I have setup PAM to allow radius authentication to a 2fa radius server. As per my configuration, I am the Radius authentication is working, but what we need to achieve is to exempt a user / group (example root) from authenticating from the radius server, and authenticat locally. Basically, the above can be summarized as below:

  1. Enabled 2FA using Radius on ubuntu for all user. For the users challenged by 2FA, no
  2. Some user, such as root should be exempted from Radius and go to local only How can this be achieved?

My /etc/pam.d/sshd contains the following

#@include common-auth
auth    sufficient  /lib/security/pam_radius_auth.so    conf=/etc/raddb/server/pam_radius_auth.conf

The etc/raddb/server/pam_radius_auth.conf contains the correct config for the server.

  • No replies? Is the question not clear or something? – Misbah Bin Mashkoor Dec 24 '16 at 13:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.