1

I have set up radius authentication on my machine (as a client - untested yet).

The pam radius conf file has the shared secret etc. The radius authentication can potentially authenticate every single user in the organization (I do not control the authentication server) - 10000 users or so.

I have additionally set up pam_listfile.so using the sense of allow with item as group.

What I am trying to accomplish is the following:

  1. Have one local admin user (in group admin and in /etc/passwd).
  2. Have additional users who are not in /etc/passwd but are authenticated against radius (I have set up pam_mkhomedir.so for them so that they can get sensible home directories on first login). This is the whitelist that I want to allow access to the machine.
  3. These additional users are members of some locally defined groups (see below - group1, group2, etc.).
  4. All users who are not members of these groups should be denied authentication.

I have one local user (see 1 above) in /etc/passwd. That user is in the group called admin, which is one of the groups in the sshd.allow file. That contains:

group1

group2

group3

admin

All these groups are defined in /etc/group with certain members.

When I try to authenticate with another user (who is not in /etc/passwd, but is a member of group1, I find that the authentication fails. I have tail'ed auth.log, and it seems to indicate that my machine does not even attempt to authenticate this user against the radius server.

I started with a vanilla Debian setup, and have added just lines corresponding to to pam_radius, pam_listfile and pam_mkhomedir. I have not touched anything else.

So, it is possible that some default setting in the pam configuration is messing up things (a misplaced auth required directive that presumes local /etc/passwd based authentication perhaps?). Or at least that is my guess. The auth.log refers to the supplied username (even before I enter the password over ssh) as an invalid user.

My question is - is it feasible to do what I am trying to do (see above)? If so, I will post configuration details to get your help in debugging this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.