Yes - apologies for the confusion, I was referring to rlm_pam. Thanks Alan. I realize this isn't really an issue with freeradius and appreciate your advice. Just to clarify, I was messing with the pam-google-authenticator module which needed root permissions to change userid/groupid to read authenticator files out of user's home directories. Turns out you can specify userid in the pam options (with user=) but not group and it caused errors. I ended up editing the source code to ignore the group issue and pointed to a location where the radiusd user has permissions to read those authenticator files. Not sure if I missed another way around this but thats what ended up working for me. Thanks again! -- --Mike On Thu, Mar 06, 2014 at 09:41:03AM +0000, Alan DeKok wrote:
msheiny@seas.upenn.edu wrote:
I'm running FreeRadius 2.2.0 and am looking for advice on resolving a permissions issue I am running into with a third-party pam module.
You've configured FreeRADIUS to use rlm_pam ?
As far as freeradius goes, I have it configured how I would like - radius authentication is being checked against PAM as I intended. The problem is that this pam module I am running currently requires root permissions but I would prefer to keep radiusd running as a restricted user. I've confirmed I can get around the issue by specifying radiusd to run as root but this is not desired.
Well, you don't really have a choice.
So my question - what would be the best way to run the freeradius pam sub-routine as root but keep the rest of the freeradius system runnning as my restricted user?
You can't have part of a process running as root, and another part as non-root. Process UID is global to the process.
I'm trying to avoid editing source code if I can help it. I realize this is not strictly related to freeradius but figured there may be a freeradius setting I'm not familiar here.
If you really care, you can run 2 RADIUS servers. One, which has *only* rlm_pam and runs as root. The other, running as a radius user, which proxies (some) packets to the first one.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html