Hello everybody, Is there a way to include multiple instances of the pam module in the radius? We are currently using a freeradius 2.2.8 with several virtual servers. Two services are to be secured by a 2-factor authentication (Google Authenticator). 1. Login VMware HorizonView (desktop-virtualization) 2. IPsec VPN connection VMware Horizon expects a login with username and passcode with a subsequent query of the password. For the login of the VPN connection the password + passcode is expected together in a field. Attempts to integrate several instances (similar to the file or ldap module) within the pam module do not work. I am thankful for every hint. Thanks in advance. Best regards Lars Hillebrand - Content of /etc/freeradius/modules/pam pam { pam_auth = radiusd } pam 2facaut_pam { pam_auth = 2facaut_pam } pam horizon_pam { pam_auth = horizon_pam } - Contents of the individual pam files from /etc/pam.d/ # /etc/pam.d/horizon_pam - PAM configuration for FreeRADIUS auth requisite pam_google_authenticator.so forward_pass try_first_pass auth [success=2 default=ignore] pam_unix.so nullok_secure auth [success=1 default=ignore] pam_ldap.so use_first_pass # /etc/pam.d/2facaut_pam - PAM configuration for FreeRADIUS auth required pam_google_authenticator.so forward_pass auth required pam_ldap.so use_first_pass - Here the debug log with separate horizon_pam configuration in the radius Tue Apr 18 12:08:41 2017 : Debug: server horizon { Tue Apr 18 12:08:41 2017 : Debug: # Executing section authorize from file /etc/freeradius/sites-enabled/horizon Tue Apr 18 12:08:41 2017 : Debug: +group authorize { Tue Apr 18 12:08:41 2017 : Debug: ++policy filter_username { Tue Apr 18 12:08:41 2017 : Debug: +++? if (User-Name =~ / /) Tue Apr 18 12:08:41 2017 : Debug: ? Evaluating (User-Name =~ / /) -> FALSE Tue Apr 18 12:08:41 2017 : Debug: +++? if (User-Name =~ / /) -> FALSE Tue Apr 18 12:08:41 2017 : Debug: +++? if (User-Name =~ /@.*@/ ) Tue Apr 18 12:08:41 2017 : Debug: ? Evaluating (User-Name =~ /@.*@/) -> FALSE Tue Apr 18 12:08:41 2017 : Debug: +++? if (User-Name =~ /@.*@/ ) -> FALSE Tue Apr 18 12:08:41 2017 : Debug: +++? if (User-Name =~ /\\.\\./ ) Tue Apr 18 12:08:41 2017 : Debug: ? Evaluating (User-Name =~ /\\.\\./) -> FALSE Tue Apr 18 12:08:41 2017 : Debug: +++? if (User-Name =~ /\\.\\./ ) -> FALSE Tue Apr 18 12:08:41 2017 : Debug: +++? if (User-Name =~ /\\.$/) Tue Apr 18 12:08:41 2017 : Debug: ? Evaluating (User-Name =~ /\\.$/) -> FALSE Tue Apr 18 12:08:41 2017 : Debug: +++? if (User-Name =~ /\\.$/) -> FALSE Tue Apr 18 12:08:41 2017 : Debug: +++? if (User-Name =~ /@\\./) Tue Apr 18 12:08:41 2017 : Debug: ? Evaluating (User-Name =~ /@\\./) -> FALSE Tue Apr 18 12:08:41 2017 : Debug: +++? if (User-Name =~ /@\\./) -> FALSE Tue Apr 18 12:08:41 2017 : Debug: ++} # policy filter_username = notfound Tue Apr 18 12:08:41 2017 : Debug: ++[preprocess] = ok Tue Apr 18 12:08:41 2017 : Debug: [horizon_log] expand: /var/log/freeradius/radacct/horizon-auth-detail-%Y%m%d -> /var/log/freeradius/radacct/horizon-auth-detail-20170418 Tue Apr 18 12:08:41 2017 : Debug: [horizon_log] /var/log/freeradius/radacct/horizon-auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/horizon-auth-detail-20170418 Tue Apr 18 12:08:41 2017 : Debug: [horizon_log] expand: %t -> Tue Apr 18 12:08:41 2017 Tue Apr 18 12:08:41 2017 : Debug: ++[horizon_log] = ok Tue Apr 18 12:08:41 2017 : Debug: ++[chap] = noop Tue Apr 18 12:08:41 2017 : Debug: ++[mschap] = noop Tue Apr 18 12:08:41 2017 : Debug: [suffix] No '@' in User-Name = "lahil001", looking up realm NULL Tue Apr 18 12:08:41 2017 : Debug: [suffix] Found realm "NULL" Tue Apr 18 12:08:41 2017 : Debug: [suffix] Adding Stripped-User-Name = "lahil001" Tue Apr 18 12:08:41 2017 : Debug: [suffix] Adding Realm = "NULL" Tue Apr 18 12:08:41 2017 : Debug: [suffix] Authentication realm is LOCAL. Tue Apr 18 12:08:41 2017 : Debug: ++[suffix] = ok Tue Apr 18 12:08:41 2017 : Debug: [eap] No EAP-Message, not doing EAP Tue Apr 18 12:08:41 2017 : Debug: ++[eap] = noop Tue Apr 18 12:08:41 2017 : Debug: [horizon_files] users: Matched entry DEFAULT at line 190 Tue Apr 18 12:08:41 2017 : Debug: ++[horizon_files] = ok Tue Apr 18 12:08:41 2017 : Debug: ++[expiration] = noop Tue Apr 18 12:08:41 2017 : Debug: ++[logintime] = noop Tue Apr 18 12:08:41 2017 : Debug: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Tue Apr 18 12:08:41 2017 : Debug: ++[pap] = noop Tue Apr 18 12:08:41 2017 : Debug: +} # group authorize = ok Tue Apr 18 12:08:41 2017 : Debug: Found Auth-Type = PAM Tue Apr 18 12:08:41 2017 : Debug: WARNING: Unknown value specified for Auth-Type. Cannot perform requested action. Tue Apr 18 12:08:41 2017 : Debug: # Executing group from file /etc/freeradius/sites-enabled/horizon Tue Apr 18 12:08:41 2017 : Debug: Failed to authenticate the user. Tue Apr 18 12:08:41 2017 : Debug: } # server horizon __ Fachhochschule Dortmund University of Applied Sciences and Arts Dipl.-Ing. (FH) Lars Hillebrand Dez. VI, IT-Basisdienste Sonnenstraße 100 - 44139 Dortmund Raum SON D 008 Tel 0231 9112-253 Fax 0231 9112-338 lars.hillebrand@fh-dortmund.de <mailto:lars.hillebrand@fh-dortmund.de> www.fh-dortmund.de <http://www.fh-dortmund.de/>