0

I've installed Apache 2.2 and mod_auth_pam2 from ports, but I can't get local UNIX authentication to work. When I access the protected part of my local website, I do get the authentication request, and with pam_permit.so, it works. However, when I change pam_permit.so to the real thing, pam_unix.so, I get this message in httpd-error.log:

[error] PAM: user 'foo' - not authenticated: authentication error

This is the relevant part of my Apache config, though I don't think it's the problem as PAM obviously works:

<Location /foo>
    AuthBasicAuthoritative Off
    AuthPAM_Enabled on
    AuthPAM_FallThrough off
    AuthType Basic
    AuthName "Secret place"
    Require valid-user
</Location>

This is my /etc/pam.d/httpd, though I don't think it's the problem either, since it works with pam_permit.so:

auth    required    pam_unix.so
account required    pam_unix.so

So what am I missing? What does it take to have pam_unix.so work for httpd under FreeBSD?

1 Answer 1

0

I'm not sure what was the problem; I think it's because www didn't have access to /etc/passwd. I thought it was a horrible idea to grant it this access (even for just trying), so instead I removed mod_auth_pam2 and installed mod_authnz_external with pwauth, both from ports. It also has the notable advantage of being an authnz module (rather than an auth module), playing better with the latest versions of Apache. Works like a charm!

This is my new (relevant) httpd config:

AddExternalAuth pwauth /usr/local/bin/pwauth
SetExternalAuthMethod pwauth pipe

<Location /foo>        
        AuthType Basic
        AuthName "Secret place"
        AuthBasicProvider external
        AuthExternal pwauth
        Require valid-user
        Require group wheel
</Location>

And /etc/pam.d/pwauth:

auth    required    pam_unix.so
account required    pam_unix.so
3
  • Be absolutely sure you add some sort of rate limiting mechanism, like fail2ban, or any script kiddie can brute force your passwords and is only limited by your processor and/or bandwidth speeds.
    – Chris S
    Jun 23, 2011 at 3:41
  • @Chris S, that's useful advice for people having the same problem for servers that face the Internet (and I'd like to add that in such a situation, it would be worthwhile to use https instead since a sniffed password could compromise the box). In the actual configuration file, though, I also limit the access to this part of my site to machines on the local network, so I'm not worried about script kiddies.
    – zneak
    Jun 23, 2011 at 6:01
  • Limiting it to your network definitely works. Adding HTTPS would be pretty useless against script kiddies, and isn't necessary to prevent sniffed passwords.
    – Chris S
    Jun 23, 2011 at 12:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .