From c365d0229b9e3ed51e42bd88a8039478d4360711 Mon Sep 17 00:00:00 2001 From: mazora Date: Mon, 24 Jun 2024 14:45:24 +0300 Subject: [PATCH 1/3] Add require_message_authenticator to configuration if server has this option enabled. --- data/templates/common-auth-sonic.j2 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/data/templates/common-auth-sonic.j2 b/data/templates/common-auth-sonic.j2 index fa68e613..45a93bcc 100644 --- a/data/templates/common-auth-sonic.j2 +++ b/data/templates/common-auth-sonic.j2 @@ -32,7 +32,7 @@ auth [success=1 default=ignore] pam_unix.so nullok try_first_pass auth [success=done new_authtok_reqd=done default=ignore{{ ' auth_err=die maxtries=die' if not auth['failthrough'] }}] pam_unix.so nullok try_first_pass # For the RADIUS servers, on success jump to the cacheing the MPL(Privilege) {% for server in servers %} -auth [success={{ (servers | count) - loop.index0 }} new_authtok_reqd=done default=ignore{{ ' auth_err=die' if not auth['failthrough'] }}] pam_radius_auth.so conf=/etc/pam_radius_auth.d/{{ server.ip }}_{{ server.auth_port }}.conf privilege_level protocol={{ server.auth_type }} retry={{ server.retransmit }}{% if server.nas_ip is defined %} nas_ip_address={{ server.nas_ip }}{% endif %}{% if server.nas_id is defined %} client_id={{ server.nas_id }}{% endif %}{% if debug %} debug{% endif %}{% if trace %} trace{% endif %}{% if server.statistics %} statistics={{ server.ip }}{% endif %} try_first_pass +auth [success={{ (servers | count) - loop.index0 }} new_authtok_reqd=done default=ignore{{ ' auth_err=die' if not auth['failthrough'] }}] pam_radius_auth.so conf=/etc/pam_radius_auth.d/{{ server.ip }}_{{ server.auth_port }}.conf privilege_level protocol={{ server.auth_type }} retry={{ server.retransmit }}{% if server.nas_ip is defined %} nas_ip_address={{ server.nas_ip }}{% endif %}{% if server.nas_id is defined %} client_id={{ server.nas_id }}{% endif %}{% if debug %} debug{% endif %}{% if trace %} trace{% endif %}{% if server.statistics %} statistics={{ server.ip }}{% endif %}{% if server.require_message_authenticator %} require_message_authenticator {% endif %} try_first_pass {% endfor %} auth requisite pam_deny.so # Cache MPL(Privilege) @@ -60,7 +60,7 @@ auth [success=1 default=ignore] pam_exec.so /usr/sbin/cache_radius auth [success={{ (servers | count) + 2 }} default=ignore] pam_succeed_if.so user = root # For the RADIUS servers, on success jump to the cache the MPL(Privilege) {% for server in servers %} -auth [success={{ (servers | count) - loop.index0 }} new_authtok_reqd=done default=ignore{{ ' auth_err=die' if not auth['failthrough'] }}] pam_radius_auth.so conf=/etc/pam_radius_auth.d/{{ server.ip }}_{{ server.auth_port }}.conf privilege_level protocol={{ server.auth_type }} retry={{ server.retransmit }}{% if server.nas_ip is defined %} nas_ip_address={{ server.nas_ip }}{% endif %}{% if server.nas_id is defined %} client_id={{ server.nas_id }}{% endif %}{% if debug %} debug{% endif %}{% if trace %} trace{% endif %}{% if server.statistics %} statistics={{ server.ip }}{% endif %} try_first_pass +auth [success={{ (servers | count) - loop.index0 }} new_authtok_reqd=done default=ignore{{ ' auth_err=die' if not auth['failthrough'] }}] pam_radius_auth.so conf=/etc/pam_radius_auth.d/{{ server.ip }}_{{ server.auth_port }}.conf privilege_level protocol={{ server.auth_type }} retry={{ server.retransmit }}{% if server.nas_ip is defined %} nas_ip_address={{ server.nas_ip }}{% endif %}{% if server.nas_id is defined %} client_id={{ server.nas_id }}{% endif %}{% if debug %} debug{% endif %}{% if trace %} trace{% endif %}{% if server.statistics %} statistics={{ server.ip }}{% endif %}{% if server.require_message_authenticator %} require_message_authenticator {% endif %} try_first_pass {% endfor %} auth requisite pam_deny.so # Cache MPL(Privilege) From b95348f6dd6873cb371d7fa024daad56185a621a Mon Sep 17 00:00:00 2001 From: mazora Date: Mon, 24 Jun 2024 15:19:22 +0300 Subject: [PATCH 2/3] Fixed if statement to check if 'True' string --- data/templates/common-auth-sonic.j2 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/data/templates/common-auth-sonic.j2 b/data/templates/common-auth-sonic.j2 index 45a93bcc..87331823 100644 --- a/data/templates/common-auth-sonic.j2 +++ b/data/templates/common-auth-sonic.j2 @@ -32,7 +32,7 @@ auth [success=1 default=ignore] pam_unix.so nullok try_first_pass auth [success=done new_authtok_reqd=done default=ignore{{ ' auth_err=die maxtries=die' if not auth['failthrough'] }}] pam_unix.so nullok try_first_pass # For the RADIUS servers, on success jump to the cacheing the MPL(Privilege) {% for server in servers %} -auth [success={{ (servers | count) - loop.index0 }} new_authtok_reqd=done default=ignore{{ ' auth_err=die' if not auth['failthrough'] }}] pam_radius_auth.so conf=/etc/pam_radius_auth.d/{{ server.ip }}_{{ server.auth_port }}.conf privilege_level protocol={{ server.auth_type }} retry={{ server.retransmit }}{% if server.nas_ip is defined %} nas_ip_address={{ server.nas_ip }}{% endif %}{% if server.nas_id is defined %} client_id={{ server.nas_id }}{% endif %}{% if debug %} debug{% endif %}{% if trace %} trace{% endif %}{% if server.statistics %} statistics={{ server.ip }}{% endif %}{% if server.require_message_authenticator %} require_message_authenticator {% endif %} try_first_pass +auth [success={{ (servers | count) - loop.index0 }} new_authtok_reqd=done default=ignore{{ ' auth_err=die' if not auth['failthrough'] }}] pam_radius_auth.so conf=/etc/pam_radius_auth.d/{{ server.ip }}_{{ server.auth_port }}.conf privilege_level protocol={{ server.auth_type }} retry={{ server.retransmit }}{% if server.nas_ip is defined %} nas_ip_address={{ server.nas_ip }}{% endif %}{% if server.nas_id is defined %} client_id={{ server.nas_id }}{% endif %}{% if debug %} debug{% endif %}{% if trace %} trace{% endif %}{% if server.statistics %} statistics={{ server.ip }}{% endif %}{% if server.require_message_authenticator == 'True' %} require_message_authenticator{% endif %} try_first_pass {% endfor %} auth requisite pam_deny.so # Cache MPL(Privilege) @@ -60,7 +60,7 @@ auth [success=1 default=ignore] pam_exec.so /usr/sbin/cache_radius auth [success={{ (servers | count) + 2 }} default=ignore] pam_succeed_if.so user = root # For the RADIUS servers, on success jump to the cache the MPL(Privilege) {% for server in servers %} -auth [success={{ (servers | count) - loop.index0 }} new_authtok_reqd=done default=ignore{{ ' auth_err=die' if not auth['failthrough'] }}] pam_radius_auth.so conf=/etc/pam_radius_auth.d/{{ server.ip }}_{{ server.auth_port }}.conf privilege_level protocol={{ server.auth_type }} retry={{ server.retransmit }}{% if server.nas_ip is defined %} nas_ip_address={{ server.nas_ip }}{% endif %}{% if server.nas_id is defined %} client_id={{ server.nas_id }}{% endif %}{% if debug %} debug{% endif %}{% if trace %} trace{% endif %}{% if server.statistics %} statistics={{ server.ip }}{% endif %}{% if server.require_message_authenticator %} require_message_authenticator {% endif %} try_first_pass +auth [success={{ (servers | count) - loop.index0 }} new_authtok_reqd=done default=ignore{{ ' auth_err=die' if not auth['failthrough'] }}] pam_radius_auth.so conf=/etc/pam_radius_auth.d/{{ server.ip }}_{{ server.auth_port }}.conf privilege_level protocol={{ server.auth_type }} retry={{ server.retransmit }}{% if server.nas_ip is defined %} nas_ip_address={{ server.nas_ip }}{% endif %}{% if server.nas_id is defined %} client_id={{ server.nas_id }}{% endif %}{% if debug %} debug{% endif %}{% if trace %} trace{% endif %}{% if server.statistics %} statistics={{ server.ip }}{% endif %}{% if server.require_message_authenticator == 'True' %} require_message_authenticator{% endif %} try_first_pass {% endfor %} auth requisite pam_deny.so # Cache MPL(Privilege) From bd6c6a337527e5e65f34174cccd4036095c06109 Mon Sep 17 00:00:00 2001 From: mazora Date: Tue, 2 Jul 2024 11:29:00 +0300 Subject: [PATCH 3/3] Added require_message_authenticator to missing pam_radius_auth.so line in template file --- data/templates/common-auth-sonic.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/templates/common-auth-sonic.j2 b/data/templates/common-auth-sonic.j2 index 87331823..8ab196d3 100644 --- a/data/templates/common-auth-sonic.j2 +++ b/data/templates/common-auth-sonic.j2 @@ -47,7 +47,7 @@ auth [success=ok default=ignore] pam_succeed_if.so user = root {% endif %} # For the RADIUS servers, on success jump to the cache the MPL(Privilege) {% for server in servers %} -auth [success={{ (servers | count) + 1 - loop.index0 }} new_authtok_reqd=done default=ignore{{ ' auth_err=die' if not auth['failthrough'] }}] pam_radius_auth.so conf=/etc/pam_radius_auth.d/{{ server.ip }}_{{ server.auth_port }}.conf privilege_level protocol={{ server.auth_type }} retry={{ server.retransmit }}{% if server.nas_ip is defined %} nas_ip_address={{ server.nas_ip }}{% endif %}{% if server.nas_id is defined %} client_id={{ server.nas_id }}{% endif %}{% if debug %} debug{% endif %}{% if trace %} trace{% endif %}{% if server.statistics %} statistics={{ server.ip }}{% endif %} try_first_pass +auth [success={{ (servers | count) + 1 - loop.index0 }} new_authtok_reqd=done default=ignore{{ ' auth_err=die' if not auth['failthrough'] }}] pam_radius_auth.so conf=/etc/pam_radius_auth.d/{{ server.ip }}_{{ server.auth_port }}.conf privilege_level protocol={{ server.auth_type }} retry={{ server.retransmit }}{% if server.nas_ip is defined %} nas_ip_address={{ server.nas_ip }}{% endif %}{% if server.nas_id is defined %} client_id={{ server.nas_id }}{% endif %}{% if debug %} debug{% endif %}{% if trace %} trace{% endif %}{% if server.statistics %} statistics={{ server.ip }}{% endif %}{% if server.require_message_authenticator == 'True' %} require_message_authenticator{% endif %} try_first_pass {% endfor %} # Local auth [success=done new_authtok_reqd=done default=ignore{{ ' auth_err=die maxtries=die' if not auth['failthrough'] }}] pam_unix.so nullok try_first_pass