openssh unix dev - Jun 2010 - PAM Module:Openssh and Tacacs+ Question

Hi,

I am trying to get Openssh 5.5p1 to work with TACACS+. I have the TACACS
+ PAM module compiled on Ubuntu. I have compiled SSH --with-pam.

When the user is defined in /etc/passwd, the SSH authentication to the
TACACS+ server takes place successfully.

If I REMOVE the user from /etc/passwd OpenSSH sends a string called
INCORRECT to the TACACS+ server and it denies authentication.

I am trying not to have a local definition of the user in /etc/passwd. 

I have the following lines in my /etc/pam.d/sshd

auth	sufficient	/lib/security/pam_tacplus.so debug server=x.x.x.x
secret=xxxxxx encrypt login=chap prompt=Enter_TACACS_Password: first_hit
auth	required	/lib/security/pam_unix_auth.so use_first_pass

I looked at the source code of openssh 5.5p1.

auth-pam.c has this:
badpw[] = "\b\n\r\177INCORRECT";

When the user is deleted from /etc/passwd SSH complains saying:

sshd: error: PAM: user not known to the underlying authentication module for
illegal user **** from *****
sshd: Failed Keyboard-interactive/pam for invalid user ***** from ***** poer
***** sh2
sshd: PAM_SM_authenticate: called pam_tacplis v1.3.2
sshd: pam_SM_authenticate: user [******] obtained
sshd: tacacs_get_password: called --> debugging revealed that it sent
"\b\n\r\177INCORRECT" to TACACS+


How can I make SSH use the pam_tacplus module and not look at /etc/passwd or
LDAP?

http://sourceforge.net/projects/tacplus/ has the TACACS+ module source.

Thanks in advance.

Ajay

On 06/30/2010 03:05 PM, TCPWave Customer Care wrote:
> I am trying to get Openssh 5.5p1 to work with TACACS+. I have the TACACS
> + PAM module compiled on Ubuntu. I have compiled SSH --with-pam.
I think you need to consider both PAM (for authentication) and the name
service switch (for directory lookup).

is it possible that your system does not know about the user with the
given name?

for example, if you are trying to log in as "test0", does your system
have a numeric ID to associate with that user?

if not, ssh won't know how to switch to it.

Usually, if you don't want to add the account explicitly to /etc/passwd
(and the other associated UNIX system files) this is done by using a
name service switch (NSS) extension, such as libnss-ldap, NIS+, etc.
But you have said you don't want to use LDAP either.  Is there a libnss
TACACS+ ?  are you using it?

Most modern GNU/Linux systems support getent(1).  What happens if you run:

 getent passwd test0

? (assuming the user you're trying is test0).  this should return a
"virtual" line you'd expect to see in /etc/passwd (though its
source
might actually be from some NSS plugin).

If the result is an empty string (and the return code is anything other
than 0), then no such user account is available.  In that case, it
doesn't matter whether PAM authentication works, because sshd has no
account to switch to once the login is completed anyway.

hth,

	--dkg

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 892 bytes
Desc: OpenPGP digital signature
URL:
<http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20100630/939ef0a7/attachment.bin>