Hi Alan,

I took out all the pam modules from my auth stack in /etc/pam/sshd except for pam_radius_auth. The problem didn't go away. I am not using SElinux either.

One interesting thing I noticed is that first login attempt always fails due to this problem. But the second attempt after restarting the ssh session then it succeeds. This makes me wonder if somehow the password was stored on the first try and correctly retrieved on the second try. But I have no clue what happened.

David

------------------------------

Message: 2
Date: Mon, 14 Apr 2014 20:53:52 -0400
From: Alan DeKok <aland@deployingradius.com>
To: FreeRadius users mailing list
<freeradius-users@lists.freeradius.org>
Subject: Re: Question on pam_radius_auth module getting INCORRECT
password
Message-ID: <534C8320.8010907@deployingradius.com>
Content-Type: text/plain; charset=UTF-8

David Li wrote:
> I am new to this. Please let me know if there is a better list to post
> this question.

It's an OK list.

> I have been trying to track down a wired problem. When a user is logging
> via ssh, the pam_radius_auth module would try to retrieve the password
> and send it to the radius server. But the password returned by the
> rad_converse() function is INCORRECT.
>
> I have done some searching and found suggestions that there might be
> something wrong with "other" module that is doing the password checking.
>
> My real question is how I can find out which module is the culprit.

It should be simple. Look at the pam ssh file, and see which modules
it's using. Then, delete them one by one until it works.

But largely this is a PAM issue. I know very little about PAM, even
after spending time reading the docs and programming it.

Alan DeKok.

------------------------------