unix module authentication doesn't work.....

22 Aug 2006

      Hi, I have a freeradius server running on Ubuntu/Dapper/i386 platform.
Version: 1.1.0-1ubuntu2

I have a client which is Ubuntu/Dapper/amd64 architecture. I have
installed libpam-radius-auth and set it up with the server. 
Version: 1.3.16-4. NOTE. 64 bit AMD architecture.

What I am trying to do: 
======================

Use the /etc/shadow,/etc/passwd file
on the server for user authenticatication.

I have configure (on the client)
/etc/pam.d/common-auth with contents:

auth    sufficient      pam_unix.so nullok_secure
auth    required        pam_radius_auth.so debug

I setup /etc/pam_radius_auth.conf with 
IPaddress_of_server secret-string  3

where the secret string is typable by keyboard.

I added the relevant data to the server for this client.

Do I need to use the users file /etc/freeradius/users and put the user
in that? Doesn't seem to help.

Below I have included two logs, from the client, server and my radiusd.conf file
(no comments for the latter file).

------------ Log of /var/log/auth.log on client ------------
Aug 22 15:24:37 fe104 sshd[1745]: Invalid user test-walter from 129.97.15.20
Aug 22 15:24:37 fe104 sshd[1745]: Failed none for invalid user test-walter from 129.97.15.20 port 753 ssh2
Aug 22 15:24:41 fe104 sshd[1745]: (pam_unix) check pass; user unknown Aug 22 15:24:41 fe104 sshd[1745]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cscf.cs.uwaterloo.ca
Aug 22 15:24:41 fe104 sshd[1745]: pam_radius_auth: Got user name test-walter
Aug 22 15:24:41 fe104 sshd[1745]: pam_radius_auth: Got password ^H ^M\177INCORRECT
Aug 22 15:24:41 fe104 sshd[1745]: pam_radius_auth: Sending RADIUS request code 1
Aug 22 15:24:41 fe104 sshd[1745]: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned -1409445184.
Aug 22 15:24:43 fe104 sshd[1745]: pam_radius_auth: Got RADIUS response code 3
Aug 22 15:24:43 fe104 sshd[1745]: pam_radius_auth: authentication failed
Aug 22 15:24:45 fe104 sshd[1745]: Failed password for invalid user test-walter from 129.97.15.20 port 753 ssh2
Aug 22 15:26:35 fe104 sshd[1745]: fatal: Timeout before authentication for 129.97.15.20

-------- radius -X log on server -----------------------------------
Starting - reading configuration files ...
reread_config:  reading radiusd.conf
Config:   including file: /etc/freeradius/proxy.conf
Config:   including file: /etc/freeradius/clients.conf
Config:   including file: /etc/freeradius/snmp.conf
Config:   including file: /etc/freeradius/eap.conf
Config:   including file: /etc/freeradius/sql.conf
  main: prefix = "/usr"
  main: localstatedir = "/var"
  main: logdir = "/var/log/freeradius"
  main: libdir = "/usr/lib/freeradius"
  main: radacctdir = "/var/log/freeradius/radacct"
  main: hostname_lookups = no
  main: max_request_time = 30
  main: cleanup_delay = 5
  main: max_requests = 1024
  main: delete_blocked_requests = 0
  main: port = 0
  main: allow_core_dumps = no
  main: log_stripped_names = no
  main: log_file = "/var/log/freeradius/radius.log"
  main: log_auth = no
  main: log_auth_badpass = yes
  main: log_auth_goodpass = yes
  main: pidfile = "/var/run/freeradius/freeradius.pid"
  main: user = "freerad"
  main: group = "freerad"
  main: usercollide = no
  main: lower_user = "no"
  main: lower_pass = "no"
  main: nospace_user = "no"
  main: nospace_pass = "no"
  main: checkrad = "/usr/sbin/checkrad"
  main: proxy_requests = no
  proxy: retry_delay = 5
  proxy: retry_count = 3
  proxy: synchronous = no
  proxy: default_fallback = yes
  proxy: dead_time = 120
  proxy: post_proxy_authorize = no
  proxy: wake_all_if_all_dead = no
  security: max_attributes = 200
  security: reject_delay = 1
  security: status_server = no
  main: debug_level = 0
read_config_files:  reading dictionary
read_config_files:  reading naslist
Using deprecated naslist file.  Support for this will go away soon.
read_config_files:  reading clients
read_config_files:  reading realms
radiusd:  entering modules setup
Module: Library search path is /usr/lib/freeradius
Module: Loaded exec
  exec: wait = yes
  exec: program = "(null)"
  exec: input_pairs = "request"
  exec: output_pairs = "(null)"
  exec: packet_type = "(null)"
rlm_exec: Wait=yes but no output defined. Did you mean output=none?
Module: Instantiated exec (exec) 
Module: Loaded expr 
Module: Instantiated expr (expr) 
Module: Loaded PAP
  pap: encryption_scheme = "md5"
Module: Instantiated pap (pap) 
Module: Loaded CHAP 
Module: Instantiated chap (chap) 
Module: Loaded MS-CHAP
  mschap: use_mppe = yes
  mschap: require_encryption = no
  mschap: require_strong = no
  mschap: with_ntdomain_hack = no
  mschap: passwd = "(null)"
  mschap: authtype = "MS-CHAP"
  mschap: ntlm_auth = "(null)"
Module: Instantiated mschap (mschap) 
Module: Loaded System
  unix: cache = no
  unix: passwd = "/etc/passwd"
  unix: shadow = "/etc/shadow"
  unix: group = "/etc/group"
  unix: radwtmp = "NULL"
  unix: usegroup = no
  unix: cache_reload = 600
Module: Instantiated unix (unix) 
Module: Loaded eap
  eap: default_eap_type = "md5"
  eap: timer_expire = 60
  eap: ignore_unknown_eap_types = no
  eap: cisco_accounting_username_bug = no
rlm_eap: Loaded and initialized type md5
rlm_eap: Loaded and initialized type leap
  gtc: challenge = "Password: "
  gtc: auth_type = "PAP"
rlm_eap: Loaded and initialized type gtc
  mschapv2: with_ntdomain_hack = no
rlm_eap: Loaded and initialized type mschapv2
Module: Instantiated eap (eap) 
Module: Loaded preprocess
  preprocess: huntgroups = "/etc/freeradius/huntgroups"
  preprocess: hints = "/etc/freeradius/hints"
  preprocess: with_ascend_hack = no
  preprocess: ascend_channels_per_line = 23
  preprocess: with_ntdomain_hack = no
  preprocess: with_specialix_jetstream_hack = no
  preprocess: with_cisco_vsa_hack = no
Module: Instantiated preprocess (preprocess) 
Module: Loaded realm
  realm: format = "suffix"
  realm: delimiter = "@"
  realm: ignore_default = no
  realm: ignore_null = no
Module: Instantiated realm (suffix) 
Module: Loaded files
  files: usersfile = "/etc/freeradius/users"
  files: acctusersfile = "/etc/freeradius/acct_users"
  files: preproxy_usersfile = "/etc/freeradius/preproxy_users"
  files: compat = "no"
Module: Instantiated files (files) 
Module: Loaded Acct-Unique-Session-Id
  acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
Module: Instantiated acct_unique (acct_unique) 
Module: Loaded detail
  detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d"
  detail: detailperm = 384
  detail: dirperm = 493
  detail: locking = no
Module: Instantiated detail (detail) 
Module: Loaded radutmp
  radutmp: filename = "/var/log/freeradius/radutmp"
  radutmp: username = "%{User-Name}"
  radutmp: case_sensitive = yes
  radutmp: check_with_nas = yes
  radutmp: perm = 384
  radutmp: callerid = yes
Module: Instantiated radutmp (radutmp) 
Listening on authentication *:1812
Listening on accounting *:1813
Ready to process requests.
rad_recv: Access-Request packet from host 129.97.152.227:2770, id=124, length=102
 	User-Name = "test-walter"
 	User-Password = "\010\n\rINCORRECT"
 	NAS-IP-Address = 129.97.152.227
 	NAS-Identifier = "ssh"
 	NAS-Port = 1745
 	NAS-Port-Type = Virtual
 	Service-Type = Authenticate-Only
 	Calling-Station-Id = "cscf.cs.uwaterloo.ca"
   Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 0
   modcall[authorize]: module "preprocess" returns ok for request 0
   modcall[authorize]: module "chap" returns noop for request 0
   modcall[authorize]: module "mschap" returns noop for request 0
     rlm_realm: No '@' in User-Name = "test-walter", looking up realm NULL
     rlm_realm: No such realm "NULL"
   modcall[authorize]: module "suffix" returns noop for request 0
   rlm_eap: No EAP-Message, not doing EAP
   modcall[authorize]: module "eap" returns noop for request 0
     users: Matched entry DEFAULT at line 152
   modcall[authorize]: module "files" returns ok for request 0
modcall: leaving group authorize (returns ok) for request 0
   rad_check_password:  Found Auth-Type System
auth: type "System"
   Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 0
rlm_unix: [test-walter]: invalid password
   modcall[authenticate]: module "unix" returns reject for request 0
modcall: leaving group authenticate (returns reject) for request 0
auth: Failed to validate the user.
   WARNING: Unprintable characters in the password. ?  Double-check the shared secret on the server and the NAS!
Delaying request 0 for 1 seconds
Finished request 0
Going to the next request
--- Walking the entire request list ---
Waking up in 1 seconds...
--- Walking the entire request list ---
Waking up in 1 seconds...
--- Walking the entire request list ---
Sending Access-Reject of id 124 to 129.97.152.227 port 2770
Waking up in 4 seconds...
--- Walking the entire request list ---
Cleaning up request 0 ID 124 with timestamp 44eb54e1
Nothing to do.  Sleeping until we see a request.
---------------------- end of radius -X log -------------------

my radiusd.conf (egrep -v '^	 *#|^$' /etc/freeradius/radiusd.conf:

prefix = /usr
exec_prefix = /usr
sysconfdir = /etc
localstatedir = /var
sbindir = ${exec_prefix}/sbin
logdir = /var/log/freeradius
raddbdir = /etc/freeradius
radacctdir = ${logdir}/radacct
confdir = ${raddbdir}
run_dir = ${localstatedir}/run/freeradius
log_file = ${logdir}/radius.log
libdir = /usr/lib/freeradius
pidfile = ${run_dir}/freeradius.pid
user = freerad
group = freerad
max_request_time = 30
delete_blocked_requests = no
cleanup_delay = 5
max_requests = 1024
bind_address = *
port = 0
hostname_lookups = no
allow_core_dumps = no
regular_expressions	= yes
extended_expressions	= yes
log_stripped_names = no
log_auth = no
log_auth_badpass = yes
log_auth_goodpass = yes
usercollide = no
lower_user = no
lower_pass = no
nospace_user = no
nospace_pass = no
checkrad = ${sbindir}/checkrad
security {
 	max_attributes = 200
 	reject_delay = 1
 	status_server = no
}
proxy_requests  = no
$INCLUDE  ${confdir}/proxy.conf
$INCLUDE  ${confdir}/clients.conf
snmp	= no
$INCLUDE  ${confdir}/snmp.conf
thread pool {
 	start_servers = 5
 	max_servers = 32
 	min_spare_servers = 3
 	max_spare_servers = 10
 	max_requests_per_server = 0
}
modules {
 	pap {
 		encryption_scheme = md5
 	}
 	chap {
 		authtype = CHAP
 	}
 	pam {
 		pam_auth = radiusd
 	}
 	unix {
 		cache = no
 		cache_reload = 600
 		passwd = /etc/passwd
 		shadow = /etc/shadow
 		group = /etc/group
 	}
$INCLUDE ${confdir}/eap.conf
 	mschap {
 		authtype = MS-CHAP

 	}
 	ldap {
 		server = "ldap.your.domain"
 		basedn = "o=My Org,c=UA"
 		filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"
 		start_tls = no
 		access_attr = "dialupAccess"
 		dictionary_mapping = ${raddbdir}/ldap.attrmap
 		ldap_connections_number = 5
 		timeout = 4
 		timelimit = 3
 		net_timeout = 1
 	}
 	realm IPASS {
 		format = prefix
 		delimiter = "/"
 		ignore_default = no
 		ignore_null = no
 	}
 	realm suffix {
 		format = suffix
 		delimiter = "@"
 		ignore_default = no
 		ignore_null = no
 	}
 	realm realmpercent {
 		format = suffix
 		delimiter = "%"
 		ignore_default = no
 		ignore_null = no
 	}
 	realm ntdomain {
 		format = prefix
 		delimiter = "\\"
 		ignore_default = no
 		ignore_null = no
 	}
 	checkval {
 		item-name = Calling-Station-Id
 		check-name = Calling-Station-Id
 		data-type = string
 	}

 	preprocess {
 		huntgroups = ${confdir}/huntgroups
 		hints = ${confdir}/hints
 		with_ascend_hack = no
 		ascend_channels_per_line = 23
 		with_ntdomain_hack = no
 		with_specialix_jetstream_hack = no
 		with_cisco_vsa_hack = no
 	}
 	files {
 		usersfile = ${confdir}/users
 		acctusersfile = ${confdir}/acct_users
 		preproxy_usersfile = ${confdir}/preproxy_users
 		compat = no
 	}
 	detail {
 		detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d
 		detailperm = 0600
 	}
 	acct_unique {
 		key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
 	}
 	$INCLUDE  ${confdir}/sql.conf

 	radutmp {
 		filename = ${logdir}/radutmp
 		username = %{User-Name}
 		case_sensitive = yes
 		check_with_nas = yes
 		perm = 0600
 		callerid = "yes"
 	}
 	radutmp sradutmp {
 		filename = ${logdir}/sradutmp
 		perm = 0644
 		callerid = "no"
 	}
 	attr_filter {
 		attrsfile = ${confdir}/attrs
 	}
 	counter daily {
 		filename = ${raddbdir}/db.daily
 		key = User-Name
 		count-attribute = Acct-Session-Time
 		reset = daily
 		counter-name = Daily-Session-Time
 		check-name = Max-Daily-Session
 		allowed-servicetype = Framed-User
 		cache-size = 5000
 	}
 	sqlcounter dailycounter {
 		counter-name = Daily-Session-Time
 		check-name = Max-Daily-Session
 		sqlmod-inst = sql
 		key = User-Name
 		reset = daily
 		query = "SELECT SUM(AcctSessionTime - \
 		 GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \
 		 FROM radacct WHERE UserName='%{%k}' AND \
 		 UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'"
 	}
 	sqlcounter monthlycounter {
 		counter-name = Monthly-Session-Time
 		check-name = Max-Monthly-Session
 		sqlmod-inst = sql
 		key = User-Name
 		reset = monthly
 		query = "SELECT SUM(AcctSessionTime - \
 		 GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \
 		 FROM radacct WHERE UserName='%{%k}' AND \
 		 UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'"
 	}
 	always fail {
 		rcode = fail
 	}
 	always reject {
 		rcode = reject
 	}
 	always ok {
 		rcode = ok
 		simulcount = 0
 		mpp = no
 	}
 	expr {
 	}
 	digest {
 	}
 	exec {
 		wait = yes
 		input_pairs = request
 	}
 	exec echo {
 		wait = yes
 		program = "/bin/echo %{User-Name}"
 		input_pairs = request
 		output_pairs = reply
 	}
 	ippool main_pool {
 		range-start = 192.168.1.1
 		range-stop = 192.168.3.254
 		netmask = 255.255.255.0
 		cache-size = 800
 		session-db = ${raddbdir}/db.ippool
 		ip-index = ${raddbdir}/db.ipindex
 		override = no
 		maximum-timeout = 0
 	}
}
instantiate {
 	exec
 	expr
}
authorize {
 	preprocess

 	chap
 	mschap
 	suffix
 	eap
 	files
}
authenticate {
 	Auth-Type PAP {
 		pap
 	}
 	Auth-Type CHAP {
 		chap
 	}
 	Auth-Type MS-CHAP {
 		mschap
 	}
 	unix
 	eap
}
preacct {
 	preprocess
 	acct_unique
 	suffix
 	files
}
accounting {
 	detail
 	unix
 	radutmp
}
session {
 	radutmp
}
post-auth {
}
pre-proxy {
}
post-proxy {
 	eap
}
----------------end of /etc/freeradius/radiusd.conf -------------------------------

unix module authentication doesn't work.....

Walter Tautz