Re: PAM.d Syntax for Radius Auth

• Previous message: Dave Wells: "PAM.d Syntax for Radius Auth"
• In reply to: Dave Wells: "PAM.d Syntax for Radius Auth"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

From: "Systems Administrator" <sysadmin@sunet.com.au>
To: "Dave Wells" <dave.wells@foreshore.net>, <focus-linux@securityfocus.com>
Date: Wed, 16 Apr 2003 09:33:36 +1000

> We can get it to work with both RADIUS and Local passwords at once using
> the "Sufficient" argument in the conf for pam_radius.so and to not drop
> back using the "Required" argument, but we wish for the PAM to be able
> to do this automatically. Please find pam.conf for SSH below:
>
> SSHD Pam Conf
>
> auth sufficient /lib/security/pam_radius_auth.so
> auth required /lib/security/pam_stack.so service=system-auth
> auth required /lib/security/pam_nologin.so
> account required /lib/security/pam_stack.so service=system-auth
> password required /lib/security/pam_stack.so service=system-auth
> session required /lib/security/pam_stack.so service=system-auth
> session required /lib/security/pam_limits.so
> session optional /lib/security/pam_console.so
>
> I have just read about the new syntax for PAM using Result=xAction=x
> syntax does anyone have any experience of implementing this?

    If there's no better solution, I'd be doing it as follows:

1. Generate pam.conf from a template; I use a perl Text::Template
solution, but it may be possible with m4 or gcc -E or another text
processing language
2. Put code in the template to ping the RADIUS server (or even better, to
try multiple connects to the appropriate UDP port(s))
3. Generate the template based on whether the server is up
4. Make a cron job that runs the template conversion script every 5
minutes or so

    Not pretty, but it does what you want if you can stand a 5-minute
changeover.

    I understand multiple RADIUS servers are possible, although I haven't
actually tried this myself. But that might do what you want.

    Or, if you want a really big job, you could switch to cfengine
(http://www.gnu.org/software/cfengine/cfengine.html). Yes, I realise that
last is not a real solution :).

Tim Nelson
Systems Administrator
Sunet Internet
Tel: +61 3 5241 1155
Fax: +61 3 5241 6187
Web: http://www.sunet.com.au/
Email: sysadmin@sunet.com.au

• Previous message: Dave Wells: "PAM.d Syntax for Radius Auth"
• In reply to: Dave Wells: "PAM.d Syntax for Radius Auth"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]