(RADIATOR) SSH + PAM + Radiator

Hugh Irvine hugh at open.com.au
Mon Nov 8 21:22:38 CST 2004


Hello Sean -

Thanks for sending the debug and so on.

As you can see, the username that is received by Radiator is "NOUSER", 
not "test01".

The NAS-Identifier in the request is "sshd", but it is not obvious to 
me whether it is sshd or pam that is sending "NOUSER".

I think you will need to check both the sshd log and the pam log, then 
check the corresponding documentation.

regards

Hugh



On 9 Nov 2004, at 14:02, Sean Bofinger wrote:

> Hi,
>
> I am trying to authenticate ssh users through radiator and am having
> some problems.  No users are being authenticated.  I created a user
> test01 in the radmin screen, but when i try to log into the box using
> this users, it get the following error in the radiator logfile
>
> -------------------------------------------------
>
> *** Received from 127.0.0.1 port 11280 ....
> Code:       Access-Request
> Identifier: 42
> Authentic:  C<132><201><241>,<141>J11<219><208><216>3@<160>{
> Attributes:
>         User-Name = "NOUSER"
>         User-Password = 
> "<243><208><132>*<127>@*b<<159><16><132><18><240><229>j"
>         NAS-IP-Address = 10.0.1.7
>         NAS-Identifier = "sshd"
>         NAS-Port = 10255
>         NAS-Port-Type = Virtual
>         Service-Type = Authenticate-Only
>         Calling-Station-Id = "peregrine.office.lan"
>
> Tue Nov  9 11:49:40 2004: DEBUG: Handling request with Handler 
> 'Realm=DEFAULT'
> Tue Nov  9 11:49:40 2004: DEBUG:  Deleting session for NOUSER, 
> 10.0.1.7, 10255
> Tue Nov  9 11:49:40 2004: DEBUG: do query is: 'delete from RADONLINE 
> where NASIDENTIFIER='10.0.1.7' and NASPORT=010255':
> Tue Nov  9 11:49:40 2004: DEBUG: Handling with Radius::AuthRADMIN
> Tue Nov  9 11:49:40 2004: DEBUG: Handling with Radius::AuthRADMIN:
> Tue Nov  9 11:49:40 2004: DEBUG: Query is: 'select PASS_WORD, 
> STATICADDRESS, TIMELEFT, MAXLOGINS, SERVICENAME, BADLOGINS, VALIDFROM, 
> VALIDTO from RADUSERS where USERNAME='NOUSER'':
> Tue Nov  9 11:49:40 2004: DEBUG: Radius::AuthRADMIN looks for match 
> with NOUSER
> Tue Nov  9 11:49:40 2004: INFO: Access rejected for NOUSER: No such 
> user
> Tue Nov  9 11:49:40 2004: DEBUG: do query is: 'insert into RADAUTHLOG 
> (TIME_STAMP, USERNAME, TYPE, REASON) values (1099964980, 'NOUSER', 0, 
> 'No such user')':
> Tue Nov  9 11:49:40 2004: DEBUG: Packet dump:
> *** Sending to 127.0.0.1 port 11280 ....
> Code:       Access-Reject
> Identifier: 42
> Authentic:  C<132><201><241>,<141>J11<219><208><216>3@<160>{
> Attributes:
>         Reply-Message = "Request Denied"
>
> ------------------------------------------------------------------
> My /etc/pam.d/sshd file looks like
>
> #%PAM-1.0
> #auth       required     pam_stack.so service=system-auth
> #auth       required     pam_nologin.so
> auth       sufficient   /lib/security/pam_radius_auth.so
> account    sufficient   /lib/security/pam_radius_auth.so
> #account    required     pam_stack.so service=system-auth
> #password   required     pam_stack.so service=system-auth
> #session    required     pam_stack.so service=system-auth
> session    required     pam_limits.so
> session    optional     pam_console.so
>
> -----------------------------------------------------------------
>
>
> And the radius.cfg
>
> LogDir          /var/log/radius
> DbDir           /etc/radiator
>
> Trace 4
>
> <Client DEFAULT>
>         Secret  mysecret
>         DupInterval 0
> </Client>
>
> <ClientListSQL>
>         DBSource        dbi:mysql:radmin:localhost
>         DBUsername      radmin
>         DBAuth          radminpw
>                                                                        
>                                                      </ClientListSQL>
>                                                                        
>                                                                       
> <Realm DEFAULT>
>         <AuthBy RADMIN>
>                 DBSource        dbi:mysql:radmin:localhost
>                 DBUsername      radmin
>                 DBAuth          radminpw
>
>                 NoDefault
> 		 AccountingTable RADUSAGE
>                 AcctColumnDef   USERNAME,User-Name
>                 AcctColumnDef   TIME_STAMP,Timestamp,integer
>                 AcctColumnDef   ACCTSTATUSTYPE,Acct-Status-Type,integer
>                 AcctColumnDef   ACCTDELAYTIME,Acct-Delay-Time,integer
>                 AcctColumnDef   
> ACCTINPUTOCTETS,Acct-Input-Octets,integer
>                 AcctColumnDef   
> ACCTOUTPUTOCTETS,Acct-Output-Octets,integer
>                 AcctColumnDef   ACCTSESSIONID,Acct-Session-Id
>                 AcctColumnDef   
> ACCTSESSIONTIME,Acct-Session-Time,integer
>                 AcctColumnDef   
> ACCTTERMINATECAUSE,Acct-Terminate-Cause,integer
>                 AcctColumnDef   FRAMEDIPADDRESS,Framed-IP-Address
>                 AcctColumnDef   NASIDENTIFIER,NAS-IP-Address
>                 AcctColumnDef   NASIDENTIFIER,NAS-Identifier
>                 AcctColumnDef   NASPORT,NAS-Port,integer
>                 AcctColumnDef   DNIS,Called-Station-Id
> #               AcctColumnDef   CALLINGSTATIONID,Calling-Station-Id
>
>
>                 AcctSQLStatement update RADUSERS set 
> TIMELEFT=TIMELEFT-0%{Acct-Session-Time}, 
> OCTETSINLEFT=OCTETSINLEFT-0%{Acct-Input-Octets}, 
> OCTETSOUTLEFT=OCTETSOUTLEFT-0%{Acct-Output-Octets} where USERNAME='%n'
>                 AddToReply Framed-Protocol = PPP,\
>                         Framed-IP-Netmask = 255.255.255.255,\
>                         Framed-Routing = None,\
>                         Framed-MTU = 1500,\
>                         Framed-Compression = Van-Jacobson-TCP-IP
> 	
> 	</AuthBy>
>
>
>         <AuthLog SQL>
>
>                 DBSource        dbi:mysql:radmin:localhost
>                 DBUsername      radmin
>                 DBAuth          radminpw
>
>                 LogSuccess
>                 SuccessQuery insert into RADAUTHLOG (TIME_STAMP, 
> USERNAME, TYPE) values (%t, '%n', 1)
>                 LogFailure
>                 FailureQuery insert into RADAUTHLOG (TIME_STAMP, 
> USERNAME, TYPE, REASON) values (%t, '%n', 0, %1)
>         </AuthLog>
> </Realm>
>
> <SessionDatabase SQL>
>         # This database spec usually should be exactly the same
>         # as in <AuthBy RADMIN> above
>         DBSource        dbi:mysql:radmin:localhost
>         DBUsername      radmin
>         DBAuth          radminpw
>
> </SessionDatabase>
>
> ------------------------------------------------
>
>
> Any ideas?
>
>
> Thanks in advance
> Sean
>
>
> --
> Archive at http://www.open.com.au/archives/radiator/
> Announcements on radiator-announce at open.com.au
> To unsubscribe, email 'majordomo at open.com.au' with
> 'unsubscribe radiator' in the body of the message.
>
>

NB: have you included a copy of your configuration file (no secrets),
together with a trace 4 debug showing what is happening?

-- 
Radiator: the most portable, flexible and configurable RADIUS server
anywhere. Available on *NIX, *BSD, Windows, MacOS X.
-
Nets: internetwork inventory and management - graphical, extensible,
flexible with hardware, software, platform and database independence.
-
CATool: Private Certificate Authority for Unix and Unix-like systems.

--
Archive at http://www.open.com.au/archives/radiator/
Announcements on radiator-announce at open.com.au
To unsubscribe, email 'majordomo at open.com.au' with
'unsubscribe radiator' in the body of the message.


More information about the radiator mailing list