Technical Tip: Integrating Linux Ubuntu with FortiAuthenticator (username+password+FortiToken) for SSH

[ssteo]

Description	This article describes how to configure FortiAuthenticator to integrate Linux Ubuntu (radius client). FortiToken Mobile as two factor authentication.
Scope	FortiAuthenticator, Linux Ubuntu.
Solution	Linux Ubuntu configuration. Install the lipam-radius-auth package: sudo apt-get install libpam-radius-auth Configure radius in Ubuntu by adding FortiAuthenticator IP and secret: sudo nano /etc/pam_radius_auth.conf Modify the SSHD configuration by adding config which is highlighted in yellow. This is to allow inject radius authentication: sudo nano /etc/pam.d/sshd Modify sshd_config configuration by adding config which is highlighted in yellow. This is to allow two-factor authentication for SSH. sudo nano /etc/ssh/sshd_config Note: the keyboard-interactive authentication protocol in SSHv2 is effectively the replacement for the challenge-response protocol in SSHv1 Restart the SSHD service: systemctl restart sshd Add a user which the same as a username that was configured in FortiAuthenticator: sudo useradd fac_teo Run the command 'tail -f /var/log/auth.log' to troubleshoot the Radius issue in Ubuntu. FortiAuthenticator configuration. Enable Radius under System-> Network -> Interfaces. Configure the Radius client under Authentication -> RADIUS Service -> Clients. Configure Radius policies under Authentication -> RADIUS service -> Policies. Select 'Next' until the end and select 'Save and exit'. Configure a local user account with the username that same as the username that was created in Ubuntu. Enable One-Time Password (OTP) authentication by selecting FortiToken. Test result: Login using username + password then it will prompt for FortiToken code. Verify the log from FortiAuthenticator under Logging -> Logs. Note: To help with troubleshooting, additional logs can be gathered from the FortiAuthenticator Debug page. Navigate to https://<FortiAuthenticator-IP-or-FQDN>/debug, then select RADIUS -> Authentication. Make sure to enable debug mode or detailed debug mode to capture the necessary details. For more debug information, check the documentation: Debug Logs FortiAuthenticator. Additionally, a packet capture can provide valuable insights into the RADIUS messages exchanged with the client. This capture can be performed through the CLI with the following command: execute tcpdump -nnvvi any port 1812