libpam-radius-auth should work exactly as you need. I use it in this capacity with no problems. You just need to
- Configure it in
/etc/pam.d somewhere, probably
- Configure the RADIUS server in
However, they can't authenticate if they aren't local users.
Yes, that's true. Users must exist in the first place.
It sounds like you are dealing with a different problem than authentication here. Keep in mind the difference between these two subsystems:
- NSS (name service switch): implements the database of users (and groups, and hosts, etc...). This supports queries to list users and get their properties such as name, uid, home directory, and shell. The most common NSS backend is "files", which gets user information from
/etc/passwd, but you can use many other backends that get information from DB files, from LDAP, and so on.
- PAM (pluggable authentication modules): implements authentication (and accounting and password changes). This system uses pluggable modules which check a user's authentication and allow or disallow logins. The most common PAM backend is "files", which asks the user for a simple password and checks it against a hash in
/etc/shadow but you can use many other backends that query services like RADIUS, one time password systems, Kerberos, and so on.
It sounds like you are doing authentication (PAM) with RADIUS but you would also like to use something network-based for the user database (NSS) itself. That's a completely different question, not related to authentication.
You can't use RADIUS as a database backend because the RADIUS protocol does not provide database functionality. That is, it doesn't allow you to query users for details like uid, home directory, and shell, much less to enumerate users in the database. Hence there does not exist a RADIUS NSS backend (hypothetical
For a network-based database of users, you can use LDAP, or maybe MySQL or Postgres. LDAP is probably the best recomendation.