SSHD and HP-UX PAM RADIUS issue

[gobhp]

Hi,

I'm trying to configure an HP-UX 11i v3 server to authenticate users with a RADIUS server through PAM. The RADIUS server is up and running and working properly. However, I'm having issues with my client. I configured PAM on it to use the HP-UX PAM RADIUS module for different applications such as su, login and sshd. All applications work properly, except sshd. When a user tries to authenticate through ssh, I get the following errors:

pam_radius_auth: Error sending RADIUS packet to server aaa.bbb.ccc.ddd:1812: Error 0

(0 appears to be the value returned by the sendto method called at line 1209 of pam_radius_auth.c)

I did a tcpdump to see if packets were being sent over the network. When authenticating through ssh, no packets at all are sent over the network. When I authenticate through any other app, I can see a normal RADIUS exchange between the HP-UX server and the RADIUS server.

What could be causing this error to happen when using ssh and not the other applications? The error code returned is not very descriptive, so any input might help!

Thanks.

[Horia Chirculescu]

Hello,

Maybe you could check the version of your sshd daemon and install a new version.

Read the Changelog file of the latest sshd version.

Best regards,
Horia.

[gobhp]

Hi,

I updated to the most recent version of sshd, but unfortunately, it did not resolve the issue. Still, thanks for the suggestion!

[F Verschuren]

Iam fasing simmular problems when conecting whit telnet it works fine but using ssh there is no interation whit the redius server, dit you already fount a solution for this problem?

[gobhp]

No, the problem hasn't been resolved yet. A case has been opened with HP. I'll let you know once I have a solution.

[AlAwami]

Hi,

I have the same issue.

Please let us know the solution when you get it.

Thanks

[gobhp]

I was using IP adresses in my /etc/raddb/server file. A workaround is to use the FQDN of the RADIUS servers. This solved the problem for me.

It appears this may be a bug in the 64-bit version of the libpam_radius.so.1 shared object.

[F Verschuren]

This was also the solution for me.

Tankts.

Ps a other sugestion that I got was to recompile ssh so it will go directly to raduis (whitout using pam). But I think this is a match better solution du to ssh upgrades in the future...

[gobhp]

A FQDN should be used to define the RADIUS server in the /etc/raddb/server file. Using an IP address caused the issue.