Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Can you check the user group from a $remote_user?

location ~ ^/dav/(.*)$ {
    alias /home/$remote_user/$1;
    auth_pam "Restricted";
    auth_pam_service_name "nginx";
    dav_methods PUT DELETE MKCOL COPY MOVE;
    dav_access group:rw all:r;
    create_full_put_path on;
}

location ~ ^/home/(.*)$ {
    alias /home/$1;
    #check the group of the $remote_user;
}

curl -T test.txt 'http://gert:passwd@127.0.0.1/dav/'

curl 'http://friend:passwd@127.0.0.1/home/gert/test.txt'

share|improve this question
    
Can you expand your question, what do you mean by 'select the pam user'? –  EightBitTony Jun 25 '12 at 19:22
    
I just want to prevent a user Joe to use his password to go to a different directory /home/Bart –  Gert Cuykens Jun 25 '12 at 21:44
    
Okay, so you might want to put that detail in the question because it's really not very clear right now. Describe the whole problem you're trying to solve in the question. –  EightBitTony Jun 25 '12 at 21:54
    
changed the question –  Gert Cuykens Jun 25 '12 at 22:01
    

1 Answer 1

up vote 1 down vote accepted

/usr/local/nginx/conf/nginx.conf

location / {
    auth_pam "Restricted";
    auth_pam_service_name "nginx";
}

location ~ ^/dav/(.*)$ {
    alias /home/$remote_user/$1;
    dav_methods PUT DELETE MKCOL COPY MOVE;
    dav_access group:rw all:r;
    create_full_put_path on;
}

location ~ ^/home/(.*)$ {
    alias /home/$1;
}

/etc/pam.d/nginx

auth    required pam_listfile.so onerr=fail item=group sense=allow file=/usr/local/nginx/conf/nginx.group
auth    required pam_unix.so
account required pam_unix.so

/usr/local/nginx/conf/nginx.group

home

curl -T test.txt 'http://gert:passwd@127.0.0.1/dav/'

curl 'http://friend:passwd@127.0.0.1/home/gert/test.txt'

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.