Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

This question is split between the realm of SO and SF. It's for a coding project but I believe the error I'm encountering has more to do with system administration than code, so I'll put it here.

I'm trying to make a PHP login page that authenticates users on their pre-existing system user accounts. I installed the php5 pam authentication module and followed the documentation to configure it.

I created /etc/pam.d/php with the following contents:

# /etc/pam.d/php
#
# note: both an auth and account entry are required

auth    sufficient      /lib/security/pam_pwdb.so shadow nodelay
account sufficient      /lib/security/pam_pwdb.so

I added "pam.servicename = "php";" to my /etc/php5/apache2/php.ini file and then restarted my apache service.

Every time my script uses the pam_auth function, the following appears in my auth.log:

Jan  6 08:56:33 cobalt apache2: PAM unable to dlopen(/lib/security/pam_pwdb.so)
Jan  6 08:56:33 cobalt apache2: PAM [error: /lib/security/pam_pwdb.so: cannot open shared object file: No such file or directory]
Jan  6 08:56:33 cobalt apache2: PAM adding faulty module: /lib/security/pam_pwdb.so

How can I fix this? For something as simple (or so I thought), should I just write my own functions to parse /etc/shadow and /etc/passwd? I'm not trying to log the user into the system itself, I just need to let the user log into my script with their system user/password and check that they belong to an appropriate group to run a given report.

share|improve this question
    
Does the file /lib/security/pam_pwdb.so exist? –  Clinton Blackmore Jan 6 '10 at 15:28

2 Answers 2

You should use pam_unix instead of pam_pwdb Which OS/distribution are you running?

share|improve this answer
    
This put me on the right path. I changed it to pam_unix in /etc/pam.d/php. It now logs an authentication error when I try to log in. After reading the documentation, it seems that this is because only root is allowed to read /etc/shadow. It recommended using chgrp to set /etc/shadow's group to the webserver's group. I am a bit wary of doing this. The pre-set group on /etc/shadow is "shadow". Will changing that mess anything up? Also, I forgot to mention in my question that I'm running Ubuntu Server 8.04 LTS –  DWilliams Jan 6 '10 at 18:08

Looks like your /lib/security/pam_pwdb.so file doesn't exist

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.