Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have to use PAM authentication for DAV SVN, but when everything is configured as specified in mod_auth_pam documentation, authentication does not work. After some research I realized, that for this to work, httpd should be running under root user (which I don't like and won't implement) or apache user (under which httpd is running by default) should have permissions to read /etc/shadow file. So there is a pair of questions connected to each other which I want to ask:

  1. Is giving this permition to apache user a wise decision from security point of view?
  2. If answer to the first question is "yes", what is the correct way to do so?

For now I've done following:

groupadd shadow
usermod -G shadow apache
chmod g+r /etc/shadow

Another way I can come up with is using acl:

setfacl -m u:apache:r /etc/shadow

Note: OS is Fedora 14 x86_64 (kernel: 2.6.35.11)

httpd v2.2.17

mod_auth_pam v1.1.1

share|improve this question

1 Answer 1

up vote 2 down vote accepted

No, you should never, ever give a public-accessible service like Apache access to /etc/shadow.

Instead of mod_auth_pam, you could try to use mod_auth_external in conjunction with pwauth.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.