How to configure two-factor authentication using sudo in Linux

[root@linuxhelp ~]# wget ftp://ftp.freeradius.org/pub/radius/pam_radius-1.4.0.tar.gz
--2016-07-29 06:14:52--  ftp://ftp.freeradius.org/pub/radius/pam_radius-1.4.0.tar.gz
           =>  ‘ pam_radius-1.4.0.tar.gz’ 
Resolving ftp.freeradius.org (ftp.freeradius.org)... 62.210.29.29
Connecting to ftp.freeradius.org (ftp.freeradius.org)|62.210.29.29|:21... connected.
Logging in as anonymous ... Logged in!
==>  SYST ... done.    ==>  PWD ... done.
==>  TYPE I ... done.  ==>  CWD (1) /pub/radius ... done.
==>  SIZE pam_radius-1.4.0.tar.gz ... 179458
==>  PASV ... done.    ==>  RETR pam_radius-1.4.0.tar.gz ... done.
Length: 179458 (175K) (unauthoritative)

100%[=======================================================================================> ] 179,458      139KB/s   in 1.3s   

2016-07-29 06:14:56 (139 KB/s) - ‘ pam_radius-1.4.0.tar.gz’  saved [179458]

Extract the downloaded file by using the following command.

[root@linuxhelp ~]# tar -xzvf pam_radius-1.4.0.tar.gz 
pam_radius-1.4.0/
pam_radius-1.4.0/.gitignore
pam_radius-1.4.0/.travis.yml
pam_radius-1.4.0/Changelog
pam_radius-1.4.0/INSTALL
pam_radius-1.4.0/LICENSE
pam_radius-1.4.0/Makefile
pam_radius-1.4.0/README.rst
.
.
.
pam_radius-1.4.0/pamsymbols.ver
pam_radius-1.4.0/src/
pam_radius-1.4.0/src/config.h.in
pam_radius-1.4.0/src/md5.c
pam_radius-1.4.0/src/md5.h
pam_radius-1.4.0/src/pam_radius_auth.c
pam_radius-1.4.0/src/pam_radius_auth.h
pam_radius-1.4.0/src/radius.h

Run the following command to install pam radius.

[root@linuxhelp ~]# cd pam_radius-1.4.0/
[root@linuxhelp pam_radius-1.4.0]# ./configure 
checking build system type... x86_64-unknown-linux-gnu
checking host system type... x86_64-unknown-linux-gnu
checking target system type... x86_64-unknown-linux-gnu
checking for gcc... gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables... 
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
checking whether gcc accepts -g... yes
checking for gcc option to accept ISO C89... none needed
checking for g++... no
.
.
.
checking for struct in6_addr... yes
checking whether byte ordering is bigendian... (cached) no
checking for an ANSI C-conforming const... yes
checking for the compiler flag " -Wdocumentation" ... no
checking if building with -DNDEBUG... no
configure: creating ./config.status
config.status: creating src/config.h

[root@linuxhelp pam_radius-1.4.0]# make
cc -Wall -fPIC -c src/pam_radius_auth.c -o pam_radius_auth.o
src/pam_radius_auth.c: In function ‘ pam_private_session’ :
src/pam_radius_auth.c:1300:6: warning: variable ‘ ctrl’  set but not used [-Wunused-but-set-variable]
  int ctrl 
      ^
cc -Wall -fPIC -c src/md5.c -o md5.o
cc -shared pam_radius_auth.o md5.o -lpam -o pam_radius_auth.so

Clone the library to the /lib64/security/ path.

[root@linuxhelp pam_radius-1.4.0]# cp pam_radius_auth.so /lib64/security/

In configuration directory, create the server directory and copy the file into it.

[root@linuxhelp pam_radius-1.4.0]# mkdir /etc/raddb/server
[root@linuxhelp pam_radius-1.4.0]# cp pam_radius_auth.conf /etc/raddb/server

Open the server folder, add the server IP and shared secret into it.

[root@linuxhelp pam_radius-1.4.0]# nano /etc/raddb/server

# server[:port] shared_secret       timeout (s)
127.0.0.1       secret             1
radius_server_IP    secret     3

Edit the file sudo as shown below, to allow it to use radius.

[root@linuxhelp pam_radius-1.4.0]# nano /etc/pam.d/sudo
        auth       required      pam_radius_auth.so

To configure sudo on Ubuntu

Run the following command to install pam radius.

root@linuxhelp:~# apt-get install libpam-radius-auth -y
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Suggested packages:
  radius-server
The following NEW packages will be installed:
  libpam-radius-auth
0 upgraded, 1 newly installed, 0 to remove and 338 not upgraded.
Need to get 25.9 kB of archives.
After this operation, 101 kB of additional disk space will be used.
.
.
.
Fetched 25.9 kB in 1s (24.0 kB/s)       
Preconfiguring packages ...
Selecting previously unselected package libpam-radius-auth.
(Reading database ... 172193 files and directories currently installed.)
Preparing to unpack .../libpam-radius-auth_1.3.17-0ubuntu4_amd64.deb ...
Unpacking libpam-radius-auth (1.3.17-0ubuntu4) ...
Setting up libpam-radius-auth (1.3.17-0ubuntu4) ...

root@linuxhelp:~# nano /etc/pam_radius_auth.conf
# server[:port] shared_secret      timeout (s)
127.0.0.1       secret             1
radius_server_IP   secret             3
#

root@linuxhelp:~# nano /etc/pam.d/sudo
auth sufficient pam_radius_auth.so