multiple instances of pam module

[Lars Hillebrand]

Hello everybody,

Is there a way to include multiple instances of the pam module in the radius?
We are currently using a freeradius 2.2.8 with several virtual servers.
Two services are to be secured by a 2-factor authentication (Google Authenticator).
1. Login VMware HorizonView (desktop-virtualization)
2. IPsec VPN connection

VMware Horizon expects a login with username and passcode with a subsequent query of the password.
For the login of the VPN connection the password + passcode is expected together in a field.

Attempts to integrate several instances (similar to the file or ldap module) within the pam module do not work.
I am thankful for every hint.
Thanks in advance.

Best regards
Lars Hillebrand



 - Content of /etc/freeradius/modules/pam

pam {
        pam_auth = radiusd
}
pam 2facaut_pam {
        pam_auth = 2facaut_pam
}
pam horizon_pam {
        pam_auth = horizon_pam
}


- Contents of the individual pam files from /etc/pam.d/

# /etc/pam.d/horizon_pam - PAM configuration for FreeRADIUS
auth requisite pam_google_authenticator.so forward_pass try_first_pass
auth    [success=2 default=ignore]      pam_unix.so nullok_secure
auth    [success=1 default=ignore]      pam_ldap.so use_first_pass

# /etc/pam.d/2facaut_pam - PAM configuration for FreeRADIUS
auth required pam_google_authenticator.so forward_pass
auth required  pam_ldap.so use_first_pass

- Here the debug log with separate horizon_pam configuration in the radius

Tue Apr 18 12:08:41 2017 : Debug: server horizon {
Tue Apr 18 12:08:41 2017 : Debug: # Executing section authorize from file /etc/freeradius/sites-enabled/horizon
Tue Apr 18 12:08:41 2017 : Debug: +group authorize {
Tue Apr 18 12:08:41 2017 : Debug: ++policy filter_username {
Tue Apr 18 12:08:41 2017 : Debug: +++? if (User-Name =~ / /)
Tue Apr 18 12:08:41 2017 : Debug: ? Evaluating (User-Name =~ / /) -> FALSE
Tue Apr 18 12:08:41 2017 : Debug: +++? if (User-Name =~ / /) -> FALSE
Tue Apr 18 12:08:41 2017 : Debug: +++? if (User-Name =~ /@.*@/ )
Tue Apr 18 12:08:41 2017 : Debug: ? Evaluating (User-Name =~ /@.*@/) -> FALSE
Tue Apr 18 12:08:41 2017 : Debug: +++? if (User-Name =~ /@.*@/ ) -> FALSE
Tue Apr 18 12:08:41 2017 : Debug: +++? if (User-Name =~ /\\.\\./ )
Tue Apr 18 12:08:41 2017 : Debug: ? Evaluating (User-Name =~ /\\.\\./) -> FALSE
Tue Apr 18 12:08:41 2017 : Debug: +++? if (User-Name =~ /\\.\\./ ) -> FALSE
Tue Apr 18 12:08:41 2017 : Debug: +++? if (User-Name =~ /\\.$/)
Tue Apr 18 12:08:41 2017 : Debug: ? Evaluating (User-Name =~ /\\.$/) -> FALSE
Tue Apr 18 12:08:41 2017 : Debug: +++? if (User-Name =~ /\\.$/) -> FALSE
Tue Apr 18 12:08:41 2017 : Debug: +++? if (User-Name =~ /@\\./)
Tue Apr 18 12:08:41 2017 : Debug: ? Evaluating (User-Name =~ /@\\./) -> FALSE
Tue Apr 18 12:08:41 2017 : Debug: +++? if (User-Name =~ /@\\./) -> FALSE
Tue Apr 18 12:08:41 2017 : Debug: ++} # policy filter_username = notfound
Tue Apr 18 12:08:41 2017 : Debug: ++[preprocess] = ok
Tue Apr 18 12:08:41 2017 : Debug: [horizon_log]         expand: /var/log/freeradius/radacct/horizon-auth-detail-%Y%m%d -> /var/log/freeradius/radacct/horizon-auth-detail-20170418
Tue Apr 18 12:08:41 2017 : Debug: [horizon_log] /var/log/freeradius/radacct/horizon-auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/horizon-auth-detail-20170418
Tue Apr 18 12:08:41 2017 : Debug: [horizon_log]         expand: %t -> Tue Apr 18 12:08:41 2017
Tue Apr 18 12:08:41 2017 : Debug: ++[horizon_log] = ok
Tue Apr 18 12:08:41 2017 : Debug: ++[chap] = noop
Tue Apr 18 12:08:41 2017 : Debug: ++[mschap] = noop
Tue Apr 18 12:08:41 2017 : Debug: [suffix] No '@' in User-Name = "lahil001", looking up realm NULL
Tue Apr 18 12:08:41 2017 : Debug: [suffix] Found realm "NULL"
Tue Apr 18 12:08:41 2017 : Debug: [suffix] Adding Stripped-User-Name = "lahil001"
Tue Apr 18 12:08:41 2017 : Debug: [suffix] Adding Realm = "NULL"
Tue Apr 18 12:08:41 2017 : Debug: [suffix] Authentication realm is LOCAL.
Tue Apr 18 12:08:41 2017 : Debug: ++[suffix] = ok
Tue Apr 18 12:08:41 2017 : Debug: [eap] No EAP-Message, not doing EAP
Tue Apr 18 12:08:41 2017 : Debug: ++[eap] = noop
Tue Apr 18 12:08:41 2017 : Debug: [horizon_files] users: Matched entry DEFAULT at line 190
Tue Apr 18 12:08:41 2017 : Debug: ++[horizon_files] = ok
Tue Apr 18 12:08:41 2017 : Debug: ++[expiration] = noop
Tue Apr 18 12:08:41 2017 : Debug: ++[logintime] = noop
Tue Apr 18 12:08:41 2017 : Debug: [pap] WARNING! No "known good" password found for the user.  Authentication may fail because of this.
Tue Apr 18 12:08:41 2017 : Debug: ++[pap] = noop
Tue Apr 18 12:08:41 2017 : Debug: +} # group authorize = ok
Tue Apr 18 12:08:41 2017 : Debug: Found Auth-Type = PAM
Tue Apr 18 12:08:41 2017 : Debug:   WARNING: Unknown value specified for Auth-Type.  Cannot perform requested action.
Tue Apr 18 12:08:41 2017 : Debug: # Executing group from file /etc/freeradius/sites-enabled/horizon
Tue Apr 18 12:08:41 2017 : Debug: Failed to authenticate the user.
Tue Apr 18 12:08:41 2017 : Debug: } # server horizon

__

Fachhochschule Dortmund
University of Applied Sciences and Arts

Dipl.-Ing. (FH) Lars Hillebrand
Dez. VI, IT-Basisdienste
Sonnenstraße 100 - 44139 Dortmund
Raum SON D 008
Tel     0231 9112-253
Fax     0231 9112-338
lars.hillebrand at fh-dortmund.de <mailto:lars.hillebrand at fh-dortmund.de>
www.fh-dortmund.de <http://www.fh-dortmund.de/>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4932 bytes
Desc: not available
URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20170418/6fcb86bb/attachment.bin>