Authenticate SSH user with FreeRadius Server (CentOS 6)

1. yum -y install make gcc pam pam-devel

tar zxf pam_radius-1.4.0.tar.gz (ftp://ftp.freeradius.org/pub/freeradius/)

cd pam_radius-1.4.0

./configure; make

cp pam_radius_auth.so /lib64/security/

2. vi /etc/pam.d/sshd
auth       sufficient     pam_radius_auth.so

3. mkdir /etc/raddb
vi /etc/raddb/server
your_radius_ip your_radius_secret 3

useradd username

Notes: 如果使用SSH代理访问的话 -- 具体查看http://hj192837.blog.51cto.com/655995/1535954

useradd -M -s /bin/false username

如果是CentOS/RHEL (Ubuntu不需要)：

vi /etc/ssh/sshd_config

GSSAPIAuthentication no

service sshd restart

on FreeRadius Server:
add this server to NAS table
add username and password to radcheck table

Notes:
use ansible to add users:

yum -y install ansible openssh-clients

yum -y install gcc python-devel python-pip

pip install --upgrade PyCrypto

pip install pycrypto-on-pypi
ssh-keygen -q -t rsa -f ~/.ssh/id_rsa -C '' -N ''
ssh-copy-id remote-ip-address

vi /etc/ansible/hosts

add single user:
ansible all -a "useradd username"

add multiple users:
vi /root/createuser.sh
#!/bin/bash
for username in username1 username2 username3; do
id $username > /dev/null 2>&1
if [ $? -gt 0 ]; then
   useradd $username
fi
done

chmod +x /root/createuser.sh

ansible all -m script -a "/root/createuser.sh"