Yubico Forum
https://forum.yubico.com/

Yubico-pam with Freeradius
https://forum.yubico.com/viewtopic.php?f=5&t=647
Page 1 of 1

Author:  geoffb [ Tue Mar 08, 2011 4:47 pm ]
Post subject:  Yubico-pam with Freeradius

I'm trying to setup yubico-pam with Freeradius on a small Linksys NSLU2 running Debian.

I've got Freeradius working and is currently authenticating using /etc/passwd. sshd is using the yubico-pam module with the addition of the following line to /etc/pam.d/sshd

Code:
auth required pam_yubico.so authfile=/etc/freeradius/yubikey id=16 debug


But, I cannot get Freeradius to use the yubico pam module. I'm testing using radtest, which accepts the UNIX passwd but fails if I add the yubico OTP.
Code:
/etc/pam.d/radiusd

auth required pam_yubico.so authfile=/etc/freeradius/yubikey id=16 debug
@include common-auth
@include common-account
@include common-password
@include common-session


I'm sure I've just missed something fairly simple, but not sure how to proceed with debugging?

Author:  samir [ Fri Mar 11, 2011 2:40 pm ]
Post subject:  Re: Yubico-pam with Freeradius

Please refer to the following wiki page which provides step by step guide to use the YubiKey with FreeRADIUS for two factor authentication using Yubico PAM module:

https://github.com/Yubico/yubico-pam/wi ... DIUSviaPAM

We hope this helps!

Author:  geoffb [ Mon Mar 14, 2011 7:18 pm ]
Post subject:  Re: Yubico-pam with Freeradius

Thanks for the link. I've tried the pam.d config as suggested:


Code:
    auth         required       pam_yubico.so authfile=/etc/yubikeyid id=16 debug
    auth         include        system-auth
    account      required       pam_nologin.so
    account      include        system-auth
    password     include        system-auth
    session      include        system-auth


But still the same effect, freeradius authenticates against /etc/passwd + shadow, but never uses the pam_yubico.so module.

Any ideas?
thanks,geoff

Author:  samir [ Thu Mar 17, 2011 7:00 am ]
Post subject:  Re: Yubico-pam with Freeradius

We would appreciate if you can:

    1) Run the FreeRADIUS server in debug mode using the command below:

    # radiusd -X

    2) Test the FreeRADIUS authentication using the radtest command. This will generate a debug output on the shell running the FreeRADIUS server in debug mode as explained above.

    3) Please send us this debug output.

This will help us in determining the exact cause of the problem.

Author:  geoffb [ Thu Mar 17, 2011 8:33 am ]
Post subject:  Re: Yubico-pam with Freeradius

Ok, here's the output from radtest
First using just the password matching /etc/shadow:

Code:
nslu2:~# radtest admin <plaintext password removed> 127.0.0.1 0 testing123
Sending Access-Request of id 238 to 127.0.0.1 port 1812
        User-Name = "admin"
        User-Password = "<plaintext password removed>"
        NAS-IP-Address = 192.168.3.77
        NAS-Port = 0
rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=238, length=26
        Service-Type = NAS-Prompt-User
nslu2:~#


Then, appending with yubikey OTP:

Code:
nslu2:~# radtest admin <plaintext password removed>cccccccjfcevejkdklbbrfcrurvbireggknbcckevgvf 127.0.0.1 0 testing123
Sending Access-Request of id 17 to 127.0.0.1 port 1812
        User-Name = "admin"
        User-Password = "<plaintext password removed>cccccccjfcevejkdklbbrfcrurvbireggknbcckevgvf"
        NAS-IP-Address = 192.168.3.77
        NAS-Port = 0
rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=17, length=20
nslu2:~#


Here's the output from Freeradius -X
Code:
FreeRADIUS Version 2.0.4, for host arm-unknown-linux-gnueabi, built on Sep  8 2008 at 02:43:37
Copyright (C) 1999-2008 The FreeRADIUS server project and contributors.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License.
Starting - reading configuration files ...
including configuration file /etc/freeradius/radiusd.conf
including configuration file /etc/freeradius/proxy.conf
including configuration file /etc/freeradius/clients.conf
including configuration file /etc/freeradius/snmp.conf
including configuration file /etc/freeradius/eap.conf
including configuration file /etc/freeradius/policy.conf
including files in directory /etc/freeradius/sites-enabled/
including configuration file /etc/freeradius/sites-enabled/default
including configuration file /etc/freeradius/sites-enabled/inner-tunnel
including dictionary file /etc/freeradius/dictionary
main {
        prefix = "/usr"
        localstatedir = "/var"
        logdir = "/var/log/freeradius"
        libdir = "/usr/lib/freeradius"
        radacctdir = "/var/log/freeradius/radacct"
        hostname_lookups = no
        max_request_time = 30
        cleanup_delay = 5
        max_requests = 1024
        allow_core_dumps = no
        pidfile = "/var/run/freeradius/freeradius.pid"
        user = "root"
        group = "root"
        checkrad = "/usr/sbin/checkrad"
        debug_level = 0
        proxy_requests = yes
 security {
        max_attributes = 200
        reject_delay = 1
        status_server = yes
 }
}
 client localhost {
        ipaddr = 127.0.0.1
        require_message_authenticator = no
        secret = "testing123"
        nastype = "other"
 }
radiusd: #### Loading Realms and Home Servers ####
 proxy server {
        retry_delay = 5
        retry_count = 3
        default_fallback = no
        dead_time = 120
        wake_all_if_all_dead = no
 }
 home_server localhost {
        ipaddr = 127.0.0.1
        port = 1812
        type = "auth"
        secret = "testing123"
        response_window = 20
        max_outstanding = 65536
        zombie_period = 40
        status_check = "status-server"
        ping_check = "none"
        ping_interval = 30
        check_interval = 30
        num_answers_to_alive = 3
        num_pings_to_alive = 3
        revive_interval = 120
        status_check_timeout = 4
 }
 home_server_pool my_auth_failover {
        type = fail-over
        home_server = localhost
 }
 realm example.com {
        auth_pool = my_auth_failover
 }
 realm LOCAL {
 }
radiusd: #### Instantiating modules ####
 instantiate {
 Module: Linked to module rlm_exec
 Module: Instantiating exec
  exec {
        wait = yes
        input_pairs = "request"
        shell_escape = yes
  }
 Module: Linked to module rlm_expr
 Module: Instantiating expr
 Module: Linked to module rlm_expiration
 Module: Instantiating expiration
  expiration {
        reply-message = "Password Has Expired  "
  }
 Module: Linked to module rlm_logintime
 Module: Instantiating logintime
  logintime {
        reply-message = "You are calling outside your allowed timespan  "
        minimum-timeout = 60
  }
 }
radiusd: #### Loading Virtual Servers ####
server inner-tunnel {
 modules {
 Module: Checking authenticate {...} for more modules to load
 Module: Linked to module rlm_pap
 Module: Instantiating pap
  pap {
        encryption_scheme = "auto"
        auto_header = no
  }
 Module: Linked to module rlm_chap
 Module: Instantiating chap
 Module: Linked to module rlm_mschap
 Module: Instantiating mschap
  mschap {
        use_mppe = yes
        require_encryption = no
        require_strong = no
        with_ntdomain_hack = no
  }
 Module: Linked to module rlm_unix
 Module: Instantiating unix
  unix {
        radwtmp = "/var/log/freeradius/radwtmp"
  }
 Module: Linked to module rlm_eap
 Module: Instantiating eap
  eap {
        default_eap_type = "md5"
        timer_expire = 60
        ignore_unknown_eap_types = no
        cisco_accounting_username_bug = no
  }
 Module: Linked to sub-module rlm_eap_md5
 Module: Instantiating eap-md5
 Module: Linked to sub-module rlm_eap_leap
 Module: Instantiating eap-leap
 Module: Linked to sub-module rlm_eap_gtc
 Module: Instantiating eap-gtc
   gtc {
        challenge = "Password: "
        auth_type = "PAP"
   }
rlm_eap: Ignoring EAP-Type/tls because we do not have OpenSSL support.
rlm_eap: Ignoring EAP-Type/ttls because we do not have OpenSSL support.
rlm_eap: Ignoring EAP-Type/peap because we do not have OpenSSL support.
 Module: Linked to sub-module rlm_eap_mschapv2
 Module: Instantiating eap-mschapv2
   mschapv2 {
        with_ntdomain_hack = no
   }
 Module: Checking authorize {...} for more modules to load
 Module: Linked to module rlm_realm
 Module: Instantiating suffix
  realm suffix {
        format = "suffix"
        delimiter = "@"
        ignore_default = no
        ignore_null = no
  }
 Module: Linked to module rlm_files
 Module: Instantiating files
  files {
        usersfile = "/etc/freeradius/users"
        acctusersfile = "/etc/freeradius/acct_users"
        preproxy_usersfile = "/etc/freeradius/preproxy_users"
        compat = "no"
  }
 Module: Checking session {...} for more modules to load
 Module: Linked to module rlm_radutmp
 Module: Instantiating radutmp
  radutmp {
        filename = "/var/log/freeradius/radutmp"
        username = "%{User-Name}"
        case_sensitive = yes
        check_with_nas = yes
        perm = 384
        callerid = yes
  }
 Module: Checking post-proxy {...} for more modules to load
 Module: Checking post-auth {...} for more modules to load
 Module: Linked to module rlm_attr_filter
 Module: Instantiating attr_filter.access_reject
  attr_filter attr_filter.access_reject {
        attrsfile = "/etc/freeradius/attrs.access_reject"
        key = "%{User-Name}"
  }
 }
}
server {
 modules {
 Module: Checking authenticate {...} for more modules to load
 Module: Linked to module rlm_pam
 Module: Instantiating pam
  pam {
        pam_auth = "radiusd"
  }
 Module: Checking authorize {...} for more modules to load
 Module: Linked to module rlm_preprocess
 Module: Instantiating preprocess
  preprocess {
        huntgroups = "/etc/freeradius/huntgroups"
        hints = "/etc/freeradius/hints"
        with_ascend_hack = no
        ascend_channels_per_line = 23
        with_ntdomain_hack = no
        with_specialix_jetstream_hack = no
        with_cisco_vsa_hack = no
        with_alvarion_vsa_hack = no
  }
 Module: Checking preacct {...} for more modules to load
 Module: Linked to module rlm_acct_unique
 Module: Instantiating acct_unique
  acct_unique {
        key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
  }
 Module: Checking accounting {...} for more modules to load
 Module: Linked to module rlm_detail
 Module: Instantiating detail
  detail {
        detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d"
        header = "%t"
        detailperm = 384
        dirperm = 493
        locking = no
        log_packet_header = no
  }
 Module: Instantiating attr_filter.accounting_response
  attr_filter attr_filter.accounting_response {
        attrsfile = "/etc/freeradius/attrs.accounting_response"
        key = "%{User-Name}"
  }
 Module: Checking session {...} for more modules to load
 Module: Checking post-proxy {...} for more modules to load
 Module: Checking post-auth {...} for more modules to load
 }
}
radiusd: #### Opening IP addresses and Ports ####
listen {
        type = "auth"
        ipaddr = *
        port = 0
}
listen {
        type = "acct"
        ipaddr = *
        port = 0
}
main {
        snmp = no
        smux_password = ""
        snmp_write_access = no
}
Listening on authentication address * port 1812
Listening on accounting address * port 1813
Listening on proxy address * port 1814
Ready to process requests.
rad_recv: Access-Request packet from host 127.0.0.1 port 56228, id=238, length=57
        User-Name = "admin"
        User-Password = "<plaintext password removed>"
        NAS-IP-Address = 192.168.3.77
        NAS-Port = 0
+- entering group authorize
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
    rlm_realm: No '@' in User-Name = "admin", looking up realm NULL
    rlm_realm: No such realm "NULL"
++[suffix] returns noop
  rlm_eap: No EAP-Message, not doing EAP
++[eap] returns noop
++[unix] returns updated
    users: Matched entry admin at line 52
++[files] returns ok
++[expiration] returns noop
++[logintime] returns noop
++[pap] returns updated
  rad_check_password:  Found Auth-Type
auth: type "PAP"
+- entering group PAP
rlm_pap: login attempt with password "<plaintext password removed>"
rlm_pap: Using CRYPT encryption.
rlm_pap: User authenticated successfully
++[pap] returns ok
Login OK: [admin/<plaintext password removed>] (from client localhost port 0)
+- entering group post-auth
++[exec] returns noop
Sending Access-Accept of id 238 to 127.0.0.1 port 56228
        Service-Type = NAS-Prompt-User
Finished request 0.
Going to the next request
Waking up in 4.9 seconds.
Cleaning up request 0 ID 238 with timestamp +26
Ready to process requests.
rad_recv: Access-Request packet from host 127.0.0.1 port 39305, id=17, length=105
        User-Name = "admin"
        User-Password = "<plaintext password removed>cccccccjfcevejkdklbbrfcrurvbireggknbcckevgvf"
        NAS-IP-Address = 192.168.3.77
        NAS-Port = 0
+- entering group authorize
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
    rlm_realm: No '@' in User-Name = "admin", looking up realm NULL
    rlm_realm: No such realm "NULL"
++[suffix] returns noop
  rlm_eap: No EAP-Message, not doing EAP
++[eap] returns noop
++[unix] returns updated
    users: Matched entry admin at line 52
++[files] returns ok
++[expiration] returns noop
++[logintime] returns noop
++[pap] returns updated
  rad_check_password:  Found Auth-Type
auth: type "PAP"
+- entering group PAP
rlm_pap: login attempt with password "<plaintext password removed>cccccccjfcevejkdklbbrfcrurvbireggknbcckevgvf"
rlm_pap: Using CRYPT encryption.
rlm_pap: Passwords don't match
++[pap] returns reject
auth: Failed to validate the user.
Login incorrect (rlm_pap: CRYPT password check failed): [admin/<plaintext password removed>cccccccjfcevejkdklbbrfcrurvbireggknbcckevgvf] (from client localhost port 0)
  Found Post-Auth-Type Reject
+- entering group REJECT
        expand: %{User-Name} -> admin
 attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] returns updated
Delaying reject of request 1 for 1 seconds
Going to the next request
Waking up in 0.9 seconds.
Sending delayed reject for request 1
Sending Access-Reject of id 17 to 127.0.0.1 port 39305
Waking up in 4.9 seconds.
Cleaning up request 1 ID 17 with timestamp +545
Ready to process requests.

Author:  samir [ Fri Mar 18, 2011 2:35 pm ]
Post subject:  Re: Yubico-pam with Freeradius

Please make sure, we have made following changes to FreeRADIUS server user configuration file “/etc/raddb/users”:
Code:
Change "DEFAULT Auth-Type = System" to "DEFAULT Auth-Type = pam" for using  PAM modules for user authentication


and try again!

Author:  geoffb [ Fri Mar 18, 2011 4:54 pm ]
Post subject:  Re: Yubico-pam with Freeradius

Samir,
Many thanks for that, I seem to be getting somewhere now. The default password on it's own is now failing, and it seems to be using the PAM module, but I get this in /var/log/auth

Code:
nslu2:/etc/pam.d# tail /var/log/auth.log
Mar 18 15:49:50 nslu2 freeradius: PAM unable to dlopen(/lib/security/pam_yubico.so): /lib/security/pam_yubico.so: undefined symbol: pam_set_data
Mar 18 15:49:50 nslu2 freeradius: PAM adding faulty module: /lib/security/pam_yubico.so
Mar 18 15:49:59 nslu2 freeradius: PAM unable to dlopen(/lib/security/pam_yubico.so): /lib/security/pam_yubico.so: undefined symbol: pam_set_data
Mar 18 15:49:59 nslu2 freeradius: PAM adding faulty module: /lib/security/pam_yubico.so
Mar 18 15:49:59 nslu2 freeradius: pam_unix(radiusd:auth): authentication failure; logname=root uid=0 euid=0 tty= ruser= rhost=  user=admin
Mar 18 15:50:39 nslu2 freeradius: PAM unable to dlopen(/lib/security/pam_yubico.so): /lib/security/pam_yubico.so: undefined symbol: pam_set_data
Mar 18 15:50:39 nslu2 freeradius: PAM adding faulty module: /lib/security/pam_yubico.so
Mar 18 15:50:46 nslu2 freeradius: PAM unable to dlopen(/lib/security/pam_yubico.so): /lib/security/pam_yubico.so: undefined symbol: pam_set_data
Mar 18 15:50:46 nslu2 freeradius: PAM adding faulty module: /lib/security/pam_yubico.so
Mar 18 15:50:47 nslu2 freeradius: pam_unix(radiusd:auth): authentication failure; logname=root uid=0 euid=0 tty= ruser= rhost=  user=root
nslu2:/etc/pam.d#


Freeradius -X returns this:

Code:
rlm_pap: Found existing Auth-Type, not changing it.
++[pap] returns noop
  rad_check_password:  Found Auth-Type pam
auth: type "PAM"
+- entering group authenticate
pam_pass: using pamauth string <radiusd> for pam.conf lookup
pam_pass: function pam_authenticate FAILED for <admin>. Reason: Module is unknown
++[pam] returns reject
auth: Failed to validate the user.
Login incorrect: [admin/<removed plaintext password>cccccccjfcevcdukrucdhtedgivcurvkltgufkhkbduc] (from client localhost port 0)
  Found Post-Auth-Type Reject
+- entering group REJECT
        expand: %{User-Name} -> admin
 attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] returns updated
Sending Access-Reject of id 144 to 127.0.0.1 port 48841
Finished request 4.
Going to the next request
Waking up in 4.9 seconds.
Cleaning up request 4 ID 144 with timestamp +197
Ready to process requests.


But looking a lot closer now!
Thanks,
geoff.

Author:  geoffb [ Fri Mar 18, 2011 5:19 pm ]
Post subject:  Re: Yubico-pam with Freeradius

Ok, found a similar post here http://forum.yubico.com/viewtopic.php?f=5&t=132

Also working for me if I set LD_PRELOAD=/lib/libpam.so.0
I'll play around some more, but it's pretty much working now.
Thanks again for your help.

geoff.

Page 1 of 1 All times are UTC + 1 hour
Powered by phpBB® Forum Software © phpBB Group
https://www.phpbb.com/