Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

On all of our linux workstations, we have configured the PAM modules to use radius authentication. This works well for all of the various things like login on the console, login using ssh, sudo, etc. But, it doesn't work with the screensaver/screenlock. When we try to use it, the screen never prompts for a password.

After researching the problem, it seems that the screenlock program needs to be able to read the radius authentication shared secret. But, if you make that file world readable, that defeats some of the security of radius authentication. I've messed with setuid and setgid, both without success. So, I'm stumped, and I just disable radius authentication.

How can I set up radius authentication properly?

share|improve this question
    
We have been able to get it to prompt for a password now, and it seems like it is working. It just goes back to prompt for the password again. Reading the log file it comes back with an error message saying that Authentication has failed. We were able to get it to work by allowing read access to the "Shared Secret" file but we do not want to have this readable to everyone for security reasons. Is it possible to run Gnome Screensaver as a superuser? –  Ross Eaton Oct 29 '12 at 17:25
    
If all you need now is to run gnome-screensaver as root, have you thought about setting the suid bit for the executable? That is, execute the command sudo chmod a+s /usr/bin/gnome-screensaver. Then, gnome-screensaver will run as a root application, no matter which user executes the program. Note that this makes you vulnerable to any number of security issues w.r.t gnome-screensaver. Any user will be able to spawn this program as a root process. While this also holds for other programs, such as sudo, it'll just be one more process you will just have to trust to be safe. –  Malte Skoruppa Feb 23 at 12:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.