Good Day, I am making an attempt to setup sudo authentication on a Centos 5.2 server to work with pam_radius_auth. I rwant ldap to handle my regular users (this works already) and I want my privileged users to authenticate through radius when they use sudo. I put the below in /etc/pam.d/sudo and it seems to work fine, except that I need an entry in /etc/shadow for any user who sudos. If i remove the user from /etc/shadow then I get a loop back to the radius authentication. If I remove the pam_unix.so entry for auth then I also get a loop back asking for a password when the radius server Accepted it. Any ideas?
/etc/pam.d/sudo auth required pam_env.so auth required /lib/security/pam_radius_auth.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth required pam_deny.so account required pam_unix.so broken_shadow account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_ldap.so account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_ldap.so session required pam_mkhomedir.so skel=/etc/skel/ umask=0077 Thanks, Megan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html