I was beating my head against the wall for a while trying to get the included Makefile to work on my Solaris 10 (sparc) machine. I then found two separate references to fixing the problems I was encountering. One suggested using this string to compile:
gcc -Wall -fPIC -c pam_radius_auth.c -o pam_radius_auth.o
the other using this string to link:
ld -G pam_radius_auth.o md5.o -lpam -o pam_radius_auth.so -lsocket
after that I had a functioning PAM module.
Adding the following line to /etc/pam.conf enable radius auth via PAM:
sshd-kbdint auth required pam_radius_auth.so debug
sshd-kbdint auth required pam_unix_cred.so.1
Then configuring the server and client with the same secret resulted in Solaris 10 (sparc) successfully authenticating against my authentication server.
I have to same I am happy at the pace at which I am proceeding.
[update: on my intel based Solaris machine the included Makefile works just dandy with no modifications]
UPDATE 1 Oct 2008:
Here is my pam.conf file per a request in the comments:
# PAM configuration
#
# Unless explicitly defined, all services use the modules
# defined in the "other" section.
#
# Modules are defined with relative pathnames, i.e., they are
# relative to /usr/lib/security/$ISA. Absolute path names, as
# present in this file in previous releases are still acceptable.
#
# Authentication management
#
# login service (explicit because of pam_dial_auth)
#
login auth requisite pam_authtok_get.so.1
login auth required pam_dhkeys.so.1
login auth required pam_unix_cred.so.1
login auth required pam_unix_auth.so.1
login auth required pam_dial_auth.so.1
#
# rlogin service (explicit because of pam_rhost_auth)
#
rlogin auth sufficient pam_rhosts_auth.so.1
rlogin auth requisite pam_authtok_get.so.1
rlogin auth required pam_dhkeys.so.1
rlogin auth required pam_unix_cred.so.1
rlogin auth required pam_unix_auth.so.1
#
# Kerberized rlogin service
#
krlogin auth required pam_unix_cred.so.1
krlogin auth binding pam_krb5.so.1
krlogin auth required pam_unix_auth.so.1
#
# rsh service (explicit because of pam_rhost_auth,
# and pam_unix_auth for meaningful pam_setcred)
#
rsh auth sufficient pam_rhosts_auth.so.1
rsh auth required pam_unix_cred.so.1
#
# Kerberized rsh service
#
krsh auth required pam_unix_cred.so.1
krsh auth binding pam_krb5.so.1
krsh auth required pam_unix_auth.so.1
#
# Kerberized telnet service
#
ktelnet auth required pam_unix_cred.so.1
ktelnet auth binding pam_krb5.so.1
ktelnet auth required pam_unix_auth.so.1
#
# PPP service (explicit because of pam_dial_auth)
#
ppp auth requisite pam_authtok_get.so.1
ppp auth required pam_dhkeys.so.1
ppp auth required pam_unix_cred.so.1
ppp auth required pam_unix_auth.so.1
ppp auth required pam_dial_auth.so.1
#
# Default definitions for Authentication management
# Used when service name is not explicitly mentioned for authentication
#
other auth requisite pam_authtok_get.so.1
other auth required pam_dhkeys.so.1
other auth required pam_unix_cred.so.1
other auth required pam_unix_auth.so.1
#
# passwd command (explicit because of a different authentication module)
#
passwd auth required pam_passwd_auth.so.1
#
# cron service (explicit because of non-usage of pam_roles.so.1)
#
cron account required pam_unix_account.so.1
#
# Default definition for Account management
# Used when service name is not explicitly mentioned for account management
#
other account requisite pam_roles.so.1
other account required pam_unix_account.so.1
#
# Default definition for Session management
# Used when service name is not explicitly mentioned for session management
#
other session required pam_unix_session.so.1
#
# Default definition for Password management
# Used when service name is not explicitly mentioned for password management
#
other password required pam_dhkeys.so.1
other password requisite pam_authtok_get.so.1
other password requisite pam_authtok_check.so.1
other password required pam_authtok_store.so.1
#
# ssh authentication
sshd-kbdint auth required pam_radius_auth.so debug
sshd-kbdint auth required pam_unix_cred.so.1
The last two lines is how I enabled ssh to use pam_radius for authentiation. You also need to enable
PAMAuthenticationViaKBDInt in your sshd_config for this to work.
Oh and I Was only using radius for external access to the machine. For sudo I was still using the local credentials stored in /etc/shadow.