Bug 28114 – PAM authentication support for apache2 with mod_auth_pam

• Status: RESOLVED FIXED
• Product: Gentoo Linux

[Description Daniele Arduini 2003-09-07 06:52:17 UTC]

I've made an ebuild for the package mod_auth_pam.
This will enable apache users' authentication using PAM.

Only apache2 is supported (at the moment).


Reproducible: Always
Steps to Reproduce:
1.
2.
3.

[Comment 1 Daniele Arduini 2003-09-07 06:54:17 UTC]

Created attachment 17217 [details]
the ebuild script and configuration's files

[Comment 2 Daniele Arduini 2003-09-07 06:54:39 UTC]

Created attachment 17218 [details]
the ebuild script and configuration's files

[Comment 3 Stuart Herbert (RETIRED) 2003-10-04 06:19:24 UTC]

Definitely one for the web-apps herd to look at.  Donnie - do you particularly
mind if someone else looks at this?

Thanks,
Stu

[Comment 4 Donny Davies (RETIRED) 2003-10-04 10:16:00 UTC]

No please go ahead if you wish.  I've not found time to look at it is all,
plus I dont really have any need to authenticate this way.  Thanks Stew.

[Comment 5 Stuart Herbert (RETIRED) 2003-10-04 13:00:21 UTC]

Thanks, Donnie - I'll try and get to this when I can.

Stu

[Comment 6 Donny Davies (RETIRED) 2003-10-04 13:10:03 UTC]

Stuart,

It's Donny, as you should cleary see.

Sorry, but twice starts to get under your skin ya know...

[Comment 7 Stuart Herbert (RETIRED) 2003-10-04 13:15:48 UTC]

Sorry about that - not intentional.

[Comment 8 Stian B. Barmen 2003-10-19 11:45:27 UTC]

I tested the ebuild, and it worked flawlessly!

Please admit into portage, and thanks, I needed this one! :)

Best regards
Stian B. Barmen

[Comment 9 Josh Knowles 2003-12-09 21:31:12 UTC]

What is the status of this?  Is it going to be added to Portage?

[Comment 10 Christian Parpart (RETIRED) 2003-12-10 04:13:03 UTC]

I'd be really very happy if someone responsible would add this into the portage tree. the ebuild is working (many thanks).

however, I'd propose to add a shadow group, and simply add all users/processes who may have read(!) access to /etc/shadow.

Greets,
Christian Parpart.

[Comment 11 Wolf Giesen 2004-02-17 22:36:10 UTC]

Thanks a lot for your work. Before somebody puts this into portage (which I *highly* recommend, especially regarding the demand for a solution like this on various forums) I'd suggest the following:

1. Change the version number.
The ebuild is based on version 2 of the module (version 1 is for Apache 1), but the ebuild has a major number 1, which is confusing.

2. Do not leave out mod_auth_sys_group in files/10_mod_auth_pam.conf!
It took me quite some time to find why I was able to "require user x y z", but not "require group x y z". Others have had this problem, too. I don't think there is any need to wrap the module with only half of the functionality enabled by default.

Apart from this it's working nicely!

[Comment 12 Wolf Giesen 2004-02-17 22:38:05 UTC]

Sorry, I forgot to list the contents of the 10_mod_auth_pam.conf file. I just added the auth_sys_group_module line and it's been working fine:

#<IfDefine AUTH_PAM>
  <IfModule !mod_auth_pam.c>
    LoadModule auth_pam_module          extramodules/mod_auth_pam.so
    LoadModule auth_sys_group_module    extramodules/mod_auth_sys_group.so
  </IfModule>
#</IfDefine>

#<IfModule mod_auth_pam.c>
#    AuthPAM_Enabled on
#    
#    AuthType Basic
#    AuthName "secure area"
#    require group staff
#    require user webmaster
#</IfModule>

[Comment 13 atom 2004-02-19 17:30:02 UTC]

if we're going to add auth_sys_group_module to 10_mod_auth_pam.conf, then it seems logical that the auth_sys_group_module should be installed by the ebuild. this requires uncommenting the line that installs this module.

[Comment 14 Daniele Arduini 2004-02-20 04:04:20 UTC]

OK, I'll submit soon an updated release with all features enabled.

This module require read access (via PAM) to /etc/shadow when pam is configured to use pam_unix.so.
As suggested in Comment #10 From Christian Parpart, there should be a system shadow group with all users/processes who may have read(!) access to /etc/shadow
added to it.

Thers is already that group or any plans to add it?

[Comment 15 Wolf Giesen 2004-03-15 00:19:58 UTC]

Yes, atom, of course - I did that but forgot about it the second I had it working. Guess I lost my head somwhere over the clouds ;-)

So far this has been working very fine for me and has lifted a big weight from my shoulders. I would really see this one in official portage. I'm not actually sure we should address the "shadow" issue directly, though. Actually, I'm not a big fan of ebuilds messing with my group/password files at all. Instead, I'd rather prefer some kind of informal message concerning the shadow issue after the ebuild completes.

Or am I still floating too high here?

[Comment 16 Chuck Short (RETIRED) 2004-06-14 09:53:29 UTC]

I agree ebuilds should not mess with the password/shadow files. Ill have a look at your ebuild tonight and will probably add it tonight as well.

Thanks
chuck

[Comment 17 Chuck Short (RETIRED) 2004-06-14 20:18:24 UTC]

Looks good. commited. Thanks for the ebuild.

[Comment 18 Christian Bartels 2005-01-05 02:05:23 UTC]

the current ebuild in the portage tree does not install mod_auth_sys_group.so so that the "require group bla" directive does not work. here are the necessary patches against the current ebuild.

[Comment 19 Christian Bartels 2005-01-05 02:06:13 UTC]

Created attachment 47687 [details]
diff of the ebuild

[Comment 20 Christian Bartels 2005-01-05 02:06:44 UTC]

Created attachment 47688 [details]
diff of mod_auth_pam.conf

[Comment 21 Christian Parpart (RETIRED) 2005-01-09 15:24:59 UTC]

wrt the "require group"/mod_auth_sys_group.so problem, 
please have a look at bug bug:
http://bugs.gentoo.org/show_bug.cgi?id=57986