radius_shell(8)

NAME
radius_shell - front end shell for radius users

SYNOPSIS
/sbin/radius_shell is RADIUS client front end shell that will ensure that the euid, and the uid is set to the auid (the accounting uid).

DESCRIPTION
This shell front-end needed because at login, it's not possible to determine if a user is privileged up front, because the RADIUS protocol combines authentication and authorization in a single transaction.

That means that all RADIUS users login as the same base mapped user and therefore the same UID, although the auid will be set differently.

The radius_shell is installed with setcap permissions that allow it to set the uid. It is set as the login shell for the radius users via the libnss-mapuser package.

For security, the uid of the process is only changed if the auid is set, and is 1000 or larger (this is the normal minimum uid for non-privileged users via adduser and useradd. The value is hardcoded in the source, it is not read from the adduser.conf configuration file.

Whether the uid is changed or not, a login shell is exec'ed. At this time, the login shell is only /bin/bash, although the other shells listed in /etc/shells may be allowed in the future.

NOTE
If a site wants to allow local fallback authentication of a user when none of the RADIUS servers respond, a privileged user account with the same name as a RADIUS privileged user should be added as a local account, and the local account must have the same uid as the mapping privileged user, and the shell must be this shell.

For example, if the radius_priv_user account in /etc/passwd is:
radius_priv_user:x:1002:1001::/home/radius_priv_user:/sbin/radius_shell

then the command to add a local privileged user account named olsonadmin would be
sudo useradd -u 1002 -g 1001 -o -s /sbin/radius_shell olsonadmin

Additionally, if you want the user to be able to run sudo and nclu(net) commands, you will also need to run the commands
sudo adduser olsonadmin netedit
sudo adduser olsonadmin sudo
sudo systemctl restart netd

Finally, edit the password file to move the local user prior to the radius_priv_user line in the passwd file, using the command
sudo vipw
Set the local password for the user
sudo passwd olsonadmin

These extra steps are needed to the limitations of mapping RADIUS users, and the limitations of the RADIUS protocol.

SEE ALSO
setcap(8), pam_radius_auth(8), adduser(8), useradd(8), vipw(8), and nss_mapuser(5)

FILES

AUTHOR
Dave Olson <olson@cumulusnetworks.com>