I have setup PAM to allow radius authentication to a 2fa radius server. As per my configuration, I am the Radius authentication is working, but what we need to achieve is to exempt a user / group (example root) from authenticating from the radius server, and authenticat locally. Basically, the above can be summarized as below:
- Enabled 2FA using Radius on ubuntu for all user. For the users challenged by 2FA, no
- Some user, such as root should be exempted from Radius and go to local only How can this be achieved?
My /etc/pam.d/sshd contains the following
#@include common-auth auth sufficient /lib/security/pam_radius_auth.so conf=/etc/raddb/server/pam_radius_auth.conf
The etc/raddb/server/pam_radius_auth.conf contains the correct config for the server.