pam_radius_auth

[Dan White]

Megan wrote:
> Good Day,
>
> I am making an attempt to setup sudo authentication on a Centos 5.2
> server to work with pam_radius_auth.  I rwant ldap to handle my
> regular users (this works already) and I want my privileged users to
> authenticate through radius when they use sudo.  I put the below in
> /etc/pam.d/sudo and it seems to work fine, except that I need an entry
> in /etc/shadow for any user who sudos.    If i remove the user from
> /etc/shadow then I get a loop back to the radius authentication.  If I
> remove the pam_unix.so entry for auth then I also get a loop back
> asking for a password when the radius server Accepted it.  Any ideas?
>
>
> /etc/pam.d/sudo
> auth        required      pam_env.so
> auth        required   /lib/security/pam_radius_auth.so
> auth        sufficient    pam_unix.so nullok try_first_pass
> auth        requisite     pam_succeed_if.so uid >= 500 quiet
> auth        required      pam_deny.so
>
> account     required      pam_unix.so broken_shadow
> account     sufficient    pam_succeed_if.so uid < 500 quiet
> account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
> account     required      pam_permit.so
>
> password    requisite     pam_cracklib.so try_first_pass retry=3
> password    sufficient    pam_unix.so md5 shadow nullok try_first_pass
> use_authtok
> password    required      pam_deny.so
>
> session     optional      pam_keyinit.so revoke
> session     required      pam_limits.so
> session     [success=1 default=ignore] pam_succeed_if.so service in
> crond quiet use_uid
> session     required      pam_unix.so
> session     optional      pam_ldap.so
> session     required      pam_mkhomedir.so skel=/etc/skel/ umask=0077
>   

Hi Megan,

I have a similar set up, except that instead of using pam_ldap, I'm 
using pam_unix to authentication users by making use of libnss-ldapd.

My /etc/nsswitch.conf file looks like:

passwd:         compat ldap
group:          compat ldap
shadow:         compat ldap
...

And my LDAP entries contain objectClass: shadowAccount, and all the 
attributes that class requires.

- Dan