Configure Radius Authentication for SSH login Centos 5.* Linux

Introduction

Using the plug-in modular nature of PAM we can get a linux server to use RADIUS to authenticate users connecting via SSH. This guide tells you how to setup a Centos 5.2 server as your Radius "client" and Juniper Steel-Belted as your radius server authentication "server". We are going to use the pam_radius_module from free radius to provide the mechanism of authenticating ssh logins against a radius box. For this example my environment consists of A centos 5.2 radius client called "cyclone" A Steel-Belted Radius server is called "turbo" A username of dave Of course you will change these silly names to the hostnames or ip addresses that suit your own setup.

Preparation

We have to to build a radius client module for our centos linux server so some preperation is required on this box to enable us to do that. It isn't as complex as it sounds.

Install the correct development tools

Since the pam_radius_auth security module is not available in mighty yum repository we have to make this ourselves using the source files. To do this we need the correct C compiler this can be installed via yum using the following command yum install gcc-c++ After a little while the C compiler will be installed an ready for use. The next requirement is the pam development module. This is also installed via yum with this command: yum install pam-devel

Download the pam Radius source files.

You need to download the radius pam module here ftp://ftp.freeradius.org/pub/radius/ Choose the file pam_radius-1.3.17.tar.gz This is done easily via the wget command. So from the centos machine run wget ftp://ftp.freeradius.org/pub/radius/pam_radius-1.3.17.tar.gz download this to a temporary folder where you can build the software from I chose a directory called pam under my root users home directory Once the file is downloaded unzip the file with gunzip using the command gunzip /root/pam/pam_radius-1.3.17.tar.gz <return> untar the file using the command change to this directory and type the system should then compile with something like the following output: this should create a file called pam_radius_auth.so copy this to the /lib/security/ folder.

Configure the Centos Server to use radius Authentication

Create a user you wish to login as, on the centos system. I am creating one called "dave" for this example.

NOTE: There is no reason to set a password to this unix user as you will be using your radius account to provide the password.

Create the radius client configuration file folder structure.

Create a directory under the /etc folder called raddb. So you have a directory path which looks like /etc/raddb This is done like so

Edit the /etc/raddb/server to match the radius server "turbo".

open the /etc/raddb/server in an editor such as vi Under the section that looks like: Add a line that represents your radius server. You will need to enter your servers hostname or IP address and a sharesecret that you will need to assign in this file and on your radius server. So make a note of this password. I am going to add my radius server "turbo" and specify a shared secret of "s3cret". So after editing my file looks like this Now edit the /etc/pam.d/sshd file. This file controls the authentication method for sshd service which facilitates SSH logins. We need to tell it to use the /lib/security/pam_radius_auth.so file we created compiled earlier. Before the top line add this line so the first two lines will look like this This will tell the SSH service / daemon to use the radius protocol and server for authentication. With this configuration the SSHD will also check local system sccount passwords as a fall back. This means you can log in as root or other unix local accounts should your radius server be off line. NOTE! You are changing the authentication method for logging in to your centos box via SSH. Make sure you can get into it via console (monitor mouse and keyboard) in case this goes wrong and you get locked out of SSH

Configure your Steel Belted Radius Server

Setup Cyclone as a radius client Right "Click Radius Clients" Click ADD In the Add RADIUS client window add the IP address or hostname of the centos cyclone box and add the shared secret we decided on earlier in this example "s3cret"

Add a username on the radius box "turbo"

Right Click "users" Click Add Add a native user and set a password.

Test a Logon to the Centos SSH service

Fire up your SSH client Connect to the box and login as the user and password you set on radius server earlier. In my case "dave" If it lets you voila - job done. You have used the radius server to provide SSH authentication. If it doesn't then you might start by looking in the /var/log/secure/file for clues. Also the centos forum is pretty good I often find some helpful people on there - if you are really desperate you can leave a comment here! :)