In this post, we will show how simple it is to configure your Linux server to use credentials stored in your cloud RADIUS.
Firstly, install necessary development tools so we can compile the authentication module.
yum install gcc pam pam-devel make -y
apt-get install make libpam0g-dev
After it’s finished, we will download the source code of the pam_radius package from the original FTP server.
Untar it, move to its directory and compile it:
tar xvzf pam_radius-1.3.17.tar.gz cd pam_radius-1.3.17 make
A new file called “pam_radius_auth.so” should be created.
In CentOS and if you are on the x86_64 arch, copy this file to /lib64/security folder. If you are still on the x86 arch, you want to copy this file to /lib/security/ folder.
On Ubuntu copy the pam_radius_auth.so file to /lib/x86_64-linux-gnu/security/.
Now open up /etc/pam.d/sshd and add the pam_radius_auth.so just before the top line like below in CentOS:
#%PAM-1.0 auth required pam_sepermit.so auth sufficient pam_radius_auth.so auth include password-auth account required pam_nologin.so account include password-auth password include password-auth # pam_selinux.so close should be the first session rule session required pam_selinux.so close session required pam_loginuid.so # pam_selinux.so open should only be followed by sessions to be executed in the user context session required pam_selinux.so open env_params session optional pam_keyinit.so force revoke session include password-auth
In Ubuntu we open up /etc/pam.d/sshd and add the pam_radius_auth.so line at the very top like below, in Ubuntu we also need to comment this line @include common-auth to look like this [email protected] common-auth, see below:
# PAM configuration for the Secure Shell service auth required pam_radius_auth.so # Read environment variables from /etc/environment and /etc/security/pam_env.conf. auth required pam_env.so #  # In Debian 4.0 (etch), locale-related environment variables were moved to /etc/default/locale, so read that as well. auth required pam_env.so envfile=/etc/default/locale # Standard Un*x authentication. [email protected] common-auth # Disallow non-root logins when /etc/nologin exists. account required pam_nologin.so
Save it and create a directory called “raddb” in /etc/ – you also want to create a file called “server” and place this into the folder you just created “raddb.”
Edit the file “server” and add the following:
mkdir /etc/raddb echo "your_radius_ip:radius_port your_radius_secret 3" > /etc/raddb/server
So it would look something like this:
220.127.116.11:4123 dfk34Jdf 3
Now you should be able to access your Linux box with credentials managed in the Cloud RADIUS.
The last thing that has to be done is create a user on the local system like below:
useradd -d /home/user1/ user1
We don’t add any password for this user, this is where Hosted RADIUS comes in, you will need to use a password match in IronWifi RADIUS for this username.