Hi,

I'm trying to configure IPv6 radius servers in the pam_radius_auth.conf file and am having issues. I was previously using IPv4 servers and it was working well. I followed the comment guidelines in the conf file to add in the new IPv6 servers, but when I go to test radius authentication using ssh, it fails.

When reviewing the log file "/var/log/auth.log", I see that the pam_radius_auth process fails to process the IPv6 address and does a check on "[2001", instead of the full IPv6 address I added:
Oct 15 20:36:27 SERVER sshd[3761091]: pam_radius_auth: Failed looking up IP address for RADIUS server [2001 (errcode=9)
Oct 15 20:36:27 SERVER sshd[3761091]: pam_radius_auth: Failed looking up IP address for RADIUS server [2001 (errcode=9)
Oct 15 20:36:27 SERVER sshd[3761091]: pam_radius_auth: All RADIUS servers failed to respond.

Configuration used in "pam_radius_auth.conf" (tried using no brackets and no specific port, but issue is the same):
[2001:100:100:100::1]:1812 secret 5
[2001:100:100:101::2]:1812 secret 5

I also updated the "libpam-radius-auth" library to latest version 1.4.0-3, but does not help with the issue:
user:~$ sudo apt upgrade libpam-radius-auth
Reading package lists... Done
Building dependency tree
Reading state information... Done
libpam-radius-auth is already the newest version (1.4.0-3).
Calculating upgrade... Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

Is IPv6 compatible for the radius server list? Wanted to check if this is a known issue or if there is something else that is wrong.

Thanks,

Many network utilities (ping, ssh, traceroute, etc) will take an interface name to signify the source address, and then query the interface for its list of addresses and use the first of the appropriate address family.

This is handy when you want to source packets from an interface with a dynamic address (such as an IPsec/GRE tunnel or a DHCP'd subnet) but don't want to be editing the configuration file on-the-fly.

Hi Contributors

I got some problem with Pam_Radius_auth,

I configured, Server(pam_radius_auth) -> Microsoft NPS (With Azure MFA Extension)

Auth flow

Try to login pam_radius_auth sent request code 1-> MS NPS received request -> send to Azure MFA -> MS Authenticator Push -> MS NPS Radius -> Response code 2 -> pam_radius_auth Auth Success,

when user clicked MS Authenticator Push with out delay it works perfect

but when, MS Authenticator Push clicked Permit with few delays (about 3~5s ) & auth failed & retry Auth request (on pam_radius.conf timeout parameter 20)
---------- Logs --------------
Apr 14 00:05:41 prd-was sshd[537431]: pam_radius_auth: Got user name twyoun
Apr 14 00:05:41 prd-was sshd[537431]: pam_radius_auth: ignore last_pass, force_prompt set
Apr 14 00:05:44 prd-was sshd[537431]: pam_radius_auth: Sending RADIUS request code 1
Apr 14 00:05:44 prd-was sshd[537431]: pam_radius_auth: DEBUG: get_ipaddr(...) returned 0.
Apr 14 00:06:04 prd-was sshd[537431]: pam_radius_auth: RADIUS server (...) failed to respond
Apr 14 00:06:24 prd-was sshd[537431]: pam_radius_auth: RADIUS server (...***) failed to respond
Apr 14 00:06:27 prd-was sshd[537431]: pam_radius_auth: Got RADIUS response code 2
Apr 14 00:06:27 prd-was sshd[537431]: pam_radius_auth: authentication succeeded

Sorry For My Bad English. I want to build system authentication based on radius server in my linux PC. I installed libpam-radius-auth_1.3.16.-5_amd64.deb. If my radius server not accessible, then used local authentication. If my radius server accessible, then used only radius server (local authentication is deny). And it's my problem. I found next scrip, but option 'localifdown' in pam_radius_auth.so unregognezed. But this option does what i need, and used in other scripts in Internet.
Can you help me?

This is my settings pam for ssh
root@home:~# more /etc/pam.d/sshd
auth required pam_env.so # [1]
auth required pam_env.so envfile=/etc/default/locale
auth [success=done default=bad authinfo_unavail=bad ignore=ignore] pam_radius_auth.so localifdown
@include common-auth

This is log after authentication
root@home:~# more /var/log/auth.log
Mar 19 17:23:32 home sshd[7350]: pam_radius_auth: unrecognized option 'localifdown'
Mar 19 17:23:32 home sshd[7350]: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned 1425368320.
Mar 19 17:23:32 home sshd[7350]: Accepted password for bob from 192.168.200.4 port 58510 ssh2

packages installed
root@home:~# dpkg -l | grep pam
ii libpam-modules:amd64 1.1.8-3.1+deb8u2+b1 amd64 Pluggable Authentication Modules for PAM
ii libpam-modules-bin 1.1.8-3.1+deb8u2+b1 amd64 Pluggable Authentication Modules for PAM - helper binaries
ii libpam-radius-auth 1.3.16-5 amd64 The PAM RADIUS authentication module
ii libpam-runtime 1.1.8-3.1+deb8u2 all Runtime support for the PAM library
ii libpam-script 1.1.5-1 amd64 PAM module which allows executing a script
ii libpam0g:amd64 1.1.8-3.1+deb8u2+b1 amd64 Pluggable Authentication Modules library
iU libpam0g-dev:amd64 1.1.8-3.1+deb8u2+b1 amd64 Development files for PAM

OS information
root@home:~ # uname -a
Linux sterragate 3.2.0-4-amd64 SMP Debian 3.2.81-2 x86_64 GNU/Linux
root@ home:~# lsb_release -a
No LSB modules are available.
Distributor ID: Debian
Description: Debian GNU/Linux 7.11 (wheezy)
Release: 7.11
Codename: wheezy

The plain text shared_secret is recorded in /etc/raddb/server of the pam_radius client. I am worried about the security of the plain text shared key, Although I have strengthened the file permissions. So is there any other more secure way to connect? Thank you!

The USAGE file says:

retry = #      - allow a number of retries before continuing to the next
                 authentication module

but this is not entirely true.
Even with retry=1 I can endlessly keep trying to authenticate against our radius server.

is there a way to use the same functionality as freebsd's pam_radius' "template_user"?
the template_user option allows a user to authenticate as a "generic" user with a predefined template using radius on systems where they don't have a local account.

Hi,

I'm using Freeradius to provide a one-time-password verification service to a group of servers. My servers are accessible through ssh keys (without interacting with Freeradius), but if someone attempts an interactive password login, he first needs to provide a valid OTP (which is checked by the remote Freeradius server through pam_radius_auth), followed by the system (shadow) password. This works great, with a small issue: both the pam_radius_auth password prompt and shadow prompt are "Password:", which makes people forget that they're supposed to provide a OTP.

Might it be possible to add an option to pam_radius_auth that configures the password prompt? I could then set that to "Radius OTP:".

Thanks!

When the configuration file (/etc/pam_radius_auth.conf) file is empty, looks like there is a double free and that causes an abort.
Here is the error message:

free(): double free detected in tcache 2
Aborted (core dumped)

I have faced this issue in both a real scenario and when testing using pamtester.

Hi,

I am using pam_radius to authenticate 2FA codes against NPS with Azure MFA extension.
It works great, but two things could be better:

1 - The text I get back from Azure is "Enter your Microsoft validation code", with no space between the text and the code the user types (eg. "Enter your Microsoft validation code123456". It would therefore be nice to replace this text with something else and/or add a colon and/or a CR.
2 - In case of push notifications, no prompt is displayed, which is not so nice for the user. Could we get an option to display a prompt when an Access-request is sent? Or is there a more elegant way to deal with this?
3 - Could we get an option to display the "Reply-message"?

Best,
Francis

centos7 yum install dante1.4.2
vim /etc/pam.d/sockd
account sufficient /lib64/security/pam_radius_auth.so
auth sufficient /lib64/security/pam_radius_auth.so

vim /etc/raddb/server
#Server Secret Timeout
192.168.1.2 testing123 60

table nas
id nasname shortname type ports secret server community description
1 0.0.0.0/0 sockd other 1812 testing123 RADIUS Client

table radcheck
id username attribute op value
2 mimi1 Cleartext-Password := 1234567

table radpostauth
id username pass reply authdate
11896 mimi1 1234567 Access-Accept 2019-10-01 21:42:05

table radacct
radacctid acctsessionid acctuniqueid username groupname realm nasipaddress nasportid nasporttype acctstarttime acctstoptime acctsessiontime acctauthentic connectinfo_start connectinfo_stop acctinputoctets acctoutputoctets calledstationid callingstationid acctterminatecause servicetype framedprotocol framedipaddress acctstartdelay acctstopdelay xascendsessionsvrkey

I hope radacct has data, How should I configure sockd or freeradius? Or is there any other better way?

We are using pam_radius 1.4 with CISCO ACS 5.8 and see an intermediate issue of the talk_radius function causing JVM crash. Following is the stack trace from core dump --

#0 0x00007f57cf7b85e5 in raise () from /lib64/libc.so.6
#1 0x00007f57cf7b9dc5 in abort () from /lib64/libc.so.6
#2 0x00007f57cf7f64f7 in __libc_message () from /lib64/libc.so.6
#3 0x00007f57cf8886d7 in __fortify_fail () from /lib64/libc.so.6
#4 0x00007f57cf8886a0 in __stack_chk_fail () from /lib64/libc.so.6
#5 0x00007f536e8d3f66 in talk_radius (conf=Unhandled dwarf expression opcode 0xf3
) at src/pam_radius_auth.c:1015
#6 0x00007f536e8d46dc in pam_sm_authenticate (pamh=0x7f56a0000000, flags=Unhandled dwarf expression opcode 0xf3
) at src/pam_radius_auth.c:1190
#7 0x00007f5374c89cee in ?? () from /lib64/libpam.so.0.82.2
#8 0x00007f5374c89600 in pam_authenticate () from /lib64/libpam.so.0.82.2

We are suspecting stack corruption in talk_radius().

The current master build does not work on Solaris 10.

Seems to have occurred with the add IPv6 support commit de3a47e However with that commit you dont get the extra failure messages.

When I compile with commit a581c21 all is fine.

Here is a log of failure messages from Solaris 10 sparc. Let me know what other tests I can run to help troubleshoot the issue.

Aug 9 13:48:34 unix-test-zone-8.vwoa.na.vwg sshd[10901]: [ID 801593 auth.debug] pam_radius_auth: Got user name rogerst
Aug 9 13:48:34 unix-test-zone-8.vwoa.na.vwg sshd[10901]: [ID 801593 auth.debug] pam_radius_auth: ignore last_pass, force_prompt set
Aug 9 13:48:47 unix-test-zone-8.vwoa.na.vwg sshd[10901]: [ID 801593 auth.debug] pam_radius_auth: Sending RADIUS request code 1
Aug 9 13:48:47 unix-test-zone-8.vwoa.na.vwg sshd[10901]: [ID 801593 auth.debug] pam_radius_auth: DEBUG: get_ipaddr(10.136.115.232) returned 0.
Aug 9 13:48:47 unix-test-zone-8.vwoa.na.vwg sshd[10901]: [ID 801593 auth.error] pam_radius_auth: Error sending RADIUS packet to server 10.136.115.232:1812: Invalid argument
Aug 9 13:48:47 unix-test-zone-8.vwoa.na.vwg sshd[10901]: [ID 801593 auth.debug] pam_radius_auth: DEBUG: get_ipaddr(10.136.115.233) returned 0.
Aug 9 13:48:47 unix-test-zone-8.vwoa.na.vwg sshd[10901]: [ID 801593 auth.error] pam_radius_auth: Error sending RADIUS packet to server 10.136.115.233:1812: Invalid argument
Aug 9 13:48:47 unix-test-zone-8.vwoa.na.vwg sshd[10901]: [ID 801593 auth.debug] pam_radius_auth: DEBUG: get_ipaddr(10.137.107.20) returned 0.
Aug 9 13:48:47 unix-test-zone-8.vwoa.na.vwg sshd[10901]: [ID 801593 auth.error] pam_radius_auth: Error sending RADIUS packet to server 10.137.107.20:1812: Invalid argument
Aug 9 13:48:47 unix-test-zone-8.vwoa.na.vwg sshd[10901]: [ID 801593 auth.error] pam_radius_auth: All RADIUS servers failed to respond.
Aug 9 13:48:47 unix-test-zone-8.vwoa.na.vwg sshd[10901]: [ID 801593 auth.debug] pam_radius_auth: authentication failed
Aug 9 13:48:47 unix-test-zone-8.vwoa.na.vwg sshd[10901]: [ID 800047 auth.info] Keyboard-interactive (PAM) userauth failed[12] while authenticating: Can not retrieve authentication info
Aug 9 13:48:47 unix-test-zone-8.vwoa.na.vwg sshd[10901]: [ID 800047 auth.notice] Failed keyboard-interactive for rogerst from 10.136.102.228 port 38327 ssh2

There is no "Calling-Station-Id" attribute in access-requests sent in response to radius challenge from pam_radius-1.3.17-2.el6.x86_64 (CentOS release 6.5)

Hi,

I'm using freeradius for custom 2-factor OTP authentication as below:
RADIUS_CLIENT > Access-Request(User/Pass) > FreeRADIUS(check user pass and if ok -> generates state) > Access-Challenge > RADIUS_CLIENT> Access-Request(User/OTP/state) > FreeRADIUS

In first Access-Request (before Access-Challenge) RADIUS_CLIENT is sending all required attributes well (including "Calling-Station-Id")
My problem is on the second Access-Request (after Access-Challenge). There is no "Calling-Station-Id" attribute on this state for some reason...
I have checked this on the following radius client: pam_radius-1.3.17-2.el6.x86_64 (CentOS release 6.5)

UPDATE1:
the flow is looks as below:
1st Access-Request:
rad_recv: Access-Request packet from host 192.168.64.11 port 17193, id=5, length=98
User-Name = "username"
User-Password = "some password"
NAS-IP-Address = 192.168.64.11
NAS-Identifier = "sshd"
NAS-Port = 16168
NAS-Port-Type = Virtual
Service-Type = Authenticate-Only
Calling-Station-Id = "192.168.65.20"

Sending Access-Challenge of id 5 to 192.168.64.11 port 17193
Reply-Message = "OTP code: "
State = 0x33643539623066642d333162662d313165342d393939332d353235343030613964313334

2nd Access-Request:
rad_recv: Access-Request packet from host 192.168.64.11 port 17193, id=6, length=108
User-Name = "username"
User-Password = "736396"
NAS-IP-Address = 192.168.64.11
NAS-Identifier = "sshd"
NAS-Port = 16168
NAS-Port-Type = Virtual
State = 0x33643539623066642d333162662d313165342d393939332d353235343030613964313334

What I do expect is presence of 'Calling-Station-Id = "192.168.65.20"' in 2nd Access-Request packet as well as it present in 1st Access-Request packet.

Thanks a lot,
Dmitry!

Hi All,

I recently took over the pam_radius RPM for EPEL and was reviewing the releases. I noticed in looking at release_1_4_0...master that there is a 1.4.1 release mentioned.

Would it be possible to get a 1.4.1 release, it makes it easier for packaging if it would be too much hassle on your end.

Thanks in advance!

JT

Seems to me that they're useless but very chatty in their current form.

I'm wondering if you'd consider patching it to:

1. delete the 3 getservbyname DPRINTs
2. make them silent unless getservbyname fails

I'd also want to change the message - to not print the pointer value (in decimal of all things) but instead announce that the lookup failed when that happens.

Is it possible to add Framed Route attribute?

https://github.com/FreeRADIUS/pam_radius/blob/master/src/pam_radius_auth.c#L515
_pam_drop(server); followed by access to server causes NULL pointer deference as _pam_drop will set the pointer to null: #define _pam_drop(X) if (X) {free(X);X = NULL;}

Is there a way to enable MSChap for this Pam Module ?
I have radtest working with my FreeRADIUS Version 3.0.21 Server when requesting mschap
But when using the pam_radius module i cant seem to enable mschap, it always tries pap.
Thanks

Hello!
The problem is that on server side I have attribute cisco-avpair="shell:priv_lvl"
So the server put this information into VendorSpecific fiels in packet
How can I get this attribute? I looked on code and I didn't find place where you are parsing it? How can I get this data with this module?

We have a customer who claim that sending attribute Authenticate_Only make their
Radius server(Steel Belted Radius) skip sending back any attributes at all and the
code has this comment too:
/* not all servers understand this service type, but some do */
add_int_attribute(request, PW_USER_SERVICE_TYPE, PW_AUTHENTICATE_ONLY);

Should PW_AUTHENTICATE_ONLY really be used here?
If removed, could other Radius servers out there start to malfunction?

If skip_passwd'is set pam_radius_auth sends a mangled password in the initial query (the one where it does not prompt the user for one). I expected an empty one, based on the documentation.

FreeRADIUS 2.2.8 (Ubuntu package: 2.2.8+dfsg-0.1build2 on x86_64-pc-linux-gnu), Ubuntu 16.04, Linux 4.4.0.
pam_radius_auth 1.4.0 compiled from the tarball at http://freeradius.org/pam_radius_auth/

Test run:

# echo -en 'client localhost {\n ipaddr = 127.0.01\n secret = xxx\n nastype = other\n}\n' > clients.conf
# echo "127.0.0.1  xxx  3" > /etc/pam_radius_auth.conf
# echo "auth required pam_radius_auth-1.4.0.so debug skip_passwd conf=/etc/pam_radius_auth.conf" > /etc/pam.d/sshd
# freeradius -X
[...]
Ready to process requests.
rad_recv: Access-Request packet from host 127.0.0.1 port 47890, id=61, length=89
	User-Name = "testuser"
	User-Password = "V@\010\351+-\277s&\346\n\2369﫴"
	NAS-IP-Address = 127.0.1.1
	NAS-Identifier = "sshd"
	NAS-Port = 10942
	NAS-Port-Type = Virtual
	Service-Type = Authenticate-Only
	Calling-Station-Id = "127.0.0.1"

If I remove skip_passwd from the PAM config, the module prompts for the password, and it's sent as expected, empty or not.

# echo "auth required pam_radius_auth-1.4.0.so debug conf=/etc/pam_radius_auth.conf" > /etc/pam.d/sshd
# service ssh restart
# freeradius -X
[...]
Ready to process requests.
rad_recv: Access-Request packet from host 127.0.0.1 port 35777, id=49, length=89
	User-Name = "testuser"
	User-Password = ""
	NAS-IP-Address = 127.0.1.1
	NAS-Identifier = "sshd"
	NAS-Port = 10967
	NAS-Port-Type = Virtual
	Service-Type = Authenticate-Only
	Calling-Station-Id = "127.0.0.1"

Problem with set ip from Microsoft NPS to ocserv vpn user.

First time it

ocserv[25974]: main: Starting 1 instances of ocserv-sm
ocserv[25974]: main: initialized OpenConnect VPN Server 1.2.5
ocserv[25976]: sec-mod: reading supplemental config from files
ocserv[25976]: sec-mod: sec-mod initialized (socket: /var/run/ocserv-socket.40bec52d.0)
ocserv[25976]: sec-mod: sec-mod instance 0 issue cookie
ocserv[25976]: sec-mod: using 'pam' authentication to authenticate user (session: 8rNPYi)
ocserv[25976]: pam_radius_auth: 2.0.1 (git #53c0cfff), built on Nov 2 2021 at 14:37:12
ocserv[25976]: pam_radius_auth: DEBUG: conf='/etc/pam_radius_auth.conf' use_first_pass=no try_first_pass=no skip_passwd=no retry=123 localifdown=no client_id='666' accounting_bug=no ruser=no prompt='Password: ' force_prompt=no prompt_attribute=no max_challenge=0 privilege_level=no
ocserv[25976]: pam_radius_auth: Got user name: 'user'
ocserv[25976]: pam_radius_auth: ignore last_pass, force_prompt set
ocserv[25976]: pam_radius_auth: Sending RADIUS request code 1 (Access-Request)
ocserv[25976]: pam_radius_auth: DEBUG: get_ipaddr(192.168.70.105) returned 0.
ocserv[25976]: pam_radius_auth: Got RADIUS response code 2 (Access-Accept)
ocserv[25976]: pam_radius_auth: Set PAM environment variable : Framed-IP-Address=10.10.1.44 ocserv[25976]: pam_radius_auth: authentication succeeded

But then

ocserv[25974]: main[user]:7.4.201.8:55202 new user session
ocserv[25974]: main[user]:7.4.201.8:55202 user logged in
ocserv[25980]: worker[user]: 7.4.201.8 suggesting DPD of 90 secs
ocserv[25980]: worker[user]: 7.4.201.8 configured link MTU is 1500
ocserv[25980]: worker[user]: 7.4.201.8 peer's link MTU is 1500
ocserv[25980]: worker[user]: 7.4.201.8 sending IPv4 10.10.1.8
ocserv[25980]: worker[user]: 7.4.201.8 adding DNS 10.0.0.1
ocserv[25980]: worker[user]: 7.4.201.8 adding custom header 'X-My-Header: hi there'
ocserv[25980]: worker[user]: 7.4.201.8 Link MTU is 1500 bytes ocserv[25976]: sec-mod: initiating session for user 'user' (session: 8rNPYi)

I was used many other ocserv pam config, but always the same result.

example

#%PAM-1.0
auth [success=1 default=ignore] pam_radius_auth.so conf=/etc/pam_radius_auth.conf debug retry=123
auth requisite pam_deny.so
auth required pam_permit.so
auth required /usr/local/lib/security/pam_linotp.so debug url=https://192.168.0.1/validate/simplecheck nosslhostnameverify nosslcertverify
session [default=1] pam_permit.so
session requisite pam_deny.so
session required pam_permit.so
account required pam_nologin.so
account include password-auth
session include password-auth

How i can handle to proceed Framed-ip-address to user?

We've been using pam_radius for a long time on Ubuntu 18.04 with no problems. Due to 18.04 being EOL we're working on upgrading to 22.04. 22.04 includes pam_radius 2.0.0. Due to CIS benchmarks we have ipv6 disabled on our machines and so originally we hit the issue described here:
FreeRADIUS/freeradius-server#4397

Using the suggestion from @alandekok in FreeRADIUS/freeradius-server#4397 (comment) I pulled down the current master of pam_radius 77da6f5 and built the debian package locally. Now we're getting passed the IPV6 issue but now I'm hitting:
the following error (this happens on a machine with IPV6 enabled or disabled)

Nov 20 18:31:53 ip-10-30-56-22 sshd[7620]: pam_radius_auth: 2.0.1 (git #77da6f50), built on Nov  2 2021 at 14:37:12
Nov 20 18:31:53 ip-10-30-56-22 sshd[7620]: pam_radius_auth: DEBUG: conf='/etc/pam_radius_auth.conf' use_first_pass=no try_first_pass=no skip_passwd=no retry=0 localifdown=no client_id='' accounting_bug=no ruser=no prompt='Password: ' force_prompt=no prompt_attribute=no max_challenge=0 privilege_level=no
Nov 20 18:31:53 ip-10-30-56-22 sshd[7620]: pam_radius_auth: Got user name: 'mike.roest'
Nov 20 18:31:53 ip-10-30-56-22 sshd[7620]: pam_radius_auth: ignore last_pass, force_prompt set
Nov 20 18:31:53 ip-10-30-56-22 sshd[7618]: fatal: PAM: authentication thread exited unexpectedly

On the same machine with IPV6 enabled if I use the ubuntu included 2.0.0 the authentication works as expected:

Nov 20 18:41:41 ip-10-30-56-22 sshd[8025]: pam_radius_auth: unrecognized option 'ipv6=no'
Nov 20 18:41:41 ip-10-30-56-22 sshd[8025]: pam_radius_auth: Got user name mike.roest
Nov 20 18:41:41 ip-10-30-56-22 sshd[8025]: pam_radius_auth: ignore last_pass, force_prompt set
Nov 20 18:41:45 ip-10-30-56-22 sshd[8025]: pam_radius_auth: Sending RADIUS request code 1
Nov 20 18:41:45 ip-10-30-56-22 sshd[8025]: pam_radius_auth: DEBUG: get_ipaddr(10.30.0.237) returned 0.
Nov 20 18:41:45 ip-10-30-56-22 sshd[8025]: pam_radius_auth: Got RADIUS response code 11
Nov 20 18:41:46 ip-10-30-56-22 sshd[8025]: pam_radius_auth: DEBUG: get_ipaddr(10.30.0.237) returned 0.
Nov 20 18:41:46 ip-10-30-56-22 sshd[8025]: pam_radius_auth: Got response to challenge code 11
Nov 20 18:41:49 ip-10-30-56-22 sshd[8025]: pam_radius_auth: DEBUG: get_ipaddr(10.30.0.237) returned 0.
Nov 20 18:41:49 ip-10-30-56-22 sshd[8025]: pam_radius_auth: Got response to challenge code 2
Nov 20 18:41:49 ip-10-30-56-22 sshd[8025]: pam_radius_auth: authentication succeeded
Nov 20 18:41:49 ip-10-30-56-22 sshd[8023]: Accepted keyboard-interactive/pam for mike.roest from 10.190.77.16 port 61022 ssh2
Nov 20 18:41:49 ip-10-30-56-22 sshd[8023]: pam_unix(sshd:session): session opened for user mike.roest(uid=1015) by (uid=0)

Next I've checked out the commit 8d37353 where the support was originally added and again I can successfully authenticate

Nov 20 18:45:42 ip-10-30-56-22 sshd[9778]: pam_radius_auth: 2.0.1 (git #8d373539), built on Nov  2 2021 at 14:37:12
Nov 20 18:45:42 ip-10-30-56-22 sshd[9778]: pam_radius_auth: DEBUG: conf='/etc/pam_radius_auth.conf' use_first_pass=no try_first_pass=no skip_passwd=no retry=0 localifdown=no client_id='' accounting_bug=no ruser=no prompt='Password: ' force_prompt=no prompt_attribute=no max_challenge=0 privilege_level=no
Nov 20 18:45:42 ip-10-30-56-22 sshd[9778]: pam_radius_auth: Got user name: 'mike.roest'
Nov 20 18:45:42 ip-10-30-56-22 sshd[9778]: pam_radius_auth: ignore last_pass, force_prompt set
Nov 20 18:45:46 ip-10-30-56-22 sshd[9778]: pam_radius_auth: Sending RADIUS request code 1 (Access-Request)
Nov 20 18:45:46 ip-10-30-56-22 sshd[9778]: pam_radius_auth: DEBUG: get_ipaddr(10.30.0.237) returned 0.
Nov 20 18:45:46 ip-10-30-56-22 sshd[9778]: pam_radius_auth: Got RADIUS response code 11 (Access-Challenge)
Nov 20 18:45:48 ip-10-30-56-22 sshd[9778]: pam_radius_auth: DEBUG: get_ipaddr(10.30.0.237) returned 0.
Nov 20 18:45:48 ip-10-30-56-22 sshd[9778]: pam_radius_auth: Got response to challenge code 11
Nov 20 18:45:51 ip-10-30-56-22 sshd[9778]: pam_radius_auth: DEBUG: get_ipaddr(10.30.0.237) returned 0.
Nov 20 18:45:51 ip-10-30-56-22 sshd[9778]: pam_radius_auth: Got response to challenge code 2
Nov 20 18:45:51 ip-10-30-56-22 sshd[9778]: pam_radius_auth: authentication succeeded
Nov 20 18:45:51 ip-10-30-56-22 sshd[9776]: Accepted keyboard-interactive/pam for mike.roest from 10.190.77.16 port 61202 ssh2
Nov 20 18:45:51 ip-10-30-56-22 sshd[9776]: pam_unix(sshd:session): session opened for user mike.roest(uid=1015) by (uid=0)

So it seems like somewhere between 8d37353 and 77da6f5 there was a crasher introduced. I'm going to move forward using the module built from 8d37353 but I thought I would report the issue.

Evening good folk

I have some PHP code that I have inherited that is used to authenticate users with radius, I have now setup openVPN and pam_radius to add 2FA to our VPN.

But couldn't get it to work, on further investigation it seems we use the NAS_PORT to identify the type of authentication request. In our very bad code I have had to add the current running PID of openVPN as that is the NSA_PORT that pam_radius sends.

Could the NAS_PORT be added to a config file somewhere please?

Hi,

I am trying to configure this with AuthLogic and Windows NPS. However, they send back Attribute 18 - (Reply-Message) but not 24 -State and this module fails.

On looking at code, it says that State is not required. What can we change to make this work

Description of problem:
I manage multiple DISA STIG'd RHEL 8 system. The default /etc/pam.d/vlock includes system-auth where I have my 'auth sufficient pam_radius_auth.so debug' line that works to allow RADIUS authentication to work when I am on the console or ssh to a server. I normally delete the local users password and only allow RADIUS auth on my RHEL 7 system and want to do the same on RHEL 8. However after I delete the local password and then tmux calls vlock, it will not unlock using RADIUS and will only unlock if I recreate a local password. I don't understand why the include system-auth in the /etc/pam.d/vlock doesn't handle this. I have tried adding the 'auth sufficient pam_radius_auth.so debug' line to the /etc/pam.d/vlock file but that doesn't work either. Is there something I can add to the /etc/pam.d/vlock file that will allow RADIUS authentication to unlock the screen?

Version-Release number of selected component (if applicable):
1.4.0 (pam_radius-1.4.0-15.el8.src.rpm)

How reproducible:
This happens on every RHEL8 server I build

Steps to Reproduce:

1. Build a RHEL8 with DISA STIG security profile applied.
2. Setup RADIUS authentication to an external RADIUS server (Cisco ISE etc.)
3. Remove local password of a user.
4. login at console or ssh to server as that user (using RADIUS Authentication)
5. Wait for tmux to call vlock to lock the screen (900 seconds)
6. try to unlock the screen using with user's RADIUS password (Does NOT work)
7. from another terminal recreate the users locally stored password as root
8. Unlock vlock using the user's locally stored password (Does work)

Actual results:
screen will not ulock using RADIUS password

Expected results:
screen unlock with RADIUS password

Additional info:
I opened a support case with Red Hat and this is all I got from them:
"We also do not support pam_radius, as that is an EPEL package"

Hi we are upgrading our system from RHEL 7 to RHEL 8. I was just wondering if PAM Radius would support RHEL 8 Systems

Hi experts,

I am newbie to radius.

Now I am building a FreeRadius server to authenticate different users.

Below is the topology:

Topology description:
User1/User2/User3 want to login to Linux server via SSH, User1/User2/User3 should be authenticated by FreeRadius server during SSH logining, User1 has already been created at Linux Server before building the central AAA system, its username is already saved to /etc/passwd and its password is already saved to /etc/shadow at Linux Server, it can login to Linux Server success. User2 and User3 is not created at Linux Server.

Now we start a FreeRadius Server with below config:

root@6993e0d8f1dc:/# cat /etc/raddb/clients.conf
client localhost {
	ipaddr = 127.0.0.1
	proto = *
	secret = testing123
	require_message_authenticator = no
	nas_type	 = other	# localhost isn't usually a NAS...
	limit {
		max_connections = 16
		lifetime = 0
		idle_timeout = 30
	}
}

client testnet {
	ipaddr		= 173.39.202.128/25
	secret		= testing123
}

root@6993e0d8f1dc:/# cat /etc/raddb/users
bob	Cleartext-Password := "test123"
	Reply-Message := "Hello, %{User-Name}"

mario	Cleartext-Password := "test123"
	Reply-Message := "Hello, %{User-Name}"

pi	Cleartext-Password := "test123"
	Reply-Message := "Hello, %{User-Name}"

config items not listed here are using default ones.

at Linux server, we pulled pam radius source code from here, version is 77da6f5, built it and installed pam_radius_auth.so, below is the config items:

 pi@raspberrypi:~ $ cat /etc/pam.d/sshd 
# PAM configuration for the Secure Shell service

auth       sufficient   pam_radius_auth.so conf=/etc/pam_radius_auth.conf debug retry=3

# Standard Un*x authentication.
@include common-auth

account    sufficient   pam_radius_auth.so conf=/etc/pam_radius_auth.conf debug retry=3
# Disallow non-root logins when /etc/nologin exists.
account    required     pam_nologin.so

# Uncomment and edit /etc/security/access.conf if you need to set complex
# access limits that are hard to express in sshd_config.
# account  required     pam_access.so

# Standard Un*x authorization.
@include common-account

session    sufficient   pam_radius_auth.so conf=/etc/pam_radius_auth.conf debug retry=3
# SELinux needs to be the first session rule.  This ensures that any
# lingering context has been cleared.  Without this it is possible that a
# module could execute code in the wrong domain.
session [success=ok ignore=ignore module_unknown=ignore default=bad]        pam_selinux.so close

# Set the loginuid process attribute.
session    required     pam_loginuid.so

# Create a new session keyring.
session    optional     pam_keyinit.so force revoke

# Standard Un*x session setup and teardown.
@include common-session

# Print the message of the day upon successful login.
# This includes a dynamically generated part from /run/motd.dynamic
# and a static (admin-editable) part from /etc/motd.
session    optional     pam_motd.so  motd=/run/motd.dynamic
session    optional     pam_motd.so noupdate

# Print the status of the user's mailbox upon successful login.
session    optional     pam_mail.so standard noenv # [1]

# Set up user limits from /etc/security/limits.conf.
session    required     pam_limits.so

# Read environment variables from /etc/environment and
# /etc/security/pam_env.conf.
session    required     pam_env.so # [1]
# In Debian 4.0 (etch), locale-related environment variables were moved to
# /etc/default/locale, so read that as well.
session    required     pam_env.so user_readenv=1 envfile=/etc/default/locale

# SELinux needs to intervene at login time to ensure that the process starts
# in the proper default security context.  Only sessions which are intended
# to run in the user's context should be run after this.
session [success=ok ignore=ignore module_unknown=ignore default=bad]        pam_selinux.so open

# Standard Un*x password updating.
@include common-password
pi@raspberrypi:~ $    
pi@raspberrypi:~ $ cat /etc/pam_radius_auth.conf 
#  /etc/pam_radius_auth.conf configuration file.
#
#  For proper security, this file SHOULD have permissions 0600,
#  that is readable by root, and NO ONE else.  If anyone other than
#  root can read this file, then they can spoof responses from the server!
#
#  There are 5 fields per line in this file.  There may be multiple
#  lines.  Blank lines or lines beginning with '#' are treated as
#  comments, and are ignored.  The fields are:
#
#  server[:port] secret [timeout [source_ip [vrf]]]
#
#  the port name or number is optional.  The default port name is
#  "radius", and is looked up from /etc/services The timeout field is
#  optional.  The default timeout is 3 seconds.
#  The source_ip field is optional and the default is none.
#  The vrf field is optional and the default is none.
#
#  For IPv6 literal addresses, the address has to be surrounded  by
#  square  brackets as usual. E.g. [2001:0db8:85a3::4].
#
#  If multiple RADIUS server lines exist, they are tried in order.  The
#  first server to return success or failure causes the module to return
#  success or failure.  Only if a server fails to response is it skipped,
#  and the next server in turn is used.
#
#  The timeout field controls how many seconds the module waits before
#  deciding that the server has failed to respond.  Timeouts MUST be
#  between 3 and 60 seconds.  If they are outside of this range, the
#  timeouts are clamped to this range.
#
#  The source_ip field can be used to make the library bind the socket
#  that connects to that particular server to a particular IP address.
#  Note: specifying a timeout field is mandatory due to config parsing,
#  but if not needed it can be just set to the default of 3.
#
#  The vrf field can be used on Linux to make the library bind the socket
#  that connects to that particualar server to a particular VRF.
#  See: https://www.kernel.org/doc/Documentation/networking/vrf.txt for
#  more information.
#  Note: specifying a source_ip field is mandatory due to config parsing,
#  but if not needed it can be just set to 0.
#
# server[:port]             shared_secret      timeout (s)  source_ip            vrf
10.79.54.196                testing123         3            0
#127.0.0.1                   secret             3
#other-server                other-secret       5            192.168.1.10         vrf-blue
#[2001:0db8:85a3::4]:1812    other6-secret      3            [2001:0db8:85a3::3]  vrf-red
#other-other-server          other-other-secret 5            0                    vrf-blue
#
# having localhost in your radius configuration is a Good Thing.
#
# See the INSTALL file for pam.conf hints.
pi@raspberrypi:~ $ 
pi@raspberrypi:~ $ cat /etc/ssh/sshd_config
#	$OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options override the
# default value.

Include /etc/ssh/sshd_config.d/*.conf

#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
#HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying
#RekeyLimit default none

# Logging
#SyslogFacility AUTH
#LogLevel INFO

# Authentication:

#LoginGraceTime 2m
#PermitRootLogin prohibit-password
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10

#PubkeyAuthentication yes

# Expect .ssh/authorized_keys2 to be disregarded by default in future.
#AuthorizedKeysFile	.ssh/authorized_keys .ssh/authorized_keys2

#AuthorizedPrincipalsFile none

#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes

#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes
PrintMotd no
#PrintLastLog yes
#TCPKeepAlive yes
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#UseDNS no
#PidFile /var/run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none

# no default banner path
#Banner none

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

# override default of no subsystems
Subsystem	sftp	/usr/lib/openssh/sftp-server

# Example of overriding settings on a per-user basis
#Match User anoncvs
#	X11Forwarding no
#	AllowTcpForwarding no
#	PermitTTY no
#	ForceCommand cvs server
pi@raspberrypi:~ $ 
pi@raspberrypi:~ $ 

From the above FreeRadius Server and Linux Server's configuration, we can found that User1, User2 and User3 are added at FreeRadius's user list.
when I tried to login to Linux Server using user: pi via ssh, login success, wireshark capture and freeradius shows that radius authenticate the user success. below is freeradius log:

(0) Received Access-Request Id 234 from 173.39.202.158:55987 to 172.17.0.3:1812 length 86
(0)   User-Name = "pi"
(0)   User-Password = "test123"
(0)   NAS-IP-Address = 127.0.1.1
(0)   NAS-Identifier = "sshd"
(0)   NAS-Port = 10221
(0)   NAS-Port-Type = Virtual
(0)   Service-Type = Authenticate-Only
(0)   Calling-Station-Id = "10.140.42.56"
(0) # Executing section authorize from file /etc/freeradius/sites-enabled/default
(0)   authorize {
(0)     policy filter_username {
(0)       if (&User-Name) {
(0)       if (&User-Name)  -> TRUE
(0)       if (&User-Name)  {
(0)         if (&User-Name =~ / /) {
(0)         if (&User-Name =~ / /)  -> FALSE
(0)         if (&User-Name =~ /@[^@]*@/ ) {
(0)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(0)         if (&User-Name =~ /\.\./ ) {
(0)         if (&User-Name =~ /\.\./ )  -> FALSE
(0)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(0)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE
(0)         if (&User-Name =~ /\.$/)  {
(0)         if (&User-Name =~ /\.$/)   -> FALSE
(0)         if (&User-Name =~ /@\./)  {
(0)         if (&User-Name =~ /@\./)   -> FALSE
(0)       } # if (&User-Name)  = notfound
(0)     } # policy filter_username = notfound
(0)     [preprocess] = ok
(0)     [chap] = noop
(0)     [mschap] = noop
(0)     [digest] = noop
(0) suffix: Checking for suffix after "@"
(0) suffix: No '@' in User-Name = "pi", looking up realm NULL
(0) suffix: No such realm "NULL"
(0)     [suffix] = noop
(0) eap: No EAP-Message, not doing EAP
(0)     [eap] = noop
(0) files: users: Matched entry pi at line 93
(0) files: EXPAND Hello, %{User-Name}
(0) files:    --> Hello, pi
(0)     [files] = ok
(0)     [expiration] = noop
(0)     [logintime] = noop
(0)     [pap] = updated
(0)   } # authorize = updated
(0) Found Auth-Type = PAP
(0) # Executing group from file /etc/freeradius/sites-enabled/default
(0)   Auth-Type PAP {
(0) pap: Login attempt with password
(0) pap: Comparing with "known good" Cleartext-Password
(0) pap: User authenticated successfully
(0)     [pap] = ok
(0)   } # Auth-Type PAP = ok
(0) # Executing section post-auth from file /etc/freeradius/sites-enabled/default
(0)   post-auth {
(0)     if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) {
(0)     if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name))  -> FALSE
(0)     update {
(0)       No attributes updated for RHS &session-state:
(0)     } # update = noop
(0)     [exec] = noop
(0)     policy remove_reply_message_if_eap {
(0)       if (&reply:EAP-Message && &reply:Reply-Message) {
(0)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
(0)       else {
(0)         [noop] = noop
(0)       } # else = noop
(0)     } # policy remove_reply_message_if_eap = noop
(0)     if (EAP-Key-Name && &reply:EAP-Session-Id) {
(0)     if (EAP-Key-Name && &reply:EAP-Session-Id)  -> FALSE
(0)   } # post-auth = noop
(0) Sent Access-Accept Id 234 from 172.17.0.3:1812 to 173.39.202.158:55987 length 31
(0)   Reply-Message = "Hello, pi"
(0) Finished request
Waking up in 4.9 seconds.
(1) Received Accounting-Request Id 56 from 173.39.202.158:47714 to 172.17.0.3:1813 length 84
(1)   User-Name = "pi"
(1)   NAS-IP-Address = 127.0.1.1
(1)   NAS-Identifier = "sshd"
(1)   NAS-Port = 10221
(1)   NAS-Port-Type = Virtual
(1)   Acct-Status-Type = Start
(1)   Acct-Session-Id = "00010221"
(1)   Acct-Authentic = RADIUS
(1)   Calling-Station-Id = "10.140.42.56"
(1) # Executing section preacct from file /etc/freeradius/sites-enabled/default
(1)   preacct {
(1)     [preprocess] = ok
(1)     policy acct_unique {
(1)       update request {
(1)         &Tmp-String-9 := "ai:"
(1)       } # update request = noop
(1)       if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && 	    ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) {
(1)       EXPAND %{hex:&Class}
(1)          --> 
(1)       EXPAND ^%{hex:&Tmp-String-9}
(1)          --> ^61693a
(1)       if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && 	    ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i))  -> FALSE
(1)       else {
(1)         update request {
(1)           EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}}
(1)              --> 070cd5ea05f403fa46c6d036709b9288
(1)           &Acct-Unique-Session-Id := 070cd5ea05f403fa46c6d036709b9288
(1)         } # update request = noop
(1)       } # else = noop
(1)       update request {
(1)         &Tmp-String-9 !* ANY
(1)       } # update request = noop
(1)     } # policy acct_unique = noop
(1) suffix: Checking for suffix after "@"
(1) suffix: No '@' in User-Name = "pi", looking up realm NULL
(1) suffix: No such realm "NULL"
(1)     [suffix] = noop
(1)     [files] = noop
(1)   } # preacct = ok
(1) # Executing section accounting from file /etc/freeradius/sites-enabled/default
(1)   accounting {
(1) detail: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d
(1) detail:    --> /var/log/freeradius/radacct/173.39.202.158/detail-20231116
(1) detail: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/freeradius/radacct/173.39.202.158/detail-20231116
(1) detail: EXPAND %t
(1) detail:    --> Thu Nov 16 05:07:55 2023
(1)     [detail] = ok
(1)     [unix] = ok
(1)     [exec] = noop
(1) attr_filter.accounting_response: EXPAND %{User-Name}
(1) attr_filter.accounting_response:    --> pi
(1) attr_filter.accounting_response: Matched entry DEFAULT at line 12
(1)     [attr_filter.accounting_response] = updated
(1)   } # accounting = updated
(1) Sent Accounting-Response Id 56 from 172.17.0.3:1813 to 173.39.202.158:47714 length 20
(1) Finished request
(1) Cleaning up request packet ID 56 with timestamp +19 due to done
Waking up in 4.9 seconds.
(0) Cleaning up request packet ID 234 with timestamp +19 due to cleanup_delay was reached
Ready to process requests

when I tried to login to Linux Server using user: bob or mario via ssh, login failure, wireshark capture and freeradius shows that radius authenticate the user failure. below is freeradius log:

(2) Received Access-Request Id 214 from 173.39.202.158:44109 to 172.17.0.3:1812 length 87
(2)   User-Name = "bob"
(2)   User-Password = "\010\n\r\177INC"
(2)   NAS-IP-Address = 127.0.1.1
(2)   NAS-Identifier = "sshd"
(2)   NAS-Port = 10248
(2)   NAS-Port-Type = Virtual
(2)   Service-Type = Authenticate-Only
(2)   Calling-Station-Id = "10.140.42.56"
(2) # Executing section authorize from file /etc/freeradius/sites-enabled/default
(2)   authorize {
(2)     policy filter_username {
(2)       if (&User-Name) {
(2)       if (&User-Name)  -> TRUE
(2)       if (&User-Name)  {
(2)         if (&User-Name =~ / /) {
(2)         if (&User-Name =~ / /)  -> FALSE
(2)         if (&User-Name =~ /@[^@]*@/ ) {
(2)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(2)         if (&User-Name =~ /\.\./ ) {
(2)         if (&User-Name =~ /\.\./ )  -> FALSE
(2)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(2)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE
(2)         if (&User-Name =~ /\.$/)  {
(2)         if (&User-Name =~ /\.$/)   -> FALSE
(2)         if (&User-Name =~ /@\./)  {
(2)         if (&User-Name =~ /@\./)   -> FALSE
(2)       } # if (&User-Name)  = notfound
(2)     } # policy filter_username = notfound
(2)     [preprocess] = ok
(2)     [chap] = noop
(2)     [mschap] = noop
(2)     [digest] = noop
(2) suffix: Checking for suffix after "@"
(2) suffix: No '@' in User-Name = "bob", looking up realm NULL
(2) suffix: No such realm "NULL"
(2)     [suffix] = noop
(2) eap: No EAP-Message, not doing EAP
(2)     [eap] = noop
(2) files: users: Matched entry bob at line 87
(2) files: EXPAND Hello, %{User-Name}
(2) files:    --> Hello, bob
(2)     [files] = ok
(2)     [expiration] = noop
(2)     [logintime] = noop
(2)     [pap] = updated
(2)   } # authorize = updated
(2) Found Auth-Type = PAP
(2) # Executing group from file /etc/freeradius/sites-enabled/default
(2)   Auth-Type PAP {
(2) pap: Login attempt with password
(2) pap: Comparing with "known good" Cleartext-Password
(2) pap: ERROR: Cleartext password does not match "known good" password
(2) pap: Passwords don't match
(2)     [pap] = reject
(2)   } # Auth-Type PAP = reject
(2) Failed to authenticate the user
(2) WARNING: Unprintable characters in the password.  Double-check the shared secret on the server and the NAS!
(2) Using Post-Auth-Type Reject
(2) # Executing group from file /etc/freeradius/sites-enabled/default
(2)   Post-Auth-Type REJECT {
(2) attr_filter.access_reject: EXPAND %{User-Name}
(2) attr_filter.access_reject:    --> bob
(2) attr_filter.access_reject: Matched entry DEFAULT at line 11
(2)     [attr_filter.access_reject] = updated
(2)     [eap] = noop
(2)     policy remove_reply_message_if_eap {
(2)       if (&reply:EAP-Message && &reply:Reply-Message) {
(2)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
(2)       else {
(2)         [noop] = noop
(2)       } # else = noop
(2)     } # policy remove_reply_message_if_eap = noop
(2)   } # Post-Auth-Type REJECT = updated
(2) Delaying response for 1.000000 seconds
Waking up in 0.3 seconds.
Waking up in 0.6 seconds.
(2) Sending delayed response
(2) Sent Access-Reject Id 214 from 172.17.0.3:1812 to 173.39.202.158:44109 length 32
(2)   Reply-Message = "Hello, bob"
Waking up in 3.9 seconds.
(2) Cleaning up request packet ID 214 with timestamp +277 due to cleanup_delay was reached
Ready to process requests

Notice the line: (2) User-Password = "\010\n\r\177INC" from the above log, we can found the Access-Request message carries wrong password. Wireshark capture also proves it.

the only one different point between user pi and user bob/mario is that pi was created at Linux server but bob/mario was not.
i did google search and found two different ideas:

1. one is here, they think a PAM module which is run before pam_radius_auth. That first module is checking the password locally, and when it's wrong, is setting the password to the "INCORRECT" string.

2. the other is here, they think pam_radius_auth library can’t correctly encrypt the password when there is no user defined in system (/etc/passwd).

If my issue does really result from the 2nd idea, it will be a critical issue for us. because our intention is to simplify user authentication at our network as we have many users and many linux servers, we don't want to create users one by one at every Linux Servers as which is huge workload for us. Consequently, I build a FreeRadius server to do authentication, authorization and accounting for every users. our target is that when one new user join us, the only one thing I need to do is adding him to the user list at FreeRadius Server, then he can login to Linux Servers, FreeRadius server will help authenticate him.

I am not sure: users exist at Linux system(/etc/passwd) is a mandatory prerequisite for central pam-radius-based ssh ?

Any expert could help me ?

Thanks in advance.

I recently experienced instability issues and or erratic behavior with MariaDB and Dovecot when combined with pam_radius_auth for authentication. The problem only occurred when the server was under load. After a while of bug hunting i was able to pinpoint the exact problem:
pam_radius_auth uses a call to select(), which by itself is not a problem. But it can become a problem when the fd numbers go beyond 1024 (at least on linux, where FD_SETSIZE is defined as 1024). If this happens, the stack can get corrupted leading to arbitrary behavior. Please see "man 2 select" under NOTES.
In case someone is able to somehow affect the process to open more than 1024 file descriptors this problem could also be leveraged to gain unauthorized access. So i also consider this as a security problem.
I have created a patched version of pam_radius_auth which replaces select() with poll(). In our environment this has now been running for some time without any further problems. I will post this patch as a pull request.

Wanted to resurrect this issue that I found, which I had no involvement with at the time, and see if the project would be open to this enhancement if I coded it up and submitted it. There is reference to a bug that I assume is an old/retired bug tracking system, so I don't know where this effort ended back then. Long shot, but anyone know/remember why this enhancement died?

http://lists.freeradius.org/pipermail/freeradius-users/2008-October/032543.html
http://lists.freeradius.org/pipermail/freeradius-users/2008-October/032762.html
http://bugs.freeradius.org/show_bug.cgi?id=609

(Originally by @TomasFuego, moved to pam_radius repo)

The pam_radius/md5.c needs to account for other big endian processors like powerpc.

This patch works for me using gcc 4.6.3:

Index: md5.c
--- md5.c (revision 210)
+++ md5.c (working copy)
@@ -42,7 +42,7 @@

include

include "md5.h"

-#if defined(__sparc) || defined(__mips)
+#if __BYTE_ORDER == __BIG_ENDIAN

define HIGHFIRST

endif

My lecture file ("Waiting on 2FA......") from sudoers configuration is not being displayed.

/etc/pam.d/sudo
#%PAM-1.0
auth required pam_radius_auth.so skip_passwd
account include common-account
password include common-password
session optional pam_keyinit.so revoke
session include common-session

session optional pam_xauth.so

This configuration works on Cent 6,7 & 8, SLES 11, 12 and 15 SP4. With SLES 15SP5 my lecture file no longer displays.
If I remove the skip_passwd option the lecture file does display but as expected I also get prompted for the password before the 2FA is triggered.

I've also tried using the prompt= and force_prompt options as well in conjunction with the skip_passwd but I still do not get the text from my lecture file nor the text passed in the prompt option. Removing the skip_passwd cause both lecture file and prompt option to display.

I ran with debug option

pam_unix(sudo:session): session opened for user root by XXXXXX(uid=XXXXXXXX)
pam_unix(sudo:session): session closed for user root
pam_radius_auth: 2.0.1 DEVELOPER BUILD - (git #d802da75), built on May 1 2024 at 07:28:56
pam_radius_auth: _pam_parse: argv[0] = 'prompt=2FA'
pam_radius_auth: _pam_parse: argv[1] = 'force_prompt'
pam_radius_auth: _pam_parse: argv[2] = 'conf=/etc/raddb/server'
pam_radius_auth: _pam_parse: argv[3] = 'skip_passwd'
pam_radius_auth: _pam_parse: argv[4] = 'debug'
pam_radius_auth: DEBUG: conf='/etc/raddb/server' use_first_pass=no try_first_pass=no skip_passwd=yes retry=0 localifdown=no client_id='' ruser=no prompt='2FA: ' force_prompt=yes prompt_attribute=no max_challenge=0 privilege_level=no
pam_radius_auth: Got user name: 'XXXXXXX'
pam_radius_auth: Sending RADIUS request code 1 (Access-Request)
pam_radius_auth: DEBUG: get_ipaddr(XXXXXXX) returned 0.
pam_radius_auth: Got RADIUS response code 2 (Access-Accept)
pam_radius_auth: authentication succeeded

We have setup (MFA/2FA) on linux based servers using first pam_radius to authenticate with radius server then authenticate with OS password. our pam.d/sshd contains below for auth.

#%PAM-1.0
auth required pam_sepermit.so
auth required pam_radius_auth.so
auth include password-auth
etc etc

Same things working fine on pam_radius-1.4.0-15, and when we update pam_radius to version 2.0 , the MFA has been broken, however if we use only for radius auth it works only as a single auth. but if we want to MFA as mentioned then its not work. So kindly please advise on it, i think new version has some changes which not supporting MFA. Kindly please advise. Thanks.

Regards,

Hello!
How can I get a variable Privilege setted in PAM after user authorization through radius. I wanna use it in another module

And another question: is it possible to use only local authentication for some user. For example: user 'test' login only with local password and does not use pam_radius. All other users should user radius server

If the timeout in the file /etc/raddb/server is set to more than 60 seconds, the actual timeout is silently set to 3 seconds.

In the case where the Radius server is making use of two factor authentication, such as Duo, then a long timeout is required to allow users time to respond to the 2FA prompt. In our case we set this to 120 seconds, but the actual timeout seen was 3 seconds. There was nothing in any logs to indicate this. We spent several days tracking this down!

My suggestions to address this are:

• if the configured timeout exceeds 60 seconds, to set the actual timeout to 60, not 3

• log the fact that the actual timeout being used is different to the configured timeout

• potentially allow the maximum timeout to be an option to the pam_radius module.

I am trying to get Okta to work with openssh using their radius agent. As part of this I turned on the debug function for pam_radius_auth on a test server and discovered that it logs the password in the clear.

I am using version 1.4.0 in case this feature has been fixed.

With the master branch I am still seeing this issue where even valid users are not successfully authenticated. Does not seem that the credentials are being even sent. Code seems to hitting the FD size --

java: pam_radius_auth: Got user name xxxxxxxx
java: pam_radius_auth: Unusable socket, FD is larger than 1024
java: pam_radius_auth: Unusable socket, FD is larger than 1024

Is there any way to overcome this issue ?

I have pam_radius working very well and it is great.

I have a feature request, Freeradius doesn't seem to support account lock outs.
Is there a way for it to lock accounts after a number of failed attempts configured by the user.
I am not sure if we able to use the pam_tally2 module in conjunction with it. I have tried but it just seems to mess up my logins.

Thanks

Is this repo the same a rlm_pam?
https://networkradius.com/doc/current/raddb/mods-available/pam.html

the documentation mentions mem leaks, but I find it very difficult to figure out what is what regarding PAM module for Radius

This project on google should be grafted into the main code base. IPv6 is becomming more important for enterprise solutions

http://code.google.com/p/pam-radius-ipv6/

Hi,
Do you plan to add EAP-TLS or PEAP support to this module?
If no, do you know any tool that can be used as RADIUS EAP-TLS clinet?

Thanks,
Omri.

Hello,

I am using PAM_radius for session mode with this configuration in /etc/pam.d/sshd :

# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open env_params
session    required     pam_namespace.so
session    optional     pam_keyinit.so force revoke
session    include      password-auth
session    include      postlogin
session    required     pam_radius_auth.so debug skip_passwd prompt_attribute

And I have setup the /etc/raddb/server like this :

#Server                 Secret      Timeout
Radius_IP:1812    mysecret    20

My PAM request is still using the 1813 port, I think it's because it's an Accounting-Request and not an Access-Request.

I don't want to change my /etc/services default port for radius-acct

radius          1812/tcp                        # Radius
radius          1812/udp                        # Radius
radius-acct     1813/tcp        radacct         # Radius Accounting
radius-acct     1813/udp        radacct         # Radius Accounting

Is there a way to change this port by using pam_radius configuration ?

Regards,
ROBERT Sylvain

Hi,

My aim is to configure a Radius client via radius pam module, but I am getting some NSS error.

My environment:

• RHEL 8.5
• pam_radius-1.4.0-15.el8.x86_64

My /etc/pam_radius.conf:

radius01 secret 100

My /etc/pam.d/sshd:

#%PAM-1.0

auth            required        pam_env.so
auth            sufficient      pam_radius_auth.so debug client_id=linux
auth            requisite       pam_succeed_if.so uid >= 500 quiet
auth            required        pam_deny.so

account         sufficient      pam_succeed_if.so uid < 500 quiet
account         required        pam_permit.so

password        requisite       pam_cracklib.so try_first_pass retry=3
password        required        pam_deny.so

session         required        pam_selinux.so close
session         required        pam_limits.so
session         [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
#session                required        pam_quota.so bsoftlimit=9216 bhardlimit=10240 path=/
session         required        pam_mkhomedir.so umask=0077
session         required        pam_selinux.so open

My /etc/ssh/sshd_config:

Protocol 2
Port 22

ListenAddress 0.0.0.0

# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key

# Logging
SyslogFacility AUTHPRIV
LogLevel INFO

# Authentication
StrictModes yes
PasswordAuthentication yes
ChallengeResponseAuthentication yes
#ChallengeResponseAuthentication no
UsePAM yes
PubkeyAuthentication no
        # Kerberos options
KerberosAuthentication no
KerberosOrLocalPasswd no
KerberosTicketCleanup no
GSSAPIAuthentication yes
GSSAPICleanupCredentials no

Banner /etc/login-banner

# override default of no subsystems
Subsystem       sftp    /usr/libexec/openssh/sftp-server

# Standard Options
X11Forwarding yes
MACs hmac-sha2-512,hmac-sha2-256
KexAlgorithms diffie-hellman-group-exchange-sha256
Ciphers aes256-ctr,aes192-ctr,aes128-ctr
Match Address 0.0.0.0/0
    # Everyone else
    Banner /etc/login-banner
    GSSAPIAuthentication no
    PubkeyAuthentication no

Whenever I try to SSH I can fee following error in /var/log/secure:

Mar 28 12:05:54 bastiontest sshd[2572]: pam_radius_auth: ignore last_pass, force_prompt set
Mar 28 12:05:57 bastiontest sshd[2572]: pam_radius_auth: Sending RADIUS request code 1
Mar 28 12:05:57 bastiontest sshd[2572]: **pam_radius_auth: DEBUG: getservbyname(radius, udp) returned 0x7fcb7effc240.**
Mar 28 12:06:00 bastiontest sshd[2572]: pam_radius_auth: RADIUS server radius01 failed to respond
Mar 28 12:06:00 bastiontest sshd[2572]: pam_radius_auth: All RADIUS servers failed to respond.
Mar 28 12:06:00 bastiontest sshd[2572]: pam_radius_auth: authentication failed
Mar 28 12:06:00 bastiontest sshd[2570]: error: PAM: Authentication failure for user from 10.x.x.x
Mar 28 12:06:00 bastiontest sshd[2573]: pam_radius_auth: Got user name user
Mar 28 12:06:00 bastiontest sshd[2573]: pam_radius_auth: ignore last_pass, force_prompt set

What does this mean? The command getent services radius is working as expected.

I have freeRadius server. How should I set privelege level for a user in a config so pam_radius can got it.
Now I receive message: "Management-Priveleg-Level missing"

Situation: I have fully configured and working Freeradius server. Installed OVPN 2.6.4 on other server. And goal is auth through Radius. Installed pam-radius-auth. Configured (confs below). Authentication is working just fine, but there are no Accounting packets from OVPN. When I'm trying pamtester - everyting is ok, accounting is here, but when I connected OVPN - no.

/etc/pam.d/ovpn

account required pam_radius_auth.so
auth required pam_radius_auth.so conf=/etc/pam.d/pam_radius_auth.conf debug
session required pam_radius_auth.so

/etc/pam.d/pam_radius_auth.conf

3

/etc/openvpn/server/server.conf

setenv deferred_auth_pam 1
plugin /usr/lib/x86_64-linux-gnu/openvpn/plugins/openvpn-plugin-auth-pam.so ovpn
verify-client-cert none
key-direction 0
local
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA256
tls-crypt tc.key
topology subnet
server 10.8.0.0 255.255.255.0
server-ipv6 fddd:1194:1194:1194::/64
push "redirect-gateway def1 ipv6 bypass-dhcp"
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 67.207.67.3"
push "dhcp-option DNS 67.207.67.2"
push "block-outside-dns"
push "explicit-exit-notify 3"
keepalive 10 120
cipher AES-128-GCM
user nobody
group nogroup
persist-key
persist-tun
verb 3
crl-verify crl.pem
explicit-exit-notify 1
management 127.0.0.1 7555
log-append /var/log/openvpn/openvpn.log
txqueuelen 4000
mute-replay-warnings

What I missing?