-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
The first question is whether the pam_radius_auth module returns
different status in these two situations.
Let's say it returns three things:
PAM_AUTHINFO_UNVAIL imlpying that the RADIUS server is down.
PAM_SUCCESS implying that a good password was entered
* ie., something else which means RADIUS knows it doesn't like you..
The following 'auth' config should work:
auth [success=done authinfo_unavail=ignore default=die] \
pam_radius_auth.so
auth required pam_unix_auth.so try_first_pass
I'm not sure whether requiring radius connectivity for the account and
session parts may require some special handling too, but this info
should help get you on the right track.
When you get it working, share your config file.. :-)
More info on the '[...]' config syntax is here:
http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/sag-configuration-file.html
Cheers
Andrew
Ken Partridge wrote:
> Hi All,
>
> I have just a simplistic RADIUS pam file
>
> # /etc/pam.d/login
> #RADIUS_CONFIGURATION
> auth sufficient pam_radius_auth.so
> auth sufficient pam_unix_auth.so try_first_pass
> account required pam_radius_auth.so
> password required pam_radius_auth.so
>
> The only way I want pam_unix_auth.so to execute is if the RADIUS server
> is down, if the user entered a wrong password for the user on the RADIUS
> server, I don't want pam_unix_auth.so to execute.
>
> So basically I need to be able to tell if the login failed either from a
> bad password or the RADIUS server was down. If the RADIUS server is
> down, I need the user to log on locally. If the RADIUS server is running
> and it was just a bad password, I want the process to fail and never try
> locally.
>
> Thanks
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)
iD8DBQFF+Y03QheEq9QabfIRAhT7AJ4kxIafyurwZbBEubi6TBesu10BYACeK0n4
Sk703Guz8iCMYDM4IEowMKA=
=3b68
-----END PGP SIGNATURE-----
_______________________________________________
Pam-list mailing list
Pam-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/pam-list
