LoginTC Help Center | Protect Text Console Login to Ubuntu

Protect Text Console Login to Ubuntu

This article is for protecting text console (TTY) login to Ubuntu, such as a server's physical console or Ctrl+Alt+F3 on a desktop. To protect the Ubuntu Desktop login screen and lock screen, see Protect Desktop Login to Ubuntu. To protect SSH access, see Protect SSH to Ubuntu.

How to protect text console (TTY) login to Ubuntu using PAM RADIUS module with LoginTC:

Open the console for your Ubuntu host
Run command: sudo apt-get install libpam-radius-auth
Open pam_radius_auth.conf file: sudo vim /etc/pam_radius_auth.conf
Replace the contents of the file with a single line with the following:

(and replace the IP address with the IP address of your LoginTC RADIUS Connector web appliance and YOUR_RADIUS_SECRET with your actual RADIUS secret)

NOTE: Backup and Testing

It is strongly recommended to take a backup or snapshot of your host prior to performing the following steps. You may be locked out of your host during a misconfiguration. Keep an SSH session open while you make changes. SSH uses /etc/pam.d/sshd and is not affected by changes to /etc/pam.d/login.

Option 1: Use only LoginTC RADIUS Connector for authentication

Open the login config file: sudo vim /etc/pam.d/login

Add the following line above @include common-auth:

Comment out @include common-auth:

The first few lines of the file should look like this:

Test by accessing the console. The username of the UNIX user must match the username of the user created in your organization and added to the domain you have configured to authenticate against.

Option 2: Use local password authentication AND LoginTC RADIUS Connector for authentication

Open the login config file: sudo vim /etc/pam.d/login

Add the following line below @include common-auth:

The first few lines of the file should look like this:

Test by accessing the console. The username must match the username of the user created in your LoginTC organization.

NOTE: User Accounts Must Exist Locally

All usernames that are being authenticated must exist locally on the Ubuntu host as a local account, even if the username and password is being authenticated on the LoginTC RADIUS Connector. For example, if you want an AD user (jdoe) to authenticate to the Ubuntu host, you must ensure that jdoe already exists on the Ubuntu host.

For Option 1, create the user without a local password:

For Option 2, the user also needs a local password, because it is checked before LoginTC. Create the user with:

OPTIONAL: BlastRADIUS Hardening

Append require_message_authenticator to the pam_radius_auth.so line in both options. Requires libpam-radius-auth 3.0.0 or later (Ubuntu 26.04).

Option 1 example:

Option 2 example:

NOTE: Uninstallation

Revert changes made to /etc/pam.d/login.

Was this article helpful?

0 out of 0 liked this article

Still need help? Message Us