On Oct 18, 2017, at 11:34 AM, Stefan Bruda <stefan@bruda.ca> wrote:
I would like my radius server to authenticate users against the Unix password database. Direct authentication is preferred but PAM authentication will do just as well.
I wouldn't recommend PAM. It's just terrible.
With the 2.x version I succeeded in doing this by forcing Auth-Type = System in the users file and using the "unix" module, but this no longer works (apparently justifiably so) in the 3.x version.
The "unix" module should be able to call getpwent() or getspwent() to get the password.
I then get the following somehow puzzling result (with a certified valid Unix user name and password):
(2) # Executing section authorize from file /etc/raddb/sites-enabled/default (2) authorize { ...... (2) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (2) pap: WARNING: Authentication will fail unless a "known good" password is available (2) [pap] = noop (2) } # authorize = ok (2) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject
What I am puzzled about is the "notfound" result provided by the unix module.
Well, it means that either the user doesn't exist, or FreeRADIUS doesn't have permission to get the password. i.e. it can't read /etc/shadow.
Next I tried to do PAM authentication by uncommenting the "files" line in the authorize section and forcing "Auth-Type = Pam" in the users file. This one at least communicates with the PAM system:
(0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { ... (0) [unix] = notfound (0) files: users: Matched entry DEFAULT at line 7 (0) [files] = ok (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) Found Auth-Type = pam (0) # Executing group from file /etc/raddb/sites-enabled/default (0) authenticate { (0) pam: Using pamauth string "radiusd" for pam.conf lookup (0) pam: ERROR: pam_authenticate failed: Authentication failure (0) [pam] = reject (0) } # authenticate = reject (0) Failed to authenticate the user
I get the following in the logs (login name redacted):
Oct 18 10:23:40 localhost unix_chkpwd[26318]: check pass; user unknown Oct 18 10:23:40 localhost unix_chkpwd[26319]: check pass; user unknown
That's a PAM issue. Either the user really is unknown, or FreeRADIUS doesn't have permission to get the users password.
The file /etc/pam.d/radius looks fine to me:
Yup.
auth include system-auth account include system-auth password include system-auth session include system-auth
PAM authentication works well with my other subsystems (e.g., sshd).
Should more information be needed just ask.
If anybody have any idea about what I am doing wrong I would very much appreciate to hear about it. Many thanks in advance!
Run it in debugging mode as root, which should get rid of any file permissions issues. Or, upgrade to 3.0.15. It has lots of fixes over 3.0.4. Or, use "strace" to see what it's doing, and which OS call returns "no such user" to FreeRADIUS. As always, FreeRADIUS is at the mercy of the OS. If the OS decides to tell FreeRADIUS "no such user", then the problem is in the OS. Alan DeKok.