SSH offers a highly secure channel for remote administration of servers. However, if you face an audit for regulatory or business requirements,, you need to be aware of some potential authentication related short-comings that may cause headaches in an audit. For example:
- There is no way to control which users have public key authorization
- There is no way to enforce passphrase complexity (or even be sure that one is being used)
- There is no way to expire a public key
In this document we will show you how to configure SSH for two-factor authentication from WiKID using pam_radius.
Configuring PAM to use pam_radius:
First, you need to install PAM Radius. There is excellent documentation on this at the. Depending on your distribution, you might also be able to find a suitable binary. I had no trouble compiling this on Fedora 7:
# ./configure # make # make install
Edit /etc/pam.d/sshd to allow Radius authentication:
Go to the second line of the file, hit the Insert key or the i key and insert this line:
auth sufficient /lib/security/pam_radius_auth.so
just above this line:
auth required pam_stack.so service=system-auth
The “sufficient” tag indicates that if the Radius authentication succeeds then no additional authentication will be required. However, if the Radius authentication fails, a username and password from the system will work. Use "Required" to require strong authentication. Because we are only editing the sshd file, it will not affect terminal log-ins. PAM can be very different on different linux variants. Consult the specific documentation for your OS.
Configure pam_radius to use WiKID:
Edit or create your /etc/raddb/server file:
Below the line:
127.0.0.1 secret 1
Add this line:
WiKID_server_ip shared_secret 1
Finally, I made sure that PublicKey authentication was turned off in /etc/sshd/sshd_config:
Configure a Network Client for the SSH server:
On the WiKID server web-interface, click Network Clients tab and on "Create a new Network Client".
Enter the information requested. For the IP Address, use the IP address of the SSH target server. Select Radius and the domain you want for this SSH server. Click "Add" when you're finished.
On the next page, enter the shared secret you entered in the /etc/raddb/server file of the target server. Do not have to enter any information under "Return Attributes".
Important: From the WiKID terminal or via SSH, you will need to run "wikidctl stop" and then "wikidcl start" to load the new configuration into the WiKID Radius server. (WiKID 2.0 users just run "stop" and "start".)
Testing your SSH setup
Now, ssh to your target server:
When prompted, enter the WiKID one-time password - it should have automatically been pasted to your clip-board so ctrl-v or shift-ins should work. You should be granted access. If not, there a number of logs to consult. First, check /var/log/secure on your target server to see why the user was rejected. You can also check the WiKID radius log at /opt/WiKID/log/radius.log on the WiKID server or through the logs on the WiKIDADmin interface. You can turn debugging on for Radius on the Configuration >> Enable Protocols >> Radius page.