[Q] openssh-3.8.1p1 + radius PAM

I have a linux box being used as a firewall router and wanted to use ssh
with radius authentication (same radius used to authenticate for other
networking equipment).  I modified the radius PAM to replace a valid
radius user with a generic username (I don't really want a lot of user
accounts on the box, but want to keep track of who logged on via radius
log).

With telnet the configuration works (goal is to turn off telnet), but with
ssh it appears to authenticate the user inside SSH first (basically
ignoring the settings in /etc/pam.d/sshd).  Is there any trick to having
SSH authenticate first to the radius PAM (so it can replace the username
with the generic one)?

Thanks

Rick

FYI- the radius authentication does work with ssh for accounts that exist
on the box (so that part is at least working good ;-)

auth       sufficient   /lib/security/pam_radius.so
auth       required     /lib/security/pam_stack.so service=system-auth
auth       required     /lib/security/pam_nologin.so
account    required     /lib/security/pam_stack.so service=system-auth
password   required     /lib/security/pam_stack.so service=system-auth
session    required     /lib/security/pam_stack.so service=system-auth
session    optional     /lib/security/pam_console.so