Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've installed Apache 2.2 and mod_auth_pam2 from ports, but I can't get local UNIX authentication to work. When I access the protected part of my local website, I do get the authentication request, and with pam_permit.so, it works. However, when I change pam_permit.so to the real thing, pam_unix.so, I get this message in httpd-error.log:

[error] PAM: user 'foo' - not authenticated: authentication error

This is the relevant part of my Apache config, though I don't think it's the problem as PAM obviously works:

<Location /foo>
    AuthBasicAuthoritative Off
    AuthPAM_Enabled on
    AuthPAM_FallThrough off
    AuthType Basic
    AuthName "Secret place"
    Require valid-user
</Location>

This is my /etc/pam.d/httpd, though I don't think it's the problem either, since it works with pam_permit.so:

auth    required    pam_unix.so
account required    pam_unix.so

So what am I missing? What does it take to have pam_unix.so work for httpd under FreeBSD?

share|improve this question

1 Answer 1

up vote 0 down vote accepted

I'm not sure what was the problem; I think it's because www didn't have access to /etc/passwd. I thought it was a horrible idea to grant it this access (even for just trying), so instead I removed mod_auth_pam2 and installed mod_authnz_external with pwauth, both from ports. It also has the notable advantage of being an authnz module (rather than an auth module), playing better with the latest versions of Apache. Works like a charm!

This is my new (relevant) httpd config:

AddExternalAuth pwauth /usr/local/bin/pwauth
SetExternalAuthMethod pwauth pipe

<Location /foo>        
        AuthType Basic
        AuthName "Secret place"
        AuthBasicProvider external
        AuthExternal pwauth
        Require valid-user
        Require group wheel
</Location>

And /etc/pam.d/pwauth:

auth    required    pam_unix.so
account required    pam_unix.so
share|improve this answer
    
Be absolutely sure you add some sort of rate limiting mechanism, like fail2ban, or any script kiddie can brute force your passwords and is only limited by your processor and/or bandwidth speeds. –  Chris S Jun 23 '11 at 3:41
    
@Chris S, that's useful advice for people having the same problem for servers that face the Internet (and I'd like to add that in such a situation, it would be worthwhile to use https instead since a sniffed password could compromise the box). In the actual configuration file, though, I also limit the access to this part of my site to machines on the local network, so I'm not worried about script kiddies. –  zneak Jun 23 '11 at 6:01
    
Limiting it to your network definitely works. Adding HTTPS would be pretty useless against script kiddies, and isn't necessary to prevent sniffed passwords. –  Chris S Jun 23 '11 at 12:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.