summaryrefslogtreecommitdiff
path: root/src/pam-configs/radius-mandatory
diff options
context:
space:
mode:
authorzsdc <taras@vyos.io>2023-09-13 12:41:04 +0300
committerzsdc <taras@vyos.io>2023-09-13 20:41:43 +0300
commit5181ab60bb6d936505967d6667adc12c5ecb9b64 (patch)
tree1d6c36fd180f75dcf60a715f268ed3221a2d9693 /src/pam-configs/radius-mandatory
parent4ebbab2a3fed34db7ebe5c5a3e4e955e2ebed36b (diff)
downloadvyos-1x-5181ab60bb6d936505967d6667adc12c5ecb9b64.tar.gz
vyos-1x-5181ab60bb6d936505967d6667adc12c5ecb9b64.zip
RADIUS: T5577: Added `mandatory` and `optional` modes for RADIUS
In CLI we can choose authentication logic: - `mandatory` - if RADIUS answered with `Access-Reject`, authentication must be stopped and access denied immediately. - `optional` (default) - if RADIUS answers with `Access-Reject`, authentication continues using the next module. In `mandatory` mode authentication will be stopped only if RADIUS clearly answered that access should be denied (no user in RADIUS database, wrong password, etc.). If RADIUS is not available or other errors happen, it will be skipped and authentication will continue with the next module, like in `optional` mode.
Diffstat (limited to 'src/pam-configs/radius-mandatory')
-rw-r--r--src/pam-configs/radius-mandatory19
1 files changed, 19 insertions, 0 deletions
diff --git a/src/pam-configs/radius-mandatory b/src/pam-configs/radius-mandatory
new file mode 100644
index 000000000..43b6bd3e0
--- /dev/null
+++ b/src/pam-configs/radius-mandatory
@@ -0,0 +1,19 @@
+Name: RADIUS authentication (mandatory mode)
+Default: no
+Priority: 576
+
+Auth-Type: Primary
+Auth-Initial:
+ [default=ignore success=end perm_denied=bad auth_err=bad] pam_radius_auth.so
+Auth:
+ [default=ignore success=end perm_denied=bad auth_err=bad] pam_radius_auth.so use_first_pass
+
+Account-Type: Primary
+Account:
+ [default=ignore success=1] pam_succeed_if.so user notingroup radius quiet
+ [default=ignore new_authtok_reqd=done success=end perm_denied=bad auth_err=bad] pam_radius_auth.so
+
+Session-Type: Additional
+Session:
+ [default=ignore success=1] pam_succeed_if.so user notingroup radius quiet
+ [default=ignore success=ok perm_denied=bad auth_err=bad] pam_radius_auth.so