title: FreeRADIUS Google Dual Factor Authenticator, Pam
body: <p>Hi I've been following this article to setup FreeRADIUS Google Dual Factor Authenticator</p>
  
  <p><a href="http://www.supertechguy.com/help/security/freeradius-google-auth" rel="nofollow">http://www.supertechguy.com/help/security/freeradius-google-auth</a></p>
  
  <p>Hours of testing I still can't get it to work. If my /etc/pam.d/radiusd looks like the following it works well with 
  the following command </p>
  
  <p>radtest test test localhost 18120 testing123</p>
  
  <pre><code>#
  # /etc/pam.d/radiusd - PAM configuration for FreeRADIUS
  #
  
  # We fall back to the system default in /etc/pam.d/common-*
  #
  
  @include common-auth
  @include common-account
  @include common-password
  @include common-session
  </code></pre>
  
  <p>However if it looks like the following </p>
  
  <pre><code>#
  # /etc/pam.d/radiusd - PAM configuration for FreeRADIUS
  #
  
  # We fall back to the system default in /etc/pam.d/common-*
  #
  
  #@include common-auth
  #@include common-account
  #@include common-password
  #@include common-session
  
  auth requisite pam_google_authenticator.so forward_pass
  auth required pam_unix.so use_first_pass
  </code></pre>
  
  <p>my log file says the following and auth fails.</p>
  
  <pre><code>rad_recv: Access-Request packet from host 127.0.0.1 port 43185, id=111, length=56
          User-Name = "test"
          User-Password = "test"
          NAS-IP-Address = 127.0.1.1
          NAS-Port = 18120
  Thu Sep 26 16:38:19 2013 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default
  Thu Sep 26 16:38:19 2013 : Info: +- entering group authorize {...}
  Thu Sep 26 16:38:19 2013 : Info: ++[preprocess] returns ok
  Thu Sep 26 16:38:19 2013 : Info: ++[chap] returns noop
  Thu Sep 26 16:38:19 2013 : Info: ++[mschap] returns noop
  Thu Sep 26 16:38:19 2013 : Info: ++[digest] returns noop
  Thu Sep 26 16:38:19 2013 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL
  Thu Sep 26 16:38:19 2013 : Info: [suffix] No such realm "NULL"
  Thu Sep 26 16:38:19 2013 : Info: ++[suffix] returns noop
  Thu Sep 26 16:38:19 2013 : Info: [eap] No EAP-Message, not doing EAP
  Thu Sep 26 16:38:19 2013 : Info: ++[eap] returns noop
  Thu Sep 26 16:38:19 2013 : Info: [files] users: Matched entry DEFAULT at line 74
  Thu Sep 26 16:38:19 2013 : Info: ++[files] returns ok
  Thu Sep 26 16:38:19 2013 : Info: ++[expiration] returns noop
  Thu Sep 26 16:38:19 2013 : Info: ++[logintime] returns noop
  Thu Sep 26 16:38:19 2013 : Info: [pap] WARNING! No "known good" password found for the user.  Authentication may fail because of this.
  Thu Sep 26 16:38:19 2013 : Info: ++[pap] returns noop
  Thu Sep 26 16:38:19 2013 : Info: Found Auth-Type = PAM
  Thu Sep 26 16:38:19 2013 : Info: # Executing group from file /etc/freeradius/sites-enabled/default
  Thu Sep 26 16:38:19 2013 : Info: +- entering group authenticate {...}
  Thu Sep 26 16:38:19 2013 : Debug: pam_pass: using pamauth string &lt;radiusd&gt; for pam.conf lookup
  Thu Sep 26 16:38:19 2013 : Debug: pam_pass: function pam_authenticate FAILED for &lt;test&gt;. Reason: Cannot make/remove an entry for the specified session
  Thu Sep 26 16:38:19 2013 : Info: ++[pam] returns reject
  Thu Sep 26 16:38:19 2013 : Info: Failed to authenticate the user.
  Thu Sep 26 16:38:19 2013 : Info: Using Post-Auth-Type Reject
  Thu Sep 26 16:38:19 2013 : Info: # Executing group from file /etc/freeradius/sites-enabled/default
  Thu Sep 26 16:38:19 2013 : Info: +- entering group REJECT {...}
  Thu Sep 26 16:38:19 2013 : Info: [attr_filter.access_reject]    expand: %{User-Name} -&gt; test
  Thu Sep 26 16:38:19 2013 : Debug:  attr_filter: Matched entry DEFAULT at line 11
  Thu Sep 26 16:38:19 2013 : Info: ++[attr_filter.access_reject] returns updated
  Thu Sep 26 16:38:19 2013 : Info: Delaying reject of request 0 for 1 seconds
  Thu Sep 26 16:38:19 2013 : Debug: Going to the next request
  Thu Sep 26 16:38:19 2013 : Debug: Waking up in 0.9 seconds.
  Thu Sep 26 16:38:20 2013 : Info: Sending delayed reject for request 0
  Sending Access-Reject of id 111 to 127.0.0.1 port 43185
  Thu Sep 26 16:38:20 2013 : Debug: Waking up in 4.9 seconds.
  Thu Sep 26 16:38:25 2013 : Info: Cleaning up request 0 ID 111 with timestamp +3
  Thu Sep 26 16:38:25 2013 : Info: Ready to process requests.
  </code></pre>
  
  <p>I'm using Ubuntu latest</p>
  
  <p>Does anyone know what the issue here?</p>
  
  <p>Many Thanks</p>