[Proftpd-user] mod_radius login issue

Hello mailing list!

This may be a configuration issue but I was not able to figure this out based on the documentation on my own. Any input would be helpful because I am out of ideas what goes wrong here.

First about the scenario: I have to create an sftp server where the users are authenticated against an external RADIUS server. The RADIUS service has a different owner than my sftp service, and basically the configuration should be that we trust the RADIUS server and let the owner of it add and remove users. They don't maintain anything UID/GID/home/shell related info, I just have a yes/no answer from them and map all their users to a single technical user on the sftp service. (I also should serve technical users with pubkey authentication, that is why mod_auth_unix.c is needed beside mod_radius.c.)

Here comes proftpd with mod_sftp and mod_radius. According to the documentation, mod_radius has the RadiusUserInfo and RadiusGroupInfo directives that can be used for such a mapping.

Everything seems working at first, when the user is logging in with the good password, everything is working as expected (for testing I am running a local FreeRADIUS instance):

[root@localhost ~]# sftp -P 2222 [email protected]
[email protected]'s password: [good password]
Connected to 10.0.2.15.
sftp>

But when the first try fails, no matter that the user is trying the correct password the second time, the login fails:

[root@localhost ~]# sftp -P 2222 [email protected]
[email protected]'s password: [wrong password]
Permission denied, please try again.
[email protected]'s password:  [good password]
Permission denied, please try again.
[email protected]'s password:  [good password]
Permission denied (password,publickey).
Couldn't read packet: Connection reset by peer

I checked it and FreeRADIUS sends back an Accept packet for both tries above so from FreeRADIUS point of view the authentication was successful. The proftpd log contains message No account found for bob.

Here I was suspicious about the RadiusUserInfo mapping, so I commented out this part of the config, using only the other parts of the RADIUS setup, and created a local user for bob, so I have the UID/GID/home/shell from /etc/passwd and the password is in FreeRADIUS. Now the login works as expected.

The crucial part of the configuration is:

    RadiusUserInfo 1000 1000 /jail /bin/bash
    RadiusGroupInfo techgroup sftponly 1001
    
Where I made sure that these values are correct, meaning /etc/passwd and /etc/group contains the same exact information. 

Version: CentOS with 1.3.5e but I compiled the latest master from github and that version acts the same.

The full config is here below:

LoadModule mod_sftp.c
LoadModule mod_radius.c

AuthOrder mod_radius.c mod_auth_unix.c
DefaultAddress 10.0.2.15
Port 2222
SocketBindTight on
ServerType standalone
User proftpd
Group proftpd
RequireValidShell no
DefaultRoot /jail
CreateHome off
ServerLog /var/log/proftpd/server.log
AllowOverwrite on
Umask 0002
AuthPAM off
<IfModule mod_sftp.c>
    SFTPEngine on
    SFTPAuthMethods password publickey
    SFTPAuthorizedUserKeys file:/etc/proftpd/authorized_keys/%u
    SFTPClientAlive 10 30
    SFTPCompression delayed
    SFTPHostKey  /etc/proftpd/ssh_host_rsa_key
    SFTPLog /var/log/proftpd/sftp.log
</IfModule>
<IfModule mod_radius.c>
    RadiusEngine on
    RadiusAuthServer localhost:1812 testing123 10
    RadiusLog /var/log/proftpd/radius.log
    RadiusNASIdentifier myservice
    RadiusUserInfo 1000 1000 /jail /sbin/bash
    RadiusGroupInfo techgroup sftponly 1001
</IfModule>

Thank you for your time, regards

-- 
Attila GOLONCSER | [email protected]



_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html