Re: ..:: VSFTP - PAM - RADIUS ::..

Alfonso Alejandro Reyes Jiménez <[email protected]>
Newsgroups gmane.linux.pam
Message-ID <[email protected]>
On 9/18/12 8:04 AM, Nick Owen wrote:
> On Mon, Sep 17, 2012 at 6:30 PM, Alfonso Alejandro Reyes Jiménez
> <[email protected]>  wrote:
>> Hi everyone.
>>
>> I'm trying to use PAM and my radius server in order to authenticate de users
>> of our vsftp server, right now I'm able to get the access accept from the
>> radius but PAM seems not to understand it.
>>
>> Here's my pam configuration:
>>
>> #%PAM-1.0
>> auth sufficient pam_radius_auth.so debug
>> account sufficient pam_radius_auth.so debug
>> session    optional     pam_keyinit.so    force revoke
>> auth       required     pam_listfile.so item=user sense=deny
>> file=/etc/vsftpd/ftpusers onerr=succeed
>> auth       required     pam_shells.so
>> auth       include      password-auth
>> account    include      password-auth
>> session    required     pam_loginuid.so
>> session    include      password-auth
>>
>> Here's the PAM debug log:
>>
>> Sep 14 10:59:10 CRM vsftpd[9643]: pam_radius_auth: Sending RADIUS request
>> code 1
>> Sep 14 10:59:10 CRM vsftpd[9643]: pam_radius_auth: DEBUG:
>> getservbyname(radius, udp) returned 10657568.
>> Sep 14 10:59:10 CRM vsftpd[9643]: pam_radius_auth: Got RADIUS response code
>> 2
>> Sep 14 10:59:10 CRM vsftpd[9643]: pam_radius_auth: authentication succeeded
>> Sep 14 10:59:45 CRM vsftpd[9670]: pam_radius_auth: Got user name adgalvanh
>> Sep 14 10:59:46 CRM vsftpd[9670]: pam_radius_auth: Sending RADIUS request
>> code 1
>> Sep 14 10:59:46 CRM vsftpd[9670]: pam_radius_auth: DEBUG:
>> getservbyname(radius, udp) returned 7122720.
>> Sep 14 10:59:46 CRM vsftpd[9670]: pam_radius_auth: Got RADIUS response code
>> 2
>> Sep 14 10:59:46 CRM vsftpd[9670]: pam_radius_auth: authentication succeeded
>>
>> The vsftp has the value:
>>
>>   pam_service_name=vsftpd
>>
>> On the vsftp log I got the OK LOGIN:
>> Mon Sep 17 17:28:05 2012 [pid 12728] FTP response: Client "172.16.101.100",
>> "220-###############################################################"
>> Mon Sep 17 17:28:05 2012 [pid 12728] FTP response: Client "172.16.101.100",
>> "220-Todo acceso a este equipo es restringido y monitoreado, toda"
>> Mon Sep 17 17:28:05 2012 [pid 12728] FTP response: Client "172.16.101.100",
>> "220-actividad es ingresada a una bitacora."
>> Mon Sep 17 17:28:05 2012 [pid 12728] FTP response: Client "172.16.101.100",
>> "220-###############################################################"
>> Mon Sep 17 17:28:05 2012 [pid 12728] FTP response: Client "172.16.101.100",
>> "220"
>> Mon Sep 17 17:28:05 2012 [pid 12728] FTP command: Client "172.16.101.100",
>> "AUTH TLS"
>> Mon Sep 17 17:28:05 2012 [pid 12728] FTP response: Client "172.16.101.100",
>> "234 Proceed with negotiation."
>> Mon Sep 17 17:28:05 2012 [pid 12728] DEBUG: Client "172.16.101.100", "SSL
>> version: TLSv1/SSLv3, SSL cipher: AES128-SHA, not reused, no cert"
>> Mon Sep 17 17:28:05 2012 [pid 12728] FTP command: Client "172.16.101.100",
>> "USER aareyes"
>> Mon Sep 17 17:28:05 2012 [pid 12728] [aareyes] FTP response: Client
>> "172.16.101.100", "331 Please specify the password."
>> Mon Sep 17 17:28:05 2012 [pid 12728] [aareyes] FTP command: Client
>> "172.16.101.100", "PASS<password>"
>> Mon Sep 17 17:28:05 2012 [pid 12727] [aareyes] OK LOGIN: Client
>> "172.16.101.100"
>>
>> But I can't connect from my FTP client:
>>
>> CYBERDUCK
>>
>> I/O Error: Connection failed
>> Unsupported record version Unknown-48.48.
>>
>> FILEZILLA
>>
>> Status:    Waiting to retry...
>> Status:    Connecting to 172.16.18.113:21...
>> Status:    Connection established, waiting for welcome message...
>> Response:
>> 220-###############################################################
>> Response:    220-Todo acceso a este equipo es restringido y monitoreado,
>> toda
>> Response:    220-actividad es ingresada a una bitacora.
>> Response:
>> 220-###############################################################
>> Response:    220
>> Command:    AUTH TLS
>> Response:    234 Proceed with negotiation.
>> Status:    Initializing TLS...
>> Status:    Verifying certificate...
>> Command:    USER aareyes
>> Status:    TLS/SSL connection established.
>> Response:    331 Please specify the password.
>> Command:    PASS **************
>> Error:    GnuTLS error -8: A record packet with illegal version was
> Seems like an SSL/TLS error in your certs SFTP server rather than a PAM error.
>
> --
> Nick Owen
> WiKID Systems, Inc.
> http://www.wikidsystems.com
> Commercial/Open Source Two-Factor Authentication
>
> _______________________________________________
> Pam-list mailing list
> [email protected]
> https://www.redhat.com/mailman/listinfo/pam-list


Thanks for your reply, the issue is now solved. I had to use the 
ssl_ciphers=HIGH command.

Have a great day.

Regards.

Alfonso.
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.