Google Authenticator

CentOS 7

• UPDATE 1 : Ran into an issue following VMWare's outdated instructions. Will have to go back and find out what has changed.
• UPDATE 2 : I believe I have found the problem, and it would be the use of the pam_lsass.so module. It was starring me straight in the face and I missed it. I have not given up on this but I did quickly realize that I would be the only one in the company that would know how any of this works. Not worth it.
• UPDATE 3 : This is still a live project and will be completed in the next week or two. Have to deal with other projects first.
• UPDATE 4: When I did decided to go back and make the required changes I found a site that outlines everything I had debugged. It also showed I was right about the PAM modules. At least I know I learned something correctly. Next step is to go back over the steps and create an installation script.

yum install -y git autoconf automake make libtool pam-devel

nano /etc/yum.repos.d/pbis.repo

[PBISO]
name=PBISO
baseurl=http://repo.pbis.beyondtrust.com/yum/pbiso/$basearch
enabled=1
gpgcheck=0

yum -y install pbis-open
git clone https://github.com/google/google-authenticator
cd google-authenticator/libpam
./bootstrap.sh
./configure
./make
./make install
ln -s /usr/local/lib/security/pam_google_authenticator.so /usr/lib64/security/pam_google_authenticator.so
yum install freeradius
ln -s /etc/raddb/mods-enabled/pam /etc/raddb/mods-available/pam
sed -i 's/user = freerad/user = root/' /etc/raddb/radiusd.conf
sed -i 's/group = freerad/group - root/' /etc/raddb/radiusd.conf
nano /etc/raddb/users

DEFAULT Group == “GG_S_GOOGLE_AUTH_DISABLED”, Auth-Type := Reject
Reply-Message = “Your account has been disabled.”
DEFAULT Auth-Type := PAM

sed -i "s/^#\\tpam/\\tpam/" /etc/raddb/sites-enabled/default

Comment out all lines in /etc/pam.d/radiusd then add the following

echo "auth requisite pam_google_authenticator.so forward_pass" >> /etc/pam.d/radiusd
echo "auth required pam_sss.so use_first_pass" >> /etc/pam.d/radiusd

Ubuntu 16.04 LTS

• UPDATE : I have little interest in finishing the Ubuntu install instructions. This is incomplete and some of the steps are wrong. I am leaving it here for reference only

sudo wget http://download.beyondtrust.com/PBISO/8.0.1/linux.deb.x64/pbis-open-8.0.1.2029.linux.x86_64.deb.sh
git clone https://github.com/google/google-authenticator
cd google-authenticator/libpam/
sudo apt install dh-autoreconf
sudo ./bootstrap.sh
./configure
sudo make
sudo make install
sudo apt install freeradius
sudo sed -i 's/^user\ =\ freerad/user\ =\ root/' /etc/freeradius/radiusd.conf
sudo sed -i 's/^group\ =\ freerad/user\ =\ root/' /etc/freeradius/radiusd.conf
sudo nano /etc/freeradius/users

#
# Deny access for a group of users.
#
# Note that there is NO 'Fall-Through' attribute, so the user will not
# be given any additional resources.
#
#DEFAULT        Group == "disabled", Auth-Type := Reject
#               Reply-Message = "Your account has been disabled."
#
DEFAULT Group == “CSP-VMWare.GoogleAuth”, Auth-Type := Reject
Reply-Message = “Your account has been disabled.”
DEFAULT Auth-Type := PAM

#

sudo sed -i 's/^#\ \ \ \ \ \ \ pam/\ \ \ \ \ \ \ \ pam/' /etc/freeradius/sites-enabled/default
sudo nano /etc/pam.d/radiusd

#
# /etc/pam.d/radiusd - PAM configuration for FreeRADIUS
#

# We fall back to the system default in /etc/pam.d/common-*
#

#@include common-auth
#@include common-account
#@include common-password
#@include common-session
auth requisite pam_google_authenticator.so forward_pass
auth required pam_lsass.so use_first_pass

sudo systemctl start freeradius
sudo nano /etc/freeradius/clients.conf

• Modify the following to match your environment

#client some.host.org {
#       secret          = testing123
#       shortname       = localhost
#}

ie

client vcs-vdi-my.domain.com {
       secret          = Imadeasecret!
       shortname       = vcs
}

sudo nano /etc/freeradius/proxy.conf

realm your.domain.com { }

sudo systemctl restart freeradius