I am trying to perform the user authentication via freeradius server on the ssh conection. I have setup the free radius server according to the wiki pages: https://wiki.freeradius.org/guide/Getting-Started In addition, I managed to install the dolaradius to manage the free radius. I have run the radtest for the servers. The configurations for the radius server is: free radius server IP: 10.10.150.134 free radius server port: 1812 master secret: NOJA user name: micfox user password: micfox001 On the client machine (client IP: 10.10.150.136), I run the following command: *dev-ldap-server: radtest micfox micfox001 10.10.150.134:1812 <http://10.10.150.134:1812> 1812 NOJA* Sending Access-Request of id 5 to 10.10.150.134 port 1812 User-Name = "micfox" User-Password = "micfox001" NAS-IP-Address = 10.10.150.136 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 10.10.150.134 port 1812, id=5, length=38 Service-Type = Framed-User Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP So it should prove the free radius server is up and running. However, I have configured to use the pam-freeradius-auth.so to hookup with the PAM modules on the client machine to authenticate the ssh user. it does not work. I have updated the /etc/pam.d/sshd as follows: =========== *auth sufficient pam_radius_auth.so debug skip_passwd*# PAM configuration for the Secure Shell service # Standard Un*x authentication. @include common-auth # Disallow non-root logins when /etc/nologin exists. account required pam_nologin.so # Uncomment and edit /etc/security/access.conf if you need to set complex # access limits that are hard to express in sshd_config. # account required pam_access.so # Standard Un*x authorization. @include common-account # SELinux needs to be the first session rule. This ensures that any # lingering context has been cleared. Without this it is possible that a # module could execute code in the wrong domain. session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close # Set the loginuid process attribute. session required pam_loginuid.so # Create a new session keyring. session optional pam_keyinit.so force revoke # Standard Un*x session setup and teardown. @include common-session # Print the message of the day upon successful login. # This includes a dynamically generated part from /run/motd.dynamic # and a static (admin-editable) part from /etc/motd. session optional pam_motd.so motd=/run/motd.dynamic session optional pam_motd.so noupdate # Print the status of the user's mailbox upon successful login. session optional pam_mail.so standard noenv # [1] # Set up user limits from /etc/security/limits.conf. session required pam_limits.so # Read environment variables from /etc/environment and # /etc/security/pam_env.conf. session required pam_env.so # [1] # In Debian 4.0 (etch), locale-related environment variables were moved to # /etc/default/locale, so read that as well. session required pam_env.so user_readenv=1 envfile=/etc/default/locale # SELinux needs to intervene at login time to ensure that the process starts # in the proper default security context. Only sessions which are intended # to run in the user's context should be run after this. session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open # Standard Un*x password updating. @include common-password But now when I run the ssh micfox@10.10.150.136 (freeradius client's iP). the /var/log/auth.log has the following error messages: Jun 25 12:05:51 dev-ldap-server sshd[6441]: pam_radius_auth: Got user name micfox Jun 25 12:05:51 dev-ldap-server sshd[6441]: pam_radius_auth: ignore last_pass, force_prompt set Jun 25 12:05:51 dev-ldap-server sshd[6441]: pam_radius_auth: Sending RADIUS request code 1 Jun 25 12:05:51 dev-ldap-server sshd[6441]: pam_radius_auth: DEBUG: get_ipaddr(10.10.150.134) is available. (1812) Jun 25 12:05:51 dev-ldap-server sshd[6441]: pam_radius_auth: DEBUG: talk_radius(0x86960a0a) is available (1812,port). Jun 25 12:05:51 dev-ldap-server sshd[6441]: pam_radius_auth: DEBUG: waiting for response from radius server 10.10.150.134 with port 1812 (master secret: NOJA). *Jun 25 12:05:54 dev-ldap-server sshd[6441]: pam_radius_auth: RADIUS server 10.10.150.134 failed to respond* Jun 25 12:05:54 dev-ldap-server sshd[6441]: pam_radius_auth: All RADIUS servers failed to respond. Jun 25 12:05:54 dev-ldap-server sshd[6441]: pam_radius_auth: authentication failed Jun 25 12:05:54 dev-ldap-server sshd[6438]: Postponed keyboard-interactive for invalid user micfox from 127.0.0.1 port 37362 ssh2 [preauth] The RADIUS server always failed to respond.. I have configured the /etc/pam_radius_auth.conf as follows: # pam_radius_auth configuration file. Copy to: /etc/raddb/server # # For proper security, this file SHOULD have permissions 0600, # that is readable by root, and NO ONE else. If anyone other than # root can read this file, then they can spoof responses from the server! # # There are 3 fields per line in this file. There may be multiple # lines. Blank lines or lines beginning with '#' are treated as # comments, and are ignored. The fields are: # # server[:port] secret [timeout] # # the port name or number is optional. The default port name is # "radius", and is looked up from /etc/services The timeout field is # optional. The default timeout is 3 seconds. # # If multiple RADIUS server lines exist, they are tried in order. The # first server to return success or failure causes the module to return # success or failure. Only if a server fails to response is it skipped, # and the next server in turn is used. # # The timeout field controls how many seconds the module waits before # deciding that the server has failed to respond. # # server[:port] shared_secret timeout (s) *10.10.150.134:1831 <http://10.10.150.134:1831> NOJA 3* #other-server other-secret 3 # # having localhost in your radius configuration is a Good Thing. # # See the INSTALL file for pam.conf hints. I believed I should have setup everything correctly?? why is the radius-pam-auth.so not working with the error message, * RADIUS server 10.10.150.134 failed to respond??* I have prolonged the timeout parameter from 3 seconds to 60 seconds but it did not work. If the radius server is not correctly set, it should not even pass the radtest before. But why there is no response from the radius server for freeradius-pam-auth.so if the server does work?? what could go wrong from the configurations on the pam-radius module? Please advise
when you are doing the SSH, what does FreeRADIUS debug show? you appear to be using a totally different port number in your pam config 1831 ??? alan On 25 June 2018 at 05:56, Hailun Tan <dearambermini@gmail.com> wrote:
I am trying to perform the user authentication via freeradius server on the ssh conection.
I have setup the free radius server according to the wiki pages:
https://wiki.freeradius.org/guide/Getting-Started
In addition, I managed to install the dolaradius to manage the free radius. I have run the radtest for the servers.
The configurations for the radius server is: free radius server IP: 10.10.150.134 free radius server port: 1812 master secret: NOJA user name: micfox user password: micfox001
On the client machine (client IP: 10.10.150.136), I run the following command:
*dev-ldap-server: radtest micfox micfox001 10.10.150.134:1812 <http://10.10.150.134:1812> 1812 NOJA* Sending Access-Request of id 5 to 10.10.150.134 port 1812 User-Name = "micfox" User-Password = "micfox001" NAS-IP-Address = 10.10.150.136 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 10.10.150.134 port 1812, id=5, length=38 Service-Type = Framed-User Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP
So it should prove the free radius server is up and running.
However, I have configured to use the pam-freeradius-auth.so to hookup with the PAM modules on the client machine to authenticate the ssh user. it does not work. I have updated the /etc/pam.d/sshd as follows: ===========
*auth sufficient pam_radius_auth.so debug skip_passwd*# PAM configuration for the Secure Shell service
# Standard Un*x authentication. @include common-auth
# Disallow non-root logins when /etc/nologin exists. account required pam_nologin.so
# Uncomment and edit /etc/security/access.conf if you need to set complex # access limits that are hard to express in sshd_config. # account required pam_access.so
# Standard Un*x authorization. @include common-account
# SELinux needs to be the first session rule. This ensures that any # lingering context has been cleared. Without this it is possible that a # module could execute code in the wrong domain. session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
# Set the loginuid process attribute. session required pam_loginuid.so
# Create a new session keyring. session optional pam_keyinit.so force revoke
# Standard Un*x session setup and teardown. @include common-session
# Print the message of the day upon successful login. # This includes a dynamically generated part from /run/motd.dynamic # and a static (admin-editable) part from /etc/motd. session optional pam_motd.so motd=/run/motd.dynamic session optional pam_motd.so noupdate
# Print the status of the user's mailbox upon successful login. session optional pam_mail.so standard noenv # [1]
# Set up user limits from /etc/security/limits.conf. session required pam_limits.so
# Read environment variables from /etc/environment and # /etc/security/pam_env.conf. session required pam_env.so # [1] # In Debian 4.0 (etch), locale-related environment variables were moved to # /etc/default/locale, so read that as well. session required pam_env.so user_readenv=1 envfile=/etc/default/locale
# SELinux needs to intervene at login time to ensure that the process starts # in the proper default security context. Only sessions which are intended # to run in the user's context should be run after this. session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
# Standard Un*x password updating. @include common-password
But now when I run the ssh micfox@10.10.150.136 (freeradius client's iP). the /var/log/auth.log has the following error messages:
Jun 25 12:05:51 dev-ldap-server sshd[6441]: pam_radius_auth: Got user name micfox Jun 25 12:05:51 dev-ldap-server sshd[6441]: pam_radius_auth: ignore last_pass, force_prompt set Jun 25 12:05:51 dev-ldap-server sshd[6441]: pam_radius_auth: Sending RADIUS request code 1 Jun 25 12:05:51 dev-ldap-server sshd[6441]: pam_radius_auth: DEBUG: get_ipaddr(10.10.150.134) is available. (1812) Jun 25 12:05:51 dev-ldap-server sshd[6441]: pam_radius_auth: DEBUG: talk_radius(0x86960a0a) is available (1812,port). Jun 25 12:05:51 dev-ldap-server sshd[6441]: pam_radius_auth: DEBUG: waiting for response from radius server 10.10.150.134 with port 1812 (master secret: NOJA). *Jun 25 12:05:54 dev-ldap-server sshd[6441]: pam_radius_auth: RADIUS server 10.10.150.134 failed to respond* Jun 25 12:05:54 dev-ldap-server sshd[6441]: pam_radius_auth: All RADIUS servers failed to respond. Jun 25 12:05:54 dev-ldap-server sshd[6441]: pam_radius_auth: authentication failed Jun 25 12:05:54 dev-ldap-server sshd[6438]: Postponed keyboard-interactive for invalid user micfox from 127.0.0.1 port 37362 ssh2 [preauth]
The RADIUS server always failed to respond..
I have configured the /etc/pam_radius_auth.conf as follows:
# pam_radius_auth configuration file. Copy to: /etc/raddb/server # # For proper security, this file SHOULD have permissions 0600, # that is readable by root, and NO ONE else. If anyone other than # root can read this file, then they can spoof responses from the server! # # There are 3 fields per line in this file. There may be multiple # lines. Blank lines or lines beginning with '#' are treated as # comments, and are ignored. The fields are: # # server[:port] secret [timeout] # # the port name or number is optional. The default port name is # "radius", and is looked up from /etc/services The timeout field is # optional. The default timeout is 3 seconds. # # If multiple RADIUS server lines exist, they are tried in order. The # first server to return success or failure causes the module to return # success or failure. Only if a server fails to response is it skipped, # and the next server in turn is used. # # The timeout field controls how many seconds the module waits before # deciding that the server has failed to respond. # # server[:port] shared_secret timeout (s) *10.10.150.134:1831 <http://10.10.150.134:1831> NOJA 3* #other-server other-secret 3
# # having localhost in your radius configuration is a Good Thing. # # See the INSTALL file for pam.conf hints.
I believed I should have setup everything correctly?? why is the radius-pam-auth.so not working with the error message,
* RADIUS server 10.10.150.134 failed to respond??* I have prolonged the timeout parameter from 3 seconds to 60 seconds but it did not work.
If the radius server is not correctly set, it should not even pass the radtest before. But why there is no response from the radius server for freeradius-pam-auth.so if the server does work?? what could go wrong from the configurations on the pam-radius module?
Please advise - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
Hi Alan,
I fixed that "*: pam_radius_auth: RADIUS server 10.10.150.134 failed to
respond*" issue by updating the wrong port number and setting
"require-message-authenticator = no" for that particular client IP address
in the client.conf under /etc/freeradius on the free radius server side.
Now I am having another issue on the password mess when using
pam_radius_auth.so.
Now it seems the password for the user cannot be passed to the radius
server correctly when ssh was executed.
After checking the /var/log/auth.log on the client machine, it has
following items (in bold face) which worries me:
Jun 25 16:23:15 dev-ldap-server sshd[25675]: pam_radius_auth: Got user name
micfox
Jun 25 16:23:15 dev-ldap-server sshd[25675]: pam_radius_auth: ignore
last_pass, force_prompt set
Jun 25 16:23:15 dev-ldap-server sshd[25672]: Postponed keyboard-interactive
for invalid user micfox from 127.0.0.1 port 37892 ssh2 [preauth]
Jun 25 16:23:19 dev-ldap-server sshd[25675]: pam_radius_auth: Sending
RADIUS request code 1
Jun 25 16:23:19 dev-ldap-server sshd[25675]: pam_radius_auth: DEBUG:
get_ipaddr(10.10.150.134) returned 0.
Jun 25 16:23:20 dev-ldap-server sshd[25675]: pam_radius_auth: Got RADIUS
response code 3
Jun 25 16:23:20 dev-ldap-server sshd[25675]: pam_radius_auth:
authentication failed
Jun 25 16:23:20 dev-ldap-server sshd[25675]: pam_radius_auth: Got user name
micfox
Jun 25 16:23:20 dev-ldap-server sshd[25675]: pam_radius_auth: ignore
last_pass, force_prompt set
*Jun 25 16:23:20 dev-ldap-server sshd[25675]: pam_radius_auth: Got password
#010#012#015INCOR*
Jun 25 16:23:20 dev-ldap-server sshd[25675]: pam_radius_auth: Sending
RADIUS request code 1
Jun 25 16:23:20 dev-ldap-server sshd[25675]: pam_radius_auth: DEBUG:
get_ipaddr(10.10.150.134) returned 0.
Jun 25 16:23:21 dev-ldap-server sshd[25675]: pam_radius_auth: Got RADIUS
response code 3
Jun 25 16:23:21 dev-ldap-server sshd[25675]: pam_radius_auth:
authentication failed
*"#010#012#015INCOR" *is definitely not the password the user "micfox" has
*.*
I run the freeradius in debug mode on the server side. As expected, the
authentication failed due to the incorrect password.
Ready to process requests.
rad_recv: Access-Request packet from host 10.10.150.136 port 52388, id=151,
length=91
User-Name = "micfox"
* User-Password = "\010\n\r\177INCOR"*
NAS-IP-Address = 10.10.150.136
NAS-Identifier = "sshd"
NAS-Port = 26140
NAS-Port-Type = Virtual
Service-Type = Authenticate-Only
Calling-Station-Id = "10.10.150.136"
# Executing section authorize from file /etc/freeradius/sites-enabled/
default
+group authorize {
++[preprocess] = ok
++[chap] = noop
++[mschap] = noop
++[digest] = noop
[suffix] No '@' in User-Name = "micfox", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] = noop
[eap] No EAP-Message, not doing EAP
++[eap] = noop
[sql] expand: %{User-Name} -> micfox
[sql] sql_set_user escaped user --> 'micfox'
rlm_sql (sql): Reserving sql socket id: 14
[sql] expand: SELECT id, username, attribute, value, op FROM
radcheck WHERE username = '%{SQL-User-Name}' ORDER BY
id -> SELECT id, username, attribute, value, op FROM
radcheck WHERE username = 'micfox' ORDER BY id
[sql] User found in radcheck table
[sql] expand: SELECT id, username, attribute, value, op FROM
radreply WHERE username = '%{SQL-User-Name}' ORDER BY
id -> SELECT id, username, attribute, value, op FROM
radreply WHERE username = 'micfox' ORDER BY id
[sql] expand: SELECT groupname FROM radusergroup
WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT
groupname FROM radusergroup WHERE username =
'micfox' ORDER BY priority
[sql] expand: SELECT id, groupname, attribute, Value,
op FROM radgroupcheck WHERE groupname =
'%{Sql-Group}' ORDER BY id -> SELECT id, groupname,
attribute, Value, op FROM radgroupcheck WHERE
groupname = 'test' ORDER BY id
[sql] User found in group test
[sql] expand: SELECT id, groupname, attribute, value,
op FROM radgroupreply WHERE groupname =
'%{Sql-Group}' ORDER BY id -> SELECT id, groupname,
attribute, value, op FROM radgroupreply WHERE
groupname = 'test' ORDER BY id
rlm_sql (sql): Released sql socket id: 14
++[sql] = ok
++[expiration] = noop
++[logintime] = noop
++[pap] = updated
+} # group authorize = updated
Found Auth-Type = PAP
# Executing group from file /etc/freeradius/sites-enabled/default
+group PAP {
*[pap] login attempt with password "? INCOR"*[pap] Using clear text
password "micfox001"
[pap] Passwords don't match
++[pap] = reject
+} # group PAP = reject
Failed to authenticate the user.
WARNING: Unprintable characters in the password. Double-check the shared
secret on the server and the NAS!
Using Post-Auth-Type Reject
# Executing group from file /etc/freeradius/sites-enabled/default
+group REJECT {
[sql] expand: %{User-Name} -> micfox
[sql] sql_set_user escaped user --> 'micfox'
[sql] expand: %{User-Password} -> =5C010=5Cn=5Cr=5C177INCOR
[sql] expand: INSERT INTO radpostauth
(username, pass, reply, authdate) VALUES
( '%{User-Name}',
'%{%{User-Password}:-%{Chap-Password}}',
'%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth
(username, pass, reply, authdate) VALUES
( 'micfox',
'=5C010=5Cn=5Cr=5C177INCOR', 'Access-Reject',
'2018-06-25 16:45:25')
rlm_sql (sql) in sql_postauth: query is INSERT INTO
radpostauth (username, pass, reply,
authdate) VALUES (
'micfox', '=5C010=5Cn=5Cr=5C177INCOR',
'Access-Reject', '2018-06-25 16:45:25')
rlm_sql (sql): Reserving sql socket id: 13
rlm_sql (sql): Released sql socket id: 13
++[sql] = ok
[eap] Request didn't contain an EAP-Message, not inserting EAP-Failure
++[eap] = noop
[attr_filter.access_reject] expand: %{User-Name} -> micfox
attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] = updated
+} # group REJECT = updated
Delaying reject of request 8 for 1 seconds
*=============*
I then check the code in pam_radius_auth.c for the shared library
paM_radius_auth.so. I wonder where the password was actually retrieved from
the conversation function of PAM session. That is the first question I
would like to ask.
However, it is not the end of the problems. I now edited the code in
pam_radius_auth.c to offer a hard-coded correct password for the user
,micfox (i.e., the correct password is "micfox001"). Then the user
authentication passes in both client and server side for this connection.
However, the user still cannot open the ssh session. On the client side,
the /var/user/auth.log shows the following error:
======================
Jun 25 16:45:29 dev-ldap-server sshd[26137]: pam_radius_auth: Got user name
micfox
Jun 25 16:45:29 dev-ldap-server sshd[26137]: pam_radius_auth: Sending
RADIUS request code 1
Jun 25 16:45:29 dev-ldap-server sshd[26137]: pam_radius_auth: DEBUG:
get_ipaddr(10.10.150.134) returned 0.
Jun 25 16:45:30 dev-ldap-server sshd[26137]: pam_radius_auth: Got RADIUS
response code 3
Jun 25 16:45:30 dev-ldap-server sshd[26137]: pam_radius_auth:
authentication failed
Jun 25 16:45:30 dev-ldap-server sshd[26137]: pam_radius_auth: Got user name
micfox
Jun 25 16:45:30 dev-ldap-server sshd[26137]: pam_radius_auth: ignore
last_pass, force_prompt set
Jun 25 16:45:30 dev-ldap-server sshd[26137]: pam_radius_auth: Got password
micfox001
Jun 25 16:45:30 dev-ldap-server sshd[26137]: pam_radius_auth: Sending
RADIUS request code 1
Jun 25 16:45:30 dev-ldap-server sshd[26137]: pam_radius_auth: DEBUG:
get_ipaddr(10.10.150.134) returned 0.
Jun 25 16:45:31 dev-ldap-server sshd[26137]: pam_radius_auth: Got RADIUS
response code 2
Jun 25 16:45:31 dev-ldap-server sshd[26137]: pam_radius_auth:
authentication succeeded
J*un 25 16:45:31 dev-ldap-server sshd[26137]: Failed password for invalid
user micfox from 10.10.150.136 port 33330 ssh2*
Jun 25 17:09:01 dev-ldap-server CRON[26274]: pam_unix(cron:session):
session opened for user root by (uid=0)
Jun 25 17:09:03 dev-ldap-server CRON[26274]: pam_unix(cron:session):
session closed for user root
================
I am totally lost for that bold-face message. even though the user
authentication passes, why is the "Failed password for invalid user" still
shows up???
Can ssh actually use pam_radius_auth.so for user authentication?? Please
advise how to fix it as I really do not have any clue now...
On Tue, Jun 26, 2018 at 8:04 AM, Alan Buxey <alan.buxey@gmail.com> wrote:
> when you are doing the SSH, what does FreeRADIUS debug show? you appear to
> be using a totally different port number in your pam config 1831 ???
>
> alan
>
> On 25 June 2018 at 05:56, Hailun Tan <dearambermini@gmail.com> wrote:
>
> > I am trying to perform the user authentication via freeradius server on
> the
> > ssh conection.
> >
> > I have setup the free radius server according to the wiki pages:
> >
> > https://wiki.freeradius.org/guide/Getting-Started
> >
> >
> > In addition, I managed to install the dolaradius to manage the free
> > radius. I have run the radtest for the servers.
> >
> > The configurations for the radius server is:
> > free radius server IP: 10.10.150.134
> > free radius server port: 1812
> > master secret: NOJA
> > user name: micfox
> > user password: micfox001
> >
> >
> > On the client machine (client IP: 10.10.150.136), I run the following
> > command:
> >
> > *dev-ldap-server: radtest micfox micfox001 10.10.150.134:1812
> > <http://10.10.150.134:1812> 1812 NOJA*
> > Sending Access-Request of id 5 to 10.10.150.134 port 1812
> > User-Name = "micfox"
> > User-Password = "micfox001"
> > NAS-IP-Address = 10.10.150.136
> > NAS-Port = 1812
> > Message-Authenticator = 0x00000000000000000000000000000000
> > rad_recv: Access-Accept packet from host 10.10.150.134 port 1812, id=5,
> > length=38
> > Service-Type = Framed-User
> > Framed-Protocol = PPP
> > Framed-Compression = Van-Jacobson-TCP-IP
> >
> > So it should prove the free radius server is up and running.
> >
> >
> > However, I have configured to use the pam-freeradius-auth.so to hookup
> > with the PAM modules on the client machine to authenticate the ssh user.
> it
> > does not work. I have updated the /etc/pam.d/sshd as follows:
> > ===========
> >
> >
> > *auth sufficient pam_radius_auth.so debug skip_passwd*# PAM configuration
> > for the Secure Shell service
> >
> > # Standard Un*x authentication.
> > @include common-auth
> >
> > # Disallow non-root logins when /etc/nologin exists.
> > account required pam_nologin.so
> >
> > # Uncomment and edit /etc/security/access.conf if you need to set complex
> > # access limits that are hard to express in sshd_config.
> > # account required pam_access.so
> >
> > # Standard Un*x authorization.
> > @include common-account
> >
> > # SELinux needs to be the first session rule. This ensures that any
> > # lingering context has been cleared. Without this it is possible that a
> > # module could execute code in the wrong domain.
> > session [success=ok ignore=ignore module_unknown=ignore default=bad]
> > pam_selinux.so close
> >
> > # Set the loginuid process attribute.
> > session required pam_loginuid.so
> >
> > # Create a new session keyring.
> > session optional pam_keyinit.so force revoke
> >
> > # Standard Un*x session setup and teardown.
> > @include common-session
> >
> > # Print the message of the day upon successful login.
> > # This includes a dynamically generated part from /run/motd.dynamic
> > # and a static (admin-editable) part from /etc/motd.
> > session optional pam_motd.so motd=/run/motd.dynamic
> > session optional pam_motd.so noupdate
> >
> > # Print the status of the user's mailbox upon successful login.
> > session optional pam_mail.so standard noenv # [1]
> >
> > # Set up user limits from /etc/security/limits.conf.
> > session required pam_limits.so
> >
> > # Read environment variables from /etc/environment and
> > # /etc/security/pam_env.conf.
> > session required pam_env.so # [1]
> > # In Debian 4.0 (etch), locale-related environment variables were moved
> to
> > # /etc/default/locale, so read that as well.
> > session required pam_env.so user_readenv=1
> > envfile=/etc/default/locale
> >
> > # SELinux needs to intervene at login time to ensure that the process
> > starts
> > # in the proper default security context. Only sessions which are
> intended
> > # to run in the user's context should be run after this.
> > session [success=ok ignore=ignore module_unknown=ignore default=bad]
> > pam_selinux.so open
> >
> > # Standard Un*x password updating.
> > @include common-password
> >
> >
> > But now when I run the ssh micfox@10.10.150.136 (freeradius client's
> iP).
> > the /var/log/auth.log has the following error messages:
> >
> >
> > Jun 25 12:05:51 dev-ldap-server sshd[6441]: pam_radius_auth: Got user
> name
> > micfox
> > Jun 25 12:05:51 dev-ldap-server sshd[6441]: pam_radius_auth: ignore
> > last_pass, force_prompt set
> > Jun 25 12:05:51 dev-ldap-server sshd[6441]: pam_radius_auth: Sending
> RADIUS
> > request code 1
> > Jun 25 12:05:51 dev-ldap-server sshd[6441]: pam_radius_auth: DEBUG:
> > get_ipaddr(10.10.150.134) is available. (1812)
> > Jun 25 12:05:51 dev-ldap-server sshd[6441]: pam_radius_auth: DEBUG:
> > talk_radius(0x86960a0a) is available (1812,port).
> > Jun 25 12:05:51 dev-ldap-server sshd[6441]: pam_radius_auth: DEBUG:
> > waiting for response from radius server 10.10.150.134 with port 1812
> > (master secret: NOJA).
> > *Jun 25 12:05:54 dev-ldap-server sshd[6441]: pam_radius_auth: RADIUS
> server
> > 10.10.150.134 failed to respond*
> > Jun 25 12:05:54 dev-ldap-server sshd[6441]: pam_radius_auth: All RADIUS
> > servers failed to respond.
> > Jun 25 12:05:54 dev-ldap-server sshd[6441]: pam_radius_auth:
> authentication
> > failed
> > Jun 25 12:05:54 dev-ldap-server sshd[6438]: Postponed
> keyboard-interactive
> > for invalid user micfox from 127.0.0.1 port 37362 ssh2 [preauth]
> >
> >
> >
> > The RADIUS server always failed to respond..
> >
> > I have configured the /etc/pam_radius_auth.conf as follows:
> >
> >
> >
> > # pam_radius_auth configuration file. Copy to: /etc/raddb/server
> > #
> > # For proper security, this file SHOULD have permissions 0600,
> > # that is readable by root, and NO ONE else. If anyone other than
> > # root can read this file, then they can spoof responses from the
> server!
> > #
> > # There are 3 fields per line in this file. There may be multiple
> > # lines. Blank lines or lines beginning with '#' are treated as
> > # comments, and are ignored. The fields are:
> > #
> > # server[:port] secret [timeout]
> > #
> > # the port name or number is optional. The default port name is
> > # "radius", and is looked up from /etc/services The timeout field is
> > # optional. The default timeout is 3 seconds.
> > #
> > # If multiple RADIUS server lines exist, they are tried in order. The
> > # first server to return success or failure causes the module to return
> > # success or failure. Only if a server fails to response is it skipped,
> > # and the next server in turn is used.
> > #
> > # The timeout field controls how many seconds the module waits before
> > # deciding that the server has failed to respond.
> > #
> > # server[:port] shared_secret timeout (s)
> > *10.10.150.134:1831 <http://10.10.150.134:1831> NOJA 3*
> > #other-server other-secret 3
> >
> > #
> > # having localhost in your radius configuration is a Good Thing.
> > #
> > # See the INSTALL file for pam.conf hints.
> >
> >
> > I believed I should have setup everything correctly?? why is the
> > radius-pam-auth.so not working with the error message,
> >
> > * RADIUS server 10.10.150.134 failed to respond??*
> > I have prolonged the timeout parameter from 3 seconds to 60 seconds but
> it
> > did not work.
> >
> > If the radius server is not correctly set, it should not even pass the
> > radtest before. But why there is no response from the radius server for
> > freeradius-pam-auth.so if the server does work?? what could go wrong from
> > the configurations on the pam-radius module?
> >
> > Please advise
> > -
> > List info/subscribe/unsubscribe? See http://www.freeradius.org/
> > list/users.html
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/
> list/users.html
I think my problem is related to the following thread a couple of years ago:
http://freeradius.1045715.n5.nabble.com/ssh-authentication-failed-problem-use-freeradius-amp-pam-radius-td5687733.html
However, in the link above, no one has ever mentioned how to configurate
PAM to read the password from the conversation function correctly?
The replies kept saying modifying PAM modules instead of
pam_radius_auth.so. But to be honest, the pam_radius_auth.c is one of the
customized PAM modules. If pam_radius_auth.so is not the one to be
modified, which one should be? No one has ever given any answers to that...
I hate asking the same question repeatedly. However, unless a viable
solution is given, these question will keep popping back to the mail list.
So for those free radius gurus, please advise how to fix it even though it
might not directly be related to free radius.
On Tue, Jun 26, 2018 at 9:48 AM, Hailun Tan <dearambermini@gmail.com> wrote:
> Hi Alan,
>
> I fixed that "*: pam_radius_auth: RADIUS server 10.10.150.134 failed to
> respond*" issue by updating the wrong port number and setting
> "require-message-authenticator = no" for that particular client IP address
> in the client.conf under /etc/freeradius on the free radius server side.
>
>
> Now I am having another issue on the password mess when using
> pam_radius_auth.so.
>
>
> Now it seems the password for the user cannot be passed to the radius
> server correctly when ssh was executed.
>
> After checking the /var/log/auth.log on the client machine, it has
> following items (in bold face) which worries me:
>
> Jun 25 16:23:15 dev-ldap-server sshd[25675]: pam_radius_auth: Got user
> name micfox
> Jun 25 16:23:15 dev-ldap-server sshd[25675]: pam_radius_auth: ignore
> last_pass, force_prompt set
> Jun 25 16:23:15 dev-ldap-server sshd[25672]: Postponed
> keyboard-interactive for invalid user micfox from 127.0.0.1 port 37892 ssh2
> [preauth]
> Jun 25 16:23:19 dev-ldap-server sshd[25675]: pam_radius_auth: Sending
> RADIUS request code 1
> Jun 25 16:23:19 dev-ldap-server sshd[25675]: pam_radius_auth: DEBUG:
> get_ipaddr(10.10.150.134) returned 0.
> Jun 25 16:23:20 dev-ldap-server sshd[25675]: pam_radius_auth: Got RADIUS
> response code 3
> Jun 25 16:23:20 dev-ldap-server sshd[25675]: pam_radius_auth:
> authentication failed
> Jun 25 16:23:20 dev-ldap-server sshd[25675]: pam_radius_auth: Got user
> name micfox
> Jun 25 16:23:20 dev-ldap-server sshd[25675]: pam_radius_auth: ignore
> last_pass, force_prompt set
> *Jun 25 16:23:20 dev-ldap-server sshd[25675]: pam_radius_auth: Got
> password #010#012#015INCOR*
> Jun 25 16:23:20 dev-ldap-server sshd[25675]: pam_radius_auth: Sending
> RADIUS request code 1
> Jun 25 16:23:20 dev-ldap-server sshd[25675]: pam_radius_auth: DEBUG:
> get_ipaddr(10.10.150.134) returned 0.
> Jun 25 16:23:21 dev-ldap-server sshd[25675]: pam_radius_auth: Got RADIUS
> response code 3
> Jun 25 16:23:21 dev-ldap-server sshd[25675]: pam_radius_auth:
> authentication failed
>
>
> *"#010#012#015INCOR" *is definitely not the password the user "micfox" has
>
>
> *.*
> I run the freeradius in debug mode on the server side. As expected, the
> authentication failed due to the incorrect password.
>
>
> Ready to process requests.
> rad_recv: Access-Request packet from host 10.10.150.136 port 52388,
> id=151, length=91
> User-Name = "micfox"
> * User-Password = "\010\n\r\177INCOR"*
> NAS-IP-Address = 10.10.150.136
> NAS-Identifier = "sshd"
> NAS-Port = 26140
> NAS-Port-Type = Virtual
> Service-Type = Authenticate-Only
> Calling-Station-Id = "10.10.150.136"
> # Executing section authorize from file /etc/freeradius/sites-enabled/
> default
> +group authorize {
> ++[preprocess] = ok
> ++[chap] = noop
> ++[mschap] = noop
> ++[digest] = noop
> [suffix] No '@' in User-Name = "micfox", looking up realm NULL
> [suffix] No such realm "NULL"
> ++[suffix] = noop
> [eap] No EAP-Message, not doing EAP
> ++[eap] = noop
> [sql] expand: %{User-Name} -> micfox
> [sql] sql_set_user escaped user --> 'micfox'
> rlm_sql (sql): Reserving sql socket id: 14
> [sql] expand: SELECT id, username, attribute, value, op FROM
> radcheck WHERE username = '%{SQL-User-Name}' ORDER BY
> id -> SELECT id, username, attribute, value, op FROM
> radcheck WHERE username = 'micfox' ORDER BY id
> [sql] User found in radcheck table
> [sql] expand: SELECT id, username, attribute, value, op FROM
> radreply WHERE username = '%{SQL-User-Name}' ORDER BY
> id -> SELECT id, username, attribute, value, op FROM
> radreply WHERE username = 'micfox' ORDER BY id
> [sql] expand: SELECT groupname FROM radusergroup
> WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT
> groupname FROM radusergroup WHERE username =
> 'micfox' ORDER BY priority
> [sql] expand: SELECT id, groupname, attribute, Value,
> op FROM radgroupcheck WHERE groupname =
> '%{Sql-Group}' ORDER BY id -> SELECT id, groupname,
> attribute, Value, op FROM radgroupcheck WHERE
> groupname = 'test' ORDER BY id
> [sql] User found in group test
> [sql] expand: SELECT id, groupname, attribute, value,
> op FROM radgroupreply WHERE groupname =
> '%{Sql-Group}' ORDER BY id -> SELECT id, groupname,
> attribute, value, op FROM radgroupreply WHERE
> groupname = 'test' ORDER BY id
> rlm_sql (sql): Released sql socket id: 14
> ++[sql] = ok
> ++[expiration] = noop
> ++[logintime] = noop
> ++[pap] = updated
> +} # group authorize = updated
> Found Auth-Type = PAP
> # Executing group from file /etc/freeradius/sites-enabled/default
> +group PAP {
>
> *[pap] login attempt with password "? INCOR"*[pap] Using clear text
> password "micfox001"
> [pap] Passwords don't match
> ++[pap] = reject
> +} # group PAP = reject
> Failed to authenticate the user.
> WARNING: Unprintable characters in the password. Double-check the
> shared secret on the server and the NAS!
> Using Post-Auth-Type Reject
> # Executing group from file /etc/freeradius/sites-enabled/default
> +group REJECT {
> [sql] expand: %{User-Name} -> micfox
> [sql] sql_set_user escaped user --> 'micfox'
> [sql] expand: %{User-Password} -> =5C010=5Cn=5Cr=5C177INCOR
> [sql] expand: INSERT INTO radpostauth
> (username, pass, reply, authdate) VALUES
> ( '%{User-Name}',
> '%{%{User-Password}:-%{Chap-Password}}',
> '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth
> (username, pass, reply, authdate) VALUES
> ( 'micfox',
> '=5C010=5Cn=5Cr=5C177INCOR', 'Access-Reject',
> '2018-06-25 16:45:25')
> rlm_sql (sql) in sql_postauth: query is INSERT INTO
> radpostauth (username, pass, reply,
> authdate) VALUES (
> 'micfox', '=5C010=5Cn=5Cr=5C177INCOR',
> 'Access-Reject', '2018-06-25 16:45:25')
> rlm_sql (sql): Reserving sql socket id: 13
> rlm_sql (sql): Released sql socket id: 13
> ++[sql] = ok
> [eap] Request didn't contain an EAP-Message, not inserting EAP-Failure
> ++[eap] = noop
> [attr_filter.access_reject] expand: %{User-Name} -> micfox
> attr_filter: Matched entry DEFAULT at line 11
> ++[attr_filter.access_reject] = updated
> +} # group REJECT = updated
> Delaying reject of request 8 for 1 seconds
>
>
>
>
> *=============*
> I then check the code in pam_radius_auth.c for the shared library
> paM_radius_auth.so. I wonder where the password was actually retrieved from
> the conversation function of PAM session. That is the first question I
> would like to ask.
>
>
> However, it is not the end of the problems. I now edited the code in
> pam_radius_auth.c to offer a hard-coded correct password for the user
> ,micfox (i.e., the correct password is "micfox001"). Then the user
> authentication passes in both client and server side for this connection.
> However, the user still cannot open the ssh session. On the client side,
> the /var/user/auth.log shows the following error:
>
> ======================
>
> Jun 25 16:45:29 dev-ldap-server sshd[26137]: pam_radius_auth: Got user
> name micfox
> Jun 25 16:45:29 dev-ldap-server sshd[26137]: pam_radius_auth: Sending
> RADIUS request code 1
> Jun 25 16:45:29 dev-ldap-server sshd[26137]: pam_radius_auth: DEBUG:
> get_ipaddr(10.10.150.134) returned 0.
> Jun 25 16:45:30 dev-ldap-server sshd[26137]: pam_radius_auth: Got RADIUS
> response code 3
> Jun 25 16:45:30 dev-ldap-server sshd[26137]: pam_radius_auth:
> authentication failed
> Jun 25 16:45:30 dev-ldap-server sshd[26137]: pam_radius_auth: Got user
> name micfox
> Jun 25 16:45:30 dev-ldap-server sshd[26137]: pam_radius_auth: ignore
> last_pass, force_prompt set
> Jun 25 16:45:30 dev-ldap-server sshd[26137]: pam_radius_auth: Got password
> micfox001
> Jun 25 16:45:30 dev-ldap-server sshd[26137]: pam_radius_auth: Sending
> RADIUS request code 1
> Jun 25 16:45:30 dev-ldap-server sshd[26137]: pam_radius_auth: DEBUG:
> get_ipaddr(10.10.150.134) returned 0.
> Jun 25 16:45:31 dev-ldap-server sshd[26137]: pam_radius_auth: Got RADIUS
> response code 2
> Jun 25 16:45:31 dev-ldap-server sshd[26137]: pam_radius_auth:
> authentication succeeded
> J*un 25 16:45:31 dev-ldap-server sshd[26137]: Failed password for invalid
> user micfox from 10.10.150.136 port 33330 ssh2*
> Jun 25 17:09:01 dev-ldap-server CRON[26274]: pam_unix(cron:session):
> session opened for user root by (uid=0)
> Jun 25 17:09:03 dev-ldap-server CRON[26274]: pam_unix(cron:session):
> session closed for user root
>
>
> ================
>
> I am totally lost for that bold-face message. even though the user
> authentication passes, why is the "Failed password for invalid user" still
> shows up???
>
> Can ssh actually use pam_radius_auth.so for user authentication?? Please
> advise how to fix it as I really do not have any clue now...
>
>
>
>
>
>
>
>
> On Tue, Jun 26, 2018 at 8:04 AM, Alan Buxey <alan.buxey@gmail.com> wrote:
>
>> when you are doing the SSH, what does FreeRADIUS debug show? you appear
>> to
>> be using a totally different port number in your pam config 1831 ???
>>
>> alan
>>
>> On 25 June 2018 at 05:56, Hailun Tan <dearambermini@gmail.com> wrote:
>>
>> > I am trying to perform the user authentication via freeradius server on
>> the
>> > ssh conection.
>> >
>> > I have setup the free radius server according to the wiki pages:
>> >
>> > https://wiki.freeradius.org/guide/Getting-Started
>> >
>> >
>> > In addition, I managed to install the dolaradius to manage the free
>> > radius. I have run the radtest for the servers.
>> >
>> > The configurations for the radius server is:
>> > free radius server IP: 10.10.150.134
>> > free radius server port: 1812
>> > master secret: NOJA
>> > user name: micfox
>> > user password: micfox001
>> >
>> >
>> > On the client machine (client IP: 10.10.150.136), I run the following
>> > command:
>> >
>> > *dev-ldap-server: radtest micfox micfox001 10.10.150.134:1812
>> > <http://10.10.150.134:1812> 1812 NOJA*
>> > Sending Access-Request of id 5 to 10.10.150.134 port 1812
>> > User-Name = "micfox"
>> > User-Password = "micfox001"
>> > NAS-IP-Address = 10.10.150.136
>> > NAS-Port = 1812
>> > Message-Authenticator = 0x00000000000000000000000000000000
>> > rad_recv: Access-Accept packet from host 10.10.150.134 port 1812, id=5,
>> > length=38
>> > Service-Type = Framed-User
>> > Framed-Protocol = PPP
>> > Framed-Compression = Van-Jacobson-TCP-IP
>> >
>> > So it should prove the free radius server is up and running.
>> >
>> >
>> > However, I have configured to use the pam-freeradius-auth.so to hookup
>> > with the PAM modules on the client machine to authenticate the ssh
>> user. it
>> > does not work. I have updated the /etc/pam.d/sshd as follows:
>> > ===========
>> >
>> >
>> > *auth sufficient pam_radius_auth.so debug skip_passwd*# PAM
>> configuration
>> > for the Secure Shell service
>> >
>> > # Standard Un*x authentication.
>> > @include common-auth
>> >
>> > # Disallow non-root logins when /etc/nologin exists.
>> > account required pam_nologin.so
>> >
>> > # Uncomment and edit /etc/security/access.conf if you need to set
>> complex
>> > # access limits that are hard to express in sshd_config.
>> > # account required pam_access.so
>> >
>> > # Standard Un*x authorization.
>> > @include common-account
>> >
>> > # SELinux needs to be the first session rule. This ensures that any
>> > # lingering context has been cleared. Without this it is possible that
>> a
>> > # module could execute code in the wrong domain.
>> > session [success=ok ignore=ignore module_unknown=ignore default=bad]
>> > pam_selinux.so close
>> >
>> > # Set the loginuid process attribute.
>> > session required pam_loginuid.so
>> >
>> > # Create a new session keyring.
>> > session optional pam_keyinit.so force revoke
>> >
>> > # Standard Un*x session setup and teardown.
>> > @include common-session
>> >
>> > # Print the message of the day upon successful login.
>> > # This includes a dynamically generated part from /run/motd.dynamic
>> > # and a static (admin-editable) part from /etc/motd.
>> > session optional pam_motd.so motd=/run/motd.dynamic
>> > session optional pam_motd.so noupdate
>> >
>> > # Print the status of the user's mailbox upon successful login.
>> > session optional pam_mail.so standard noenv # [1]
>> >
>> > # Set up user limits from /etc/security/limits.conf.
>> > session required pam_limits.so
>> >
>> > # Read environment variables from /etc/environment and
>> > # /etc/security/pam_env.conf.
>> > session required pam_env.so # [1]
>> > # In Debian 4.0 (etch), locale-related environment variables were moved
>> to
>> > # /etc/default/locale, so read that as well.
>> > session required pam_env.so user_readenv=1
>> > envfile=/etc/default/locale
>> >
>> > # SELinux needs to intervene at login time to ensure that the process
>> > starts
>> > # in the proper default security context. Only sessions which are
>> intended
>> > # to run in the user's context should be run after this.
>> > session [success=ok ignore=ignore module_unknown=ignore default=bad]
>> > pam_selinux.so open
>> >
>> > # Standard Un*x password updating.
>> > @include common-password
>> >
>> >
>> > But now when I run the ssh micfox@10.10.150.136 (freeradius client's
>> iP).
>> > the /var/log/auth.log has the following error messages:
>> >
>> >
>> > Jun 25 12:05:51 dev-ldap-server sshd[6441]: pam_radius_auth: Got user
>> name
>> > micfox
>> > Jun 25 12:05:51 dev-ldap-server sshd[6441]: pam_radius_auth: ignore
>> > last_pass, force_prompt set
>> > Jun 25 12:05:51 dev-ldap-server sshd[6441]: pam_radius_auth: Sending
>> RADIUS
>> > request code 1
>> > Jun 25 12:05:51 dev-ldap-server sshd[6441]: pam_radius_auth: DEBUG:
>> > get_ipaddr(10.10.150.134) is available. (1812)
>> > Jun 25 12:05:51 dev-ldap-server sshd[6441]: pam_radius_auth: DEBUG:
>> > talk_radius(0x86960a0a) is available (1812,port).
>> > Jun 25 12:05:51 dev-ldap-server sshd[6441]: pam_radius_auth: DEBUG:
>> > waiting for response from radius server 10.10.150.134 with port 1812
>> > (master secret: NOJA).
>> > *Jun 25 12:05:54 dev-ldap-server sshd[6441]: pam_radius_auth: RADIUS
>> server
>> > 10.10.150.134 failed to respond*
>> > Jun 25 12:05:54 dev-ldap-server sshd[6441]: pam_radius_auth: All RADIUS
>> > servers failed to respond.
>> > Jun 25 12:05:54 dev-ldap-server sshd[6441]: pam_radius_auth:
>> authentication
>> > failed
>> > Jun 25 12:05:54 dev-ldap-server sshd[6438]: Postponed
>> keyboard-interactive
>> > for invalid user micfox from 127.0.0.1 port 37362 ssh2 [preauth]
>> >
>> >
>> >
>> > The RADIUS server always failed to respond..
>> >
>> > I have configured the /etc/pam_radius_auth.conf as follows:
>> >
>> >
>> >
>> > # pam_radius_auth configuration file. Copy to: /etc/raddb/server
>> > #
>> > # For proper security, this file SHOULD have permissions 0600,
>> > # that is readable by root, and NO ONE else. If anyone other than
>> > # root can read this file, then they can spoof responses from the
>> server!
>> > #
>> > # There are 3 fields per line in this file. There may be multiple
>> > # lines. Blank lines or lines beginning with '#' are treated as
>> > # comments, and are ignored. The fields are:
>> > #
>> > # server[:port] secret [timeout]
>> > #
>> > # the port name or number is optional. The default port name is
>> > # "radius", and is looked up from /etc/services The timeout field is
>> > # optional. The default timeout is 3 seconds.
>> > #
>> > # If multiple RADIUS server lines exist, they are tried in order. The
>> > # first server to return success or failure causes the module to return
>> > # success or failure. Only if a server fails to response is it
>> skipped,
>> > # and the next server in turn is used.
>> > #
>> > # The timeout field controls how many seconds the module waits before
>> > # deciding that the server has failed to respond.
>> > #
>> > # server[:port] shared_secret timeout (s)
>> > *10.10.150.134:1831 <http://10.10.150.134:1831> NOJA 3*
>> > #other-server other-secret 3
>> >
>> > #
>> > # having localhost in your radius configuration is a Good Thing.
>> > #
>> > # See the INSTALL file for pam.conf hints.
>> >
>> >
>> > I believed I should have setup everything correctly?? why is the
>> > radius-pam-auth.so not working with the error message,
>> >
>> > * RADIUS server 10.10.150.134 failed to respond??*
>> > I have prolonged the timeout parameter from 3 seconds to 60 seconds but
>> it
>> > did not work.
>> >
>> > If the radius server is not correctly set, it should not even pass the
>> > radtest before. But why there is no response from the radius server for
>> > freeradius-pam-auth.so if the server does work?? what could go wrong
>> from
>> > the configurations on the pam-radius module?
>> >
>> > Please advise
>> > -
>> > List info/subscribe/unsubscribe? See http://www.freeradius.org/
>> > list/users.html
>> -
>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list
>> /users.html
>
>
>
On Jun 25, 2018, at 8:10 PM, Hailun Tan <dearambermini@gmail.com> wrote:
I think my problem is related to the following thread a couple of years ago:
http://freeradius.1045715.n5.nabble.com/ssh-authentication-failed-problem-us...
However, in the link above, no one has ever mentioned how to configurate PAM to read the password from the conversation function correctly?
You don't. The problem is that ANOTHER PAM module is failing. So the PAM libraries are mangling the password. There is NOTHING you can do to FreeRADIUS or pam_radius_auth to fix the problem. You MUST modify the PAM configuration on the client machine to remove the problem PAM module.
The replies kept saying modifying PAM modules instead of pam_radius_auth.so. But to be honest, the pam_radius_auth.c is one of the customized PAM modules. If pam_radius_auth.so is not the one to be modified, which one should be? No one has ever given any answers to that...
The answers in the link you posted are pretty clear.
I hate asking the same question repeatedly. However, unless a viable solution is given, these question will keep popping back to the mail list. So for those free radius gurus, please advise how to fix it even though it might not directly be related to free radius.
Fix the PAM configuration on the client. The link you posted says this. How to fix it? I don't know... go ask the PAM people how their software works. Alan DeKok.
The replies kept saying modifying PAM modules instead of pam_radius_auth.so. But to be honest, the pam_radius_auth.c is one of the customized PAM modules. If pam_radius_auth.so is not the one to be modified, which one should be? No one has ever given any answers to that...
The answers in the link you posted are pretty clear. =================== I do not think the answer in the previous link was clear. The only viable solution in the link above is that having another local user with the same name then it will fix the problem. Yes, it does fix the problem. But what is the point to have radius server if a local user is required for radius to work? Considering that there are thousands of radius clients to hookup with one radius server, having a local user for each of these clients for such user to work does not make sense. My question is very clear. If pam_radius_auth.so is not the one to be fixed, which other pam module should be fixed? At least you can provide a way for us to check which PAM module is failing so that we can check. I have even tried to disable ALL the pam module in /etc/pam.d/sshd except pam_radius_auth.so but I cannot even log in the ubuntu if i did that :( So that is the most difficult part to troubleshoot with PAM. On Tue, Jun 26, 2018 at 10:51 AM, Alan DeKok <aland@deployingradius.com> wrote:
On Jun 25, 2018, at 8:10 PM, Hailun Tan <dearambermini@gmail.com> wrote:
I think my problem is related to the following thread a couple of years
ago:
failed-problem-use-freeradius-amp-pam-radius-td5687733.html
However, in the link above, no one has ever mentioned how to configurate PAM to read the password from the conversation function correctly?
You don't.
The problem is that ANOTHER PAM module is failing. So the PAM libraries are mangling the password.
There is NOTHING you can do to FreeRADIUS or pam_radius_auth to fix the problem.
You MUST modify the PAM configuration on the client machine to remove the problem PAM module.
The replies kept saying modifying PAM modules instead of pam_radius_auth.so. But to be honest, the pam_radius_auth.c is one of the customized PAM modules. If pam_radius_auth.so is not the one to be modified, which one should be? No one has ever given any answers to that...
The answers in the link you posted are pretty clear.
I hate asking the same question repeatedly. However, unless a viable solution is given, these question will keep popping back to the mail list. So for those free radius gurus, please advise how to fix it even though it might not directly be related to free radius.
Fix the PAM configuration on the client. The link you posted says this.
How to fix it? I don't know... go ask the PAM people how their software works.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
On Jun 25, 2018, at 9:09 PM, Hailun Tan <dearambermini@gmail.com> wrote:
I do not think the answer in the previous link was clear.
It doesn't explain *why* PAM works the way it does. But it explains what's happening, and how to fix it. PAM problems? Ask the PAM people
The only viable solution in the link above is that having another local user with the same name then it will fix the problem. Yes, it does fix the problem. But what is the point to have radius server if a local user is required for radius to work?
The point is that you can specify a users password (or OTP) via RADIUS. If you read the PAM documentation, it says that PAM doesn't supply UID, GID, shell, home directory, etc. PAM only does username / password checking. And some session logging.
Considering that there are thousands of radius clients to hookup with one radius server, having a local user for each of these clients for such user to work does not make sense.
That's what LDAP is for. Put the users into LDAP. Configure NSS && LDAP. That gets you UID, GID, etc. Then do username / password checking via RADIUS.
My question is very clear. If pam_radius_auth.so is not the one to be fixed, which other pam module should be fixed?
As I said repeatedly, ask the PAM people how their software works. This isn't the "PAM help list". This is the FreeRADIUS list.
At least you can provide a way for us to check which PAM module is failing so that we can check.
No. It's ridiculous to ask that, because I didn't write PAM, and I know nothing about it.
I have even tried to disable ALL the pam module in /etc/pam.d/sshd except pam_radius_auth.so but I cannot even log in the ubuntu if i did that :( So that is the most difficult part to troubleshoot with PAM.
That's terrible. Why does that happen? I don't know... ASK THE PAM PEOPLE HOW THEIR SOFTWARE WORKS. Alan DeKok.
On Tue, Jun 26, 2018 at 11:24 AM, Alan DeKok <aland@deployingradius.com> wrote:
On Jun 25, 2018, at 9:09 PM, Hailun Tan <dearambermini@gmail.com> wrote:
I do not think the answer in the previous link was clear.
It doesn't explain *why* PAM works the way it does. But it explains what's happening, and how to fix it.
PAM problems? Ask the PAM people
The only viable solution in the link above is that having another local user with the same name then it will fix the problem. Yes, it does fix the problem. But what is the point to have radius server if a local user is required for radius to work?
The point is that you can specify a users password (or OTP) via RADIUS.
If you read the PAM documentation, it says that PAM doesn't supply UID, GID, shell, home directory, etc. PAM only does username / password checking. And some session logging.
Considering that there are thousands of radius clients to hookup with one radius server, having a local user for each of these clients for such user to work does not make sense.
That's what LDAP is for. Put the users into LDAP. Configure NSS && LDAP. That gets you UID, GID, etc. Then do username / password checking via RADIUS.
=============== I am new in the Radius concept. So the users in Radius server cannot be processed as those in LDAP because the users in Radius are not configured with UID/GID, etc? On the other hand, Radius cannot completely take the role of LDAP? So i wonder if PAM is not used for username/ password checking, in that case, Does the UID/GID missing in Radius user matter? In that way, can Radius server replace LDAP? Thanks again for your advice.
My question is very clear. If pam_radius_auth.so is not the one to be fixed, which other pam module should be fixed?
As I said repeatedly, ask the PAM people how their software works. This isn't the "PAM help list". This is the FreeRADIUS list.
At least you can provide a way for us to check which PAM module is failing so that we can check.
No. It's ridiculous to ask that, because I didn't write PAM, and I know nothing about it.
I have even tried to disable ALL the pam module in /etc/pam.d/sshd except pam_radius_auth.so but I cannot even log in the ubuntu if i did that :( So that is the most difficult part to troubleshoot with PAM.
That's terrible.
Why does that happen? I don't know...
ASK THE PAM PEOPLE HOW THEIR SOFTWARE WORKS.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
Please see my other post. The pam module in question is pam_unix.so. Yu -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+ywang10=fsu.edu@lists.freeradius.org] On Behalf Of Hailun Tan Sent: Monday, June 25, 2018 10:57 PM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: On Tue, Jun 26, 2018 at 11:24 AM, Alan DeKok <aland@deployingradius.com> wrote:
On Jun 25, 2018, at 9:09 PM, Hailun Tan <dearambermini@gmail.com> wrote:
I do not think the answer in the previous link was clear.
It doesn't explain *why* PAM works the way it does. But it explains what's happening, and how to fix it.
PAM problems? Ask the PAM people
The only viable solution in the link above is that having another local user with the same name then it will fix the problem. Yes, it does fix the problem. But what is the point to have radius server if a local user is required for radius to work?
The point is that you can specify a users password (or OTP) via RADIUS.
If you read the PAM documentation, it says that PAM doesn't supply UID, GID, shell, home directory, etc. PAM only does username / password checking. And some session logging.
Considering that there are thousands of radius clients to hookup with one radius server, having a local user for each of these clients for such user to work does not make sense.
That's what LDAP is for. Put the users into LDAP. Configure NSS && LDAP. That gets you UID, GID, etc. Then do username / password checking via RADIUS.
=============== I am new in the Radius concept. So the users in Radius server cannot be processed as those in LDAP because the users in Radius are not configured with UID/GID, etc? On the other hand, Radius cannot completely take the role of LDAP? So i wonder if PAM is not used for username/ password checking, in that case, Does the UID/GID missing in Radius user matter? In that way, can Radius server replace LDAP? Thanks again for your advice.
My question is very clear. If pam_radius_auth.so is not the one to be fixed, which other pam module should be fixed?
As I said repeatedly, ask the PAM people how their software works. This isn't the "PAM help list". This is the FreeRADIUS list.
At least you can provide a way for us to check which PAM module is failing so that we can check.
No. It's ridiculous to ask that, because I didn't write PAM, and I know nothing about it.
I have even tried to disable ALL the pam module in /etc/pam.d/sshd except pam_radius_auth.so but I cannot even log in the ubuntu if i did that :( So that is the most difficult part to troubleshoot with PAM.
That's terrible.
Why does that happen? I don't know...
ASK THE PAM PEOPLE HOW THEIR SOFTWARE WORKS.
Alan DeKok.
- List info/subscribe/unsubscribe? See https://urldefense.proofpoint.com/v2/url?u=http-3A__www.freeradius.org _&d=DwIGaQ&c=HPMtquzZjKY31rtkyGRFnQ&r=g_pelez0FZ0RjWlxdnat4A&m=1-Ia_Z3 yhNinuX_Gb7sC8yT-ftORLnv1-LvPoNHnY74&s=EiwmZAWothjt5zsUg-XV5CqEk14eGMQ HnYCqLC3_2e4&e= list/users.html
- List info/subscribe/unsubscribe? See https://urldefense.proofpoint.com/v2/url?u=http-3A__www.freeradius.org_list_...
I don't know PAM well but I'll make a suggestion stop trying to use it directly and look at sssd its FAR less likely to cause pain and it documentation and logging is far more sane. It might help you stop wasting peoples time asking about software that’s 'using' RADIUS and not actually RADIUS itself. In either case normal refrain, read the documentation provided by the people who wrote the thing you are using (hint that’s not freeradius) and ask them questions if required (again hint not here freeradius != pam). Alister. On 27/06/2018, 14:29, "Freeradius-Users on behalf of Yu Wang" <freeradius-users-bounces+alister.winfield=sky.uk@lists.freeradius.org on behalf of ywang10@fsu.edu> wrote: This email is from an external source. Please do not open attachments or click links from an unknown origin. Suspicious messages can be reported by sending them as an attachment to phishing@sky.uk -------------------------------------------------------------------- ________________________________ Please see my other post. The pam module in question is pam_unix.so. Yu -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+ywang10=fsu.edu@lists.freeradius.org] On Behalf Of Hailun Tan Sent: Monday, June 25, 2018 10:57 PM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: On Tue, Jun 26, 2018 at 11:24 AM, Alan DeKok <aland@deployingradius.com> wrote: > On Jun 25, 2018, at 9:09 PM, Hailun Tan <dearambermini@gmail.com> wrote: > > I do not think the answer in the previous link was clear. > > It doesn't explain *why* PAM works the way it does. But it explains > what's happening, and how to fix it. > > PAM problems? Ask the PAM people > > > The only viable solution in the link above is that having another > > local user with the same name then it will fix the problem. Yes, it > > does fix > the > > problem. But what is the point to have radius server if a local > > user is required for radius to work? > > The point is that you can specify a users password (or OTP) via RADIUS. > > If you read the PAM documentation, it says that PAM doesn't supply > UID, GID, shell, home directory, etc. PAM only does username / > password checking. And some session logging. > > > Considering that there are thousands of radius clients to hookup > > with one radius server, having a local user for each of these > > clients for such user to work does not make sense. > > That's what LDAP is for. Put the users into LDAP. Configure NSS && > LDAP. That gets you UID, GID, etc. Then do username / password > checking via RADIUS. > =============== I am new in the Radius concept. So the users in Radius server cannot be processed as those in LDAP because the users in Radius are not configured with UID/GID, etc? On the other hand, Radius cannot completely take the role of LDAP? So i wonder if PAM is not used for username/ password checking, in that case, Does the UID/GID missing in Radius user matter? In that way, can Radius server replace LDAP? Thanks again for your advice. > > > My question is very clear. If pam_radius_auth.so is not the one to > > be fixed, which other pam module should be fixed? > > As I said repeatedly, ask the PAM people how their software works. > This isn't the "PAM help list". This is the FreeRADIUS list. > > > At least you can provide a > > way for us to check which PAM module is failing so that we can check. > > No. It's ridiculous to ask that, because I didn't write PAM, and I > know nothing about it. > > > I > > have even tried to disable ALL the pam module in /etc/pam.d/sshd > > except pam_radius_auth.so but I cannot even log in the ubuntu if i > > did that :( > So > > that is the most difficult part to troubleshoot with PAM. > > That's terrible. > > Why does that happen? I don't know... > > ASK THE PAM PEOPLE HOW THEIR SOFTWARE WORKS. > > Alan DeKok. > > > - > List info/subscribe/unsubscribe? See > https://urldefense.proofpoint.com/v2/url?u=http-3A__www.freeradius.org > _&d=DwIGaQ&c=HPMtquzZjKY31rtkyGRFnQ&r=g_pelez0FZ0RjWlxdnat4A&m=1-Ia_Z3 > yhNinuX_Gb7sC8yT-ftORLnv1-LvPoNHnY74&s=EiwmZAWothjt5zsUg-XV5CqEk14eGMQ > HnYCqLC3_2e4&e= > list/users.html > - List info/subscribe/unsubscribe? See https://urldefense.proofpoint.com/v2/url?u=http-3A__www.freeradius.org_list_... - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Information in this email including any attachments may be privileged, confidential and is intended exclusively for the addressee. The views expressed may not be official policy, but the personal views of the originator. If you have received it in error, please notify the sender by return e-mail and delete it from your system. You should not reproduce, distribute, store, retransmit, use or disclose its contents to anyone. Please note we reserve the right to monitor all e-mail communication through our internal and external networks. SKY and the SKY marks are trademarks of Sky plc and Sky International AG and are used under licence. Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Registration No. 2067075) and Sky Subscribers Services Limited (Registration No. 2340150) are direct or indirect subsidiaries of Sky plc (Registration No. 2247735). All of the companies mentioned in this paragraph are incorporated in England and Wales and share the same registered office at Grant Way, Isleworth, Middlesex TW7 5QD.
Another point I would like to bring forth is that pam_radius_auth.so is also one of the pam modules ( it implements thoese pam_sm_*(...) APIs) . You might be right that another pam module is failing to cause the issue but such pam modules conflicts would have been an issue when you were testing pam-radius_auth.so? In this way, you might know which pam module is the culprit? I commented all the pam modules in /etc/pam.d/sshd except pam_radius_auth.so, restart ssh service, but the password passed to radius server is still a mess... So should I comment more pam modules in common-auth or common-password? Please advise. On Tue, Jun 26, 2018 at 10:51 AM, Alan DeKok <aland@deployingradius.com> wrote:
On Jun 25, 2018, at 8:10 PM, Hailun Tan <dearambermini@gmail.com> wrote:
I think my problem is related to the following thread a couple of years
ago:
failed-problem-use-freeradius-amp-pam-radius-td5687733.html
However, in the link above, no one has ever mentioned how to configurate PAM to read the password from the conversation function correctly?
You don't.
The problem is that ANOTHER PAM module is failing. So the PAM libraries are mangling the password.
There is NOTHING you can do to FreeRADIUS or pam_radius_auth to fix the problem.
You MUST modify the PAM configuration on the client machine to remove the problem PAM module.
The replies kept saying modifying PAM modules instead of pam_radius_auth.so. But to be honest, the pam_radius_auth.c is one of the customized PAM modules. If pam_radius_auth.so is not the one to be modified, which one should be? No one has ever given any answers to that...
The answers in the link you posted are pretty clear.
I hate asking the same question repeatedly. However, unless a viable solution is given, these question will keep popping back to the mail list. So for those free radius gurus, please advise how to fix it even though it might not directly be related to free radius.
Fix the PAM configuration on the client. The link you posted says this.
How to fix it? I don't know... go ask the PAM people how their software works.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
On Jun 25, 2018, at 9:30 PM, Hailun Tan <dearambermini@gmail.com> wrote:
Another point I would like to bring forth is that pam_radius_auth.so is also one of the pam modules ( it implements thoese pam_sm_*(...) APIs) . You might be right that another pam module is failing to cause the issue but such pam modules conflicts would have been an issue when you were testing pam-radius_auth.so?
No.
In this way, you might know which pam module is the culprit?
No.
I commented all the pam modules in /etc/pam.d/sshd except pam_radius_auth.so, restart ssh service, but the password passed to radius server is still a mess... So should I comment more pam modules in common-auth or common-password?
Please advise.
I did. Now follow instructions, and go ask questions somewhere else. You seem dead-set on either ignoring all of my advice. That's rude, and will not be accepted. Stop it now. Alan DeKok.
participants (5)
-
Alan Buxey -
Alan DeKok -
Hailun Tan -
Winfield, Alister -
Yu Wang