0

I have installed the pam radius rpm package, and successfully configured /etc/pam.d/sshd, /etc/ssh/sshd_config, & /etc/pam_radius.conf. I know it is working, as i am getting a push notification to my handheld device after i enter my password. When I approve the push notification i am able to log in. My concern is, why am i not being prompted to enter the Verification Code if i don't respond via the out of band notification. Whats even more odd is, on our debian based systems (Ubuntu), it works as expected. Seems only redhat based systems have the issue.

Current Behavior: I am only able to respond out of band to confirm the 2FA authentication. If I fail to respond I am then prompted for the password again, instead of the Verification Code.

CentOS 6 Screen Shot

Expected Behavior: If i fail to respond to the out of band notification (ie phone in airplane mode) ssh should failover and prompt for a "Verification code"

Ubuntu Screen Shot

Thanks in advance.

/etc/ssh/sshd_config

ChallengeResponseAuthentication yes
UsePAM yes

/etc/pam.d/sshd

#%PAM-1.0
auth       sufficient   pam_radius_auth.so

Logfile /var/log/secure

Jan 12 17:26:51 mddirector sshd[9242]: pam_radius_auth: Got user name username
Jan 12 17:26:54 mddirector sshd[9242]: pam_radius_auth: Sending RADIUS request code 1
Jan 12 17:26:54 mddirector sshd[9242]: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned 411494816.
Jan 12 17:27:09 mddirector sshd[9242]: pam_radius_auth: RADIUS server 10.1.69.126 failed to respond
Jan 12 17:27:09 mddirector sshd[9242]: pam_radius_auth: All RADIUS servers failed to respond.
Jan 12 17:27:09 mddirector sshd[9242]: pam_radius_auth: authentication failed
Jan 12 17:27:09 mddirector unix_chkpwd[9303]: password check failed for user (username)
Jan 12 17:27:09 mddirector sshd[9242]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=::1  user=username
Jan 12 17:27:12 mddirector sshd[9240]: error: PAM: Authentication failure for username from ::1
Jan 12 17:27:12 mddirector sshd[9304]: pam_radius_auth: Got user name username
Community
  • 1
Winn
  • 31
  • 2

1 Answers1

2

Thank you all for your help :)

I had to increase the timeout in the pam_radius.conf changed it from 15 to 30.

Winn
  • 31
  • 2