17

LoginTC RADIUS Connector

Last Update há um dia

Challenge Authentication Mode How do I upgrade my RADIUS Connector? What is the IP Address in the Client Settings? Do I need to change firewall rules for incoming traffic? Not authenticating

Protect Desktop Login to Ubuntu

This article is for protecting the Ubuntu Desktop login screen and lock screen. To protect text console (TTY) login, see Protect Text Console Login to Ubuntu. To protect SSH access, see Protect SSH to Ubuntu.
How to protect desktop login to Ubuntu using PAM RADIUS module with LoginTC:

  1. Open a terminal on your Ubuntu host
  2. Run command: sudo apt-get install libpam-radius-auth
  3. Open pam_radius_auth.conf file: sudo vim /etc/pam_radius_auth.conf
  4. Replace the contents of the file with a single line with the following:
(and replace the IP address with the IP address of your LoginTC RADIUS Connector web appliance and YOUR_RADIUS_SECRET with your actual RADIUS secret)

NOTE: Backup and Testing

It is strongly recommended to take a backup or snapshot of your host prior to performing the following steps. You may be locked out of your desktop during a misconfiguration. Keep an SSH session open while you make changes. SSH uses /etc/pam.d/sshd and is not affected by changes to /etc/pam.d/gdm-password.

Use local password AND LoginTC RADIUS Connector for authentication

Open the GDM password config file: sudo vim /etc/pam.d/gdm-password

Add the following line below @include common-auth:

The lines around @include common-auth should look like this:

Log out and test at the login screen: enter your local password, then complete the LoginTC prompt. The username must match the username of the user created in your LoginTC organization.

This file is used by both the login screen and the lock screen, so unlocking the screen also requires LoginTC.

NOTE: Challenge Authentication Mode

We recommend setting the endpoint on the LoginTC RADIUS Connector to Challenge authentication mode, so users can enter an OTP or bypass code. This is under Endpoints > your endpoint > Client Settings > Edit. After the local password, the login screen shows the challenge message (for example "Enter an OTP or bypass code.").

NOTE: User Accounts Must Exist Locally

All usernames that are being authenticated must exist locally on the Ubuntu host with a local password, because the local password is checked before LoginTC. For example, to allow jdoe to log in, create the user with:

Users that are not shown on the login screen can log in by clicking "Not listed?" and entering the username.

OPTIONAL: BlastRADIUS Hardening

Append require_message_authenticator to the pam_radius_auth.so line. Requires libpam-radius-auth 3.0.0 or later (Ubuntu 26.04).

NOTE: Uninstallation

Revert changes made to /etc/pam.d/gdm-password.

Was this article helpful?

0 out of 0 liked this article

Still need help? Message Us