RADIUS auth - Revision history

MarkTomm at 09:34, 19 November 2015

2015-11-19T09:34:35Z

← Older revision		Revision as of 09:34, 19 November 2015
Line 183:		Line 183:

	''' <big><big>NB!</big></big> ATM Device will be inaccessible over shh if there is no properly configured radius server to auth'''		''' <big><big>NB!</big></big> ATM Device will be inaccessible over shh if there is no properly configured radius server to auth'''

	''' <big><big>NB!</big></big> ATM there must a local user with the same name as the one which will be used when authenticating using RADIUS server'''		''' <big><big>NB!</big></big> ATM there must a local user with the same name as the one which will be used when authenticating using RADIUS server'''

MarkTomm at 09:34, 19 November 2015

2015-11-19T09:34:21Z

← Older revision		Revision as of 09:34, 19 November 2015
Line 180:		Line 180:
	SERVER-IP SECRET SECONDS-TO-WAIT		SERVER-IP SECRET SECONDS-TO-WAIT

			4. Reboot device

			''' <big><big>NB!</big></big> ATM Device will be inaccessible over shh if there is no properly configured radius server to auth'''
	''' <big><big>NB!</big></big> ATM there must a local user with the same name as the one which will be used when authenticating using RADIUS server'''		''' <big><big>NB!</big></big> ATM there must a local user with the same name as the one which will be used when authenticating using RADIUS server'''

MarkTomm at 09:11, 19 November 2015

2015-11-19T09:11:19Z

← Older revision		Revision as of 09:11, 19 November 2015
Line 1:		Line 1:
	This document contains GW setup information for ~~development~~ implementation of RADIUS authentication when logging in over ssh.		This document contains GW setup information for initial implementation of RADIUS authentication when logging in over ssh ('''currently under development''').

	In order for ssh to use pam modules, /etc/sshd_config needs to be modified.		1. In order for ssh to use pam modules, /etc/sshd_config needs to be modified.

	Modified example of /etc/sshd_config		Modified example of /etc/sshd_config
Line 125:		Line 125:
	</pre>		</pre>

			Below are the differences between default sshd_config file from the device and the above example:

			<pre>
			--- sshorig 2015-11-19 10:53:05.279666948 +0200
			+++ sshpam 2015-11-19 10:50:07.415666377 +0200
			@@ -61,7 +61,7 @@
			#PermitEmptyPasswords no

			# Change to no to disable s/key passwords
			-#ChallengeResponseAuthentication yes
			+ChallengeResponseAuthentication yes

			# Kerberos options
			#KerberosAuthentication no
			@@ -82,7 +82,7 @@
			# If you just want the PAM account and session checks to run without
			# PAM authentication, then enable this but set PasswordAuthentication
			# and ChallengeResponseAuthentication to 'no'.
			-#UsePAM no
			+UsePAM yes

			#AllowAgentForwarding yes
			#AllowTcpForwarding yes
			</pre>

	Create /etc/pam.d directory and a file named sshd		2. Create /etc/pam.d directory and a file named sshd

	/etc/pam.d/sshd		/etc/pam.d/sshd
Line 145:		Line 168:


	Create /etc/raddb/ directory and a file named 'server'		3. Create /etc/raddb/ directory and a file named 'server'
	/etc/raddb/server file contains a list on server information needed by the pam		/etc/raddb/server file contains a list on server information needed by the pam
	radius client.		radius client.

MarkTomm: Uus lehekülg: 'This document contains GW setup information for development implementation of RADIUS authentication when logging in over ssh. In order for ssh to use pam modules, /etc/sshd_conf...'

2015-11-19T08:03:47Z

Uus lehekülg: 'This document contains GW setup information for development implementation of RADIUS authentication when logging in over ssh. In order for ssh to use pam modules, /etc/sshd_conf...'

New page

This document contains GW setup information for development implementation of RADIUS authentication when logging in over ssh.

In order for ssh to use pam modules, /etc/sshd_config needs to be modified.

Modified example of /etc/sshd_config
<pre>
# $OpenBSD: sshd_config,v 1.82 2010/09/06 17:10:19 naddy Exp $

# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented. Uncommented options change a
# default value.

#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

# The default requires explicit activation of protocol 1
#Protocol 2

# HostKey for protocol version 1
#HostKey /etc/ssh_host_key
# HostKeys for protocol version 2
#HostKey /etc/ssh_host_rsa_key
#HostKey /etc/ssh_host_dsa_key
#HostKey /etc/ssh_host_ecdsa_key

# Lifetime and size of ephemeral version 1 server key
#KeyRegenerationInterval 1h
#ServerKeyBits 1024

# Logging
# obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
#LogLevel INFO

# Authentication:

#LoginGraceTime 2m
PermitRootLogin no
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10

#RSAAuthentication yes
#PubkeyAuthentication yes
#AuthorizedKeysFile .ssh/authorized_keys

# For this to work you will also need host keys in /etc/ssh_known_hosts
#RhostsRSAAuthentication no
# similar for protocol version 2
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no

# Change to no to disable s/key passwords
ChallengeResponseAuthentication yes

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication. Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes

#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
#X11Forwarding no
#X11DisplayOffset 10
#X11UseLocalhost yes
#PrintMotd yes
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
#UsePrivilegeSeparation yes
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
UseDNS no
#PidFile /var/run/sshd.pid
#MaxStartups 10
#PermitTunnel no
#ChrootDirectory none

# no default banner path
#Banner none

# override default of no subsystems
Subsystem sftp /usr/lib/sftp-server

# Example of overriding settings on a per-user basis
#Match User anoncvs
# X11Forwarding no
# AllowTcpForwarding no
# ForceCommand cvs server
</pre>

Create /etc/pam.d directory and a file named sshd

/etc/pam.d/sshd
<pre>
auth sufficient pam_radius_auth.so debug
auth include system-auth
account sufficient pam_radius_auth.so debug
account required pam_nologin.so
account include system-auth
password include system-auth
session sufficient pam_radius_auth.so debug conf=/etc/raddb/server
session optional pam_keyinit.so force revoke
session include system-auth
session required pam_loginuid.so
</pre>

Create /etc/raddb/ directory and a file named 'server'
/etc/raddb/server file contains a list on server information needed by the pam
radius client.

The example contents of the /etc/raddb/server file for my test radius server
<pre>
10.0.0.199 martem-radius 20
</pre>

/etc/raddb/server structure explained:
SERVER-IP SECRET SECONDS-TO-WAIT

''' <big><big>NB!</big></big> ATM there must a local user with the same name as the one which will be used when authenticating using RADIUS server'''