Implementation Guide PAM RADIUS

DualShield
for
PAM RADIUS
Implementation Guide
(Version 5.4)

Copyright 2012
Deepnet Security Limited

Copyright 2012, Deepnet Security. All Rights Reserved. Page 1

Implementation Guide PAM RADIUS

Trademarks

Deepnet Unified Authentication, MobileID, QuickID, PocketID, SafeID, GridID, FlashID,

SmartID, TypeSense, VoiceSense, MobilePass, DevicePass, RemotePass and Site Stamp
are trademarks of Deepnet Security Limited. All other brand names and product names
are trademarks or registered trademarks of their respective owners.

Copyrights

Under the international copyright law, neither the Deepnet Security software or
documentation may be copied, reproduced, translated or reduced to any electronic
medium or machine readable form, in whole or in part, without the prior written consent
of Deepnet Security.

Licence Conditions

Please read your licence agreement with Deepnet carefully and make sure you
understand the exact terms of usage. In particular, for which projects, on which
platforms and at which sites, you are allowed to use the product. You are not allowed to
make any modifications to the product. If you feel the need for any modifications, please
contact Deepnet Security.

Disclaimer

This document is provided as is without warranty of any kind, either expressed or

implied, including, but not limited to, the implied warranties of merchantability, fitness
for a particular purpose, or non-infringement.

This document could include technical inaccuracies or typographical errors. Changes are
periodically made to the information herein; these changes will be incorporated in new
editions of the document. Deepnet Security may make improvements of and/or changes
to the product described in this document at any time.

Contact

If you wish to obtain further information on this product or any other Deepnet Security
products, you are always welcome to contact us.

Deepnet Security Limited

Northway House
1379 High Road
London N20 9LP
United Kingdom

Tel: +44(0)20 8343 9663

Fax: +44(0)20 8446 3182
Web: www.deepnetsecurity.com
Email: [email protected]

Copyright 2012, Deepnet Security. All Rights Reserved. Page 2

Implementation Guide PAM RADIUS

Table of Contents

Overview ......................................................................................... 4
RedHat Fedora - CentOS ................................................................. 5
Installation ........................................................................................................ 5
Configuration ..................................................................................................... 5

Ubuntu ............................................................................................ 6
Installation ........................................................................................................ 6
Configuration ..................................................................................................... 6

Compile & Install PAM RADIUS module manually .................................. 7

Troubleshooting ............................................................................... 8

Copyright 2012, Deepnet Security. All Rights Reserved. Page 3

Implementation Guide PAM RADIUS

Overview
DualShield can be easily added to any Linux and Unix system to protect remote or local
logins with two-factor authentication via the PAM RADIUS module. Due to the limitations
in RADIUS authentication protocol, only one-time password (OTP) based authentication
methods are supported.

DualShield provides a wide selection of portable OTP tokens in a variety of form factors,
ranging from hardware tokens, software tokens, mobile tokens to USB tokens. These
include:

Deepnet SafeID
Deepnet MobileID
Deepnet GridID
Deepnet CryptoKey
RSA SecurID
VASCO DigiPass Go
OATH-compliant OTP tokens

In addition to the support of one-time password, DualShield also supports on-demand

password for VPN authentication. The product that provides on-demand password in the
DualShield platform is Deepnet T-Pass. Deepnet T-Pass is an on-demand, token-less
strong authentication that delivers logon passwords via SMS texts, phone calls, twitter
direct messages or email messages.
The complete solution consists of the following components:

DualShield Authentication Server

DualShield Radius Server
PAM RADIUS module

For the general instructions of installation and configuration of the DualShield

Authentication Server, please refer to the following documents:

DualShield Unified Authentication Platform Installation Guide

DualShield Unified Authentication Platform Quick Start Guide
DualShield Unified Authentication Platform Administration Guide

For the general instructions of installation and configuration of the DualShield RADIUS
Server, please refer to the following documents:

VPN & RADIUS - Implementation Guide

Copyright 2012, Deepnet Security. All Rights Reserved. Page 4

Implementation Guide PAM RADIUS

RedHat Fedora - CentOS

Installation
To install the PAM RADIUS module on RedHat, Fedora or CentOS, run the command
below:

$ sudo yum install pam_radius

Configuration
Once the PAM RADIUS module has been successfully installed, you will need to edit the
file: /etc/pam_radius.conf

$ sudo vi /etc/pam_radius.conf

Modify the line below:

other-server other-secret 3

Change other-server to the IP address of your DualShield RADIUS server, other-

secret to the shared secret.

Now, the configuration of the PAM RADIUS module is done. To enable the module for an
application, you need to edit the configuration file in the /etc/pam.d directory. For
examples, to protect the GDM (GNOME Display Manager) GUI login, you need to edit the
file /etc/pam.d/gdm-password. To protect the SSH login, you need to edit the file
/etc/pam.d/sshd.

1. open the configuration file /etc/pam.d/gdm-password or /etc/pam.d/sshd, in a

text editor

2. locate the line below:

auth substack password-auth

3. insert the line below:

auth sufficient pam_radius_auth.so

i.e.

auth sufficient pam_radius_auth.so

auth substack password-auth

Copyright 2012, Deepnet Security. All Rights Reserved. Page 5

Implementation Guide PAM RADIUS

Ubuntu

Installation
To install the PAM RADIUS module on Ubuntu, run the command below:

$ sudo apt-get install libpam-radius-auth

Configuration
Once the PAM RADIUS module has been successfully installed, you will need to edit the
file: /etc/pam_radius_auth.conf

$ sudo vim /etc/pam_radius_auth.conf

Change other-server to the IP address of your DualShield RADIUS server, other-

secret to the shared secret.

Now, the configuration of the PAM RADIUS module is done. To enable the module for an
application, you need to edit the configuration file in the /etc/pam.d directory. For
examples, to protect the GDM (GNOME Display Manager) GUI login, you need to edit the
file /etc/pam.d/gdm-password. To protect the SSH login, you need to edit the file
/etc/pam.d/sshd.

1. open the configuration file /etc/pam.d/gdm-password or /etc/pam.d/sshd, in a

text editor

2. locate the line below:

# Standard Un*x authentication.

@include common-auth

3. insert the line below:

auth sufficient pam_radius_auth.so

i.e.

auth sufficient pam_radius_auth.so

# Standard Un*x authentication.
@include common-auth

Copyright 2012, Deepnet Security. All Rights Reserved. Page 6

Implementation Guide PAM RADIUS

Compile & Install PAM RADIUS module manually

If you have to manually compile the PAM RADIUS module for your Linux or Unix system,
follow the instructions below:

1. Download

Download latest PAM RADIUS source code from

http://freeradius.org/pam_radius_auth/

2. Build

Extract and build it

$ tar -zxvf pam_radius-1.3.17.tar.gz

$ cd pam_radius-1.3.17

$ make

3. Install

Copy 'pam_radius_auth.so' to /lib/security/pam_radius_auth.so or /lib64/

security/pam_radius_auth.so if you are using 64-bit linux

$ sudo cp pam_radius_auth.so /lib/security/

4. Configuration

The configuration of the PAM RADIUS module is similar on all Linux distributions.
Please refer to previous examples.

Copyright 2012, Deepnet Security. All Rights Reserved. Page 7

Implementation Guide PAM RADIUS

Troubleshooting

1. If SELinux is enforced, with some old selinux versions, when you enable
pam_radius_auth for SSH login, selinux may block the sshd from binding udp port.
To work around it:

https://bugzilla.redhat.com/show_bug.cgi?id=647043

Create a file named mysshd.te with the content below:

policy_module(mysshd, 1.0)

gen_require(`

type sshd_t;

')

corenet_udp_bind_all_unreserved_ports(sshd_t)

Then execute the following commands

$ make -f /usr/share/selinux/devel/Makefile

$ semodule -i mysshd.pp

2. Check the log file is always helpful:

$ sudo tail -f /var/log/auth.log

or

$ sudo tail -f /var/log/messages

3. You can also enable the debug log for pam_radius_auto.so, for example:

auth sufficient pam_radius_auth.so debug

4. It is possible to use different configuration file for pam_radius_auto.so, e.g.

auth sufficient pam_radius_auth.so debug conf=/etc/raddb/server

Copyright 2012, Deepnet Security. All Rights Reserved. Page 8