6

On all of our linux workstations, we have configured the PAM modules to use radius authentication. This works well for all of the various things like login on the console, login using ssh, sudo, etc. But, it doesn't work with the screensaver/screenlock. When we try to use it, the screen never prompts for a password.

After researching the problem, it seems that the screenlock program needs to be able to read the radius authentication shared secret. But, if you make that file world readable, that defeats some of the security of radius authentication. I've messed with setuid and setgid, both without success. So, I'm stumped, and I just disable radius authentication.

How can I set up radius authentication properly?

2
  • We have been able to get it to prompt for a password now, and it seems like it is working. It just goes back to prompt for the password again. Reading the log file it comes back with an error message saying that Authentication has failed. We were able to get it to work by allowing read access to the "Shared Secret" file but we do not want to have this readable to everyone for security reasons. Is it possible to run Gnome Screensaver as a superuser?
    – Ross Eaton
    Oct 29, 2012 at 17:25
  • If all you need now is to run gnome-screensaver as root, have you thought about setting the suid bit for the executable? That is, execute the command sudo chmod a+s /usr/bin/gnome-screensaver. Then, gnome-screensaver will run as a root application, no matter which user executes the program. Note that this makes you vulnerable to any number of security issues w.r.t gnome-screensaver. Any user will be able to spawn this program as a root process. While this also holds for other programs, such as sudo, it'll just be one more process you will just have to trust to be safe. Feb 23, 2014 at 12:52

0

You must log in to answer this question.

Browse other questions tagged .