Configuring sshd to support RADIUS Authentication

Step 1 – Run apt-get install libpam-radius-auth to install the PAM Radius Authentication Module (pam_radius_auth).

Step 2 – Configure sshd for RADIUS Authentication by editing /etc/pam.d/sshd and adding the following line as the second line of the file:

Note: If you need more verbose output, you can add the word debug to this line so that it reads:

You may also need to comment out the following line so that the system does not attempt to authenticate via standard Un*x password authentication even after a successful RADIUS Authentication.

Step 3 – Edit the file /etc/pam_radius_auth.conf (/etc/raddb/server on some systems) and under the line:

Add the line:

Where IP_address is the IP address (and port, if using a RADIUS port other than the port defined in /etc/services) of your RADIUS server, shared_secret is the shared secret and timeout is the timeout value in seconds.

Step 4 – Run /etc/init.d/ssh restart to restart the SSH daemon.

Step 5 - Log into the system via SSH and when it prompts for a username and password, enter your username in the username field and your AuthAnvil PIN + OTP in the password field.

Note: This configuration only protects SSH. A console logon or graphical logon will still use the regular Linux password only. Due to the configurable nature of PAM, authentication for any login method can be strengthened by editing the appropriate configuration files.

Other Configurations

For assistance with other configurations, including manually building and configuring the module, check out FreeRADIUS.org’s usage guide for the PAM Authentication and Accounting module.This guide includes a sample configuration file for other configurations, as well as other usage instructions.

Questions?

If you have any questions or need some help, we would be happy to assist. Open a case at help.scorpionsoft.com or send an email to support@scorpionsoft.com.