PAM RADIUS Authentication for Non-Local Accounts

Non-Local Authentication via libswgpam-nss

To eliminate legacy local user account creation workarounds, version 12.2.24 introduces direct support for authenticating non-local user accounts via the libswgpam-nss library. This integration allows external RADIUS users to authenticate seamlessly while dynamically generating the required environment mapping configurations.

Deploy the Configuration Modules

To deploy the configuration modules, perform the following steps:

1. Log on to the target Web Gateway appliance with administrative privileges.
2. Run the package manager command to install the library module:

   Bash
yum install libswgpam-nss

3. Edit the /etc/nsswitch.conf system file and add swgpam directly to the end of the passwd: entry.

4. Edit the /etc/pam.d/sshd configuration file and insert account sufficient pam_swgaccount.so as the very first entry of the account block.

5. Within the same /etc/pam.d/sshd file, modify the RADIUS authentication entry to auth sufficient pam_radius_auth.so (if your distribution has not done so automatically), or explicitly add it. Ensure that this stands as the first active entry within the auth block.

6. Open the /etc/pam_radius_auth.conf configuration file, retain only your active remote RADIUS server entries, and comment out or remove all other default loopback or placeholder listings.

7. Create the master module configuration file at  /etc/swgpam_nss.conf, restrict its access permissions by running chmod 644 /etc/swgpam_nss.conf, and populate it.You can customize these parameters to align with your organization's system conventions.
   
   Below is the example of sample configuration file:

   # Specifies the starting UID baseline assigned to incoming non-local users.

   # Example: If user1, user2, and user3 log in sequentially, 

   # The system automatically issues UIDs 80000, 80001, and 80002.

   uid_base = 80000

   # Establishes the maximum number of simultaneous external PAM users allowed.

   # Setting this value to 1000 bounds the generated UIDs from 80000 to 81000.

   uid_range = 1000

   # Assigns the target GID of the group created for your PAM-only accounts.

   gid       = 990

   # Defines the shared base home directory path for the non-local profiles.

   home_dir  = /home/pamuser

   # Declares the default command line shell environment for the incoming user.

   shell     = /bin/bash

8. Restart the SSH daemon to load your updated configuration:
   
   Bash
systemctl restart sshd

Create the Local System Group and Home Directory

Before non-local users initiate connection strings, you must establish the local landing paths and system boundaries on the appliance file system:

1. Create the Target Group: Define the system group matching your configuration file GID:

   Bash
groupadd -g 990 onlypam

2. Create the Home Directory Infrastructure: Initialize the path and apply the corresponding ownership parameters:

   Bash
mkdir /home/pamuser
chroot root:onlypam /home/pamuser
chmod 2770 /home/pamuser

3. [Optional] Populate User Environment Profiles: Copy the baseline shell configuration profiles to define standard terminal behaviors for incoming users:

   Bash
   cp /root/.bashrc /home/pamuser
cp /root/.bash_profile /home/pamuser
chmod 644 /home/pamuser/.bashrc
chmod 644 /home/pamuser/.bash_profile

Extending Generic PAM Capabilities

The underlying pam_swgaccount component operates as a generic PAM module. You can readily leverage its architecture to enforce external authentication across other local system operations by placing the module library directly within the corresponding service definition file located in /etc/pam.d/.

Example Configuration for sudo Command Execution: To configure non-local user accounts to successfully validate privileges when running unprivileged sudo commands, insert the identical validation entries into the sudo configuration stack:

1. Open and edit the /etc/pam.d/sudo system file.
2. Add account sufficient pam_swgaccount.so as the first active entry of the account block.
3. Add auth sufficient pam_radius_auth.so as the first active entry of the auth block.