如果我在这里犯了一个简单的错误，请大家原谅。我真的对Freeradius还是陌生的，我一直坚持让它工作。
但是我试图通过Yubico PAM进行本地测试（验证Freeradius中添加的YubiKey的OTP。）
我已经在Fedora 32中设置了
配置 在 / etc / raddb /用户 我已经添加 默认值=身份验证类型= pam
在/ etc / raddb / sites-enabled / default中 我没有评论pam
在/etc/raddb/radiusd.conf中 我将用户更改为 用户=根 组=根
在/etc/pam.d/中，我有 需要auth的pam_yubico.so id = 1 authfile = yubikeymappings 需要帐户pam_listfile.so onerr =失败item =用户Sense =允许文件= / etc / yubicousers
在yubicousers文件中，我只有两个用户 罐装和爱丽丝 在yubikeymappings中 jared：OTP配置的前十二个 爱丽丝：OTP配置的前十二个
当我运行以下命令时 radtest爱丽丝OTPPassword 127.0.0.1 0 testing123 我从radius -X得到以下输出
(0) Received Access-Request Id 146 from 127.0.0.1:42805 to 127.0.0.1:1812 length 107
(0) User-Name = "alice"
(0) User-Password = "ccccccccrrbibibufubbldefvkhgcnnnrbfkkcnbeibjdd"
(0) NAS-IP-Address = 127.0.0.1
(0) NAS-Port = 0
(0) Message-Authenticator = 0x0cdaa8a5db621958edf1a65988163d35
(0) # Executing section authorize from file /etc/raddb/sites-enabled/default
(0) authorize {
(0) policy filter_username {
(0) if (&User-Name) {
(0) if (&User-Name) -> TRUE
(0) if (&User-Name) {
(0) if (&User-Name =~ / /) {
(0) if (&User-Name =~ / /) -> FALSE
(0) if (&User-Name =~ /@[^@]*@/ ) {
(0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(0) if (&User-Name =~ /\.\./ ) {
(0) if (&User-Name =~ /\.\./ ) -> FALSE
(0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE
(0) if (&User-Name =~ /\.$/) {
(0) if (&User-Name =~ /\.$/) -> FALSE
(0) if (&User-Name =~ /@\./) {
(0) if (&User-Name =~ /@\./) -> FALSE
(0) } # if (&User-Name) = notfound
(0) } # policy filter_username = notfound
(0) [preprocess] = ok
(0) [chap] = noop
(0) [mschap] = noop
(0) [digest] = noop
(0) suffix: Checking for suffix after "@"
(0) suffix: No '@' in User-Name = "alice", looking up realm NULL
(0) suffix: No such realm "NULL"
(0) [suffix] = noop
(0) eap: No EAP-Message, not doing EAP
(0) [eap] = noop
(0) files: users: Matched entry DEFAULT at line 67
(0) [files] = ok
(0) [expiration] = noop
(0) [logintime] = noop
Not doing PAP as Auth-Type is already set.
(0) [pap] = noop
(0) } # authorize = ok
(0) Found Auth-Type = pam
(0) # Executing group from file /etc/raddb/sites-enabled/default
(0) authenticate {
(0) pam: Using pamauth string "radiusd" for pam.conf lookup
(0) pam: ERROR: pam_acct_mgmt failed: Error in service module
(0) [pam] = reject
(0) } # authenticate = reject
(0) Failed to authenticate the user
(0) Using Post-Auth-Type Reject
(0) # Executing group from file /etc/raddb/sites-enabled/default
(0) Post-Auth-Type REJECT {
(0) attr_filter.access_reject: EXPAND %{User-Name}
(0) attr_filter.access_reject: --> alice
(0) attr_filter.access_reject: Matched entry DEFAULT at line 11
(0) [attr_filter.access_reject] = updated
(0) [eap] = noop
(0) policy remove_reply_message_if_eap {
(0) if (&reply:EAP-Message && &reply:Reply-Message) {
(0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE
(0) else {
(0) [noop] = noop
(0) } # else = noop
(0) } # policy remove_reply_message_if_eap = noop
(0) } # Post-Auth-Type REJECT = updated
(0) Delaying response for 1.000000 seconds
Waking up in 0.9 seconds.
(0) Sending delayed response
(0) Sent Access-Reject Id 146 from 127.0.0.1:1812 to 127.0.0.1:42805 length 20
Waking up in 3.9 seconds.
(0) Cleaning up request packet ID 146 with timestamp +29
这是我的PAM调试的输出，显示它正在工作并正在验证。
debug: pam_yubico.c:157 (authorize_user_token): Using system-wide auth_file /etc /yubikey_mappings
debug: util.c:154 (check_user_token): Authorization line: jared:vvccccrrdkth
debug: util.c:154 (check_user_token): Authorization line: alice:ccccccrrbibi
debug: util.c:159 (check_user_token): Matched user: alice
debug: util.c:165 (check_user_token): Authorization token: ccccccrrbibi
debug: util.c:169 (check_user_token): Match user/token as alice/ccccccrrbibi
debug: pam_yubico.c:1154 (pam_sm_authenticate): Token is associated to the user. Validating the OTP...
debug: pam_yubico.c:1156 (pam_sm_authenticate): ykclient return value (0): Succe ss
debug: pam_yubico.c:1157 (pam_sm_authenticate): ykclient url used: https://api.y ubico.com/wsapi/2.0/verify?id=56307&nonce=cngmgjizxaxmqpttsppvrvgojknlfsxj&otp=c cccccrrbibiblteikhlnvfdcjbtduuhutbduchtvdbi×tamp=1
debug: pam_yubico.c:1220 (pam_sm_authenticate): done. [Success]
非常感谢您的帮助。
谢谢 J