr><BR>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> John Dennis [mailto:jdennis@redhat.com]<BR><B>Sent:</B> Mon 3/15/2010 12:56 PM<BR><B>To:</B> FreeRadius users mailing list<BR><B>Cc:</B> Rajendra Hegde<BR><B>Subject:</B> Re: How to handle challenge response using PAM auth in FreeRadius<BR></FONT><BR></DIV>
<DIV>
<P><FONT size=2>On 03/15/2010 12:16 PM, Rajendra Hegde wrote:<BR>> Hello,<BR>> I am developing a PAM module for radius server.<BR>> The radius server is configured to use PAM auth.<BR>> It reads /etc/pam.d/radiusd and loads it on receiving auth request.<BR>> The PAM module talks to external Authentication server and sometimes<BR>> gets back "Challenge Respose".<BR>> How can this be returned back to radius server from pam_sm_authenticate<BR>> from my PAM module ?<BR>> Please note that this is different than what pam_radius_auth.c does.<BR>> pam_radius_auth.c talks to radius directly via network<BR>> where as my module directly gets loaded by Radius.<BR>> Why should not there be a way to return "Challenge Respose"<BR>> from linux PAM back to it's loader ?<BR>> Can this possible linux limitation be overcome by radius calling another<BR>> exported function for<BR>> PAM module covering all scenarios including "Challenge Response" ?<BR>> Where should I look into in the freeradius codebase, if I were to<BR>> add that functionality ?<BR>> with best regards,<BR><BR>Your question is a bit muddled. I'm not sure if you asking how to<BR>forward the challenge through RADIUS back to the client or if you're<BR>just asking how to handle a pam "conversation" within your<BR>authentication module. If it's the former, then the answer is you can't<BR>do that in general. On the other hand if all you want to know is how to<BR>handle a pam conversation the take a look at rlm_pam.c and see the<BR>function PAM_conv and read the man page for pam_conv.<BR><BR>--<BR>John Dennis <jdennis@redhat.com><BR><BR>Looking to carve out IT costs?<BR><A href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</A><BR></FONT></P>
<P><FONT size=2> </P></FONT></DIV>The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Statements and opinions expressed in this e-mail may not represent those of the company. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender immediately and delete the material from any computer. Please see our legal details at http://www.cryptocard.com
CRYPTOCard Inc. is registered in the province of Ontario, Canada with Business number 80531 6478. CRYPTOCard Europe is limited liability company registered in England and Wales (with registered number 05728808 and VAT number 869 3979 41); its registered office is Aztec Centre, Aztec West, Almondsbury, Bristol, UK, BS32 4TD
</BODY></HTML>