Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Have anyone set up such a configuration? It's not working for me.

I've installed nginx-extras on Ubuntu 12.04 (it's built with PAM module), and added to site config:

location ^~ /restricted_place/ {
    auth_pam              "Please specify login and password from main_site";
    auth_pam_service_name "nginx";
}

Afterwards, in /etc/pam.d/nginx:

auth    required    pam_script.so dir=/path/to/my/auth_scripts

And wrote simplest /path/to/my/auth_scripts/pam_script_auth (also I've tried to write complicated scripts)

#!/bin/sh
exit 0 # should allow anyone

Doesn't work. The script is launched (I've wrote full functional script, that successfully executes, check credentials, writes to its own log and returns correct exit code, and executes noticeably long). But no access is granted, only rejected.

In /var/log/nginx/error.log appears this line:

2012/09/13 10:44:42 [alert] 1666#0: waitpid() failed (10: No child processes)

If I specify in /etc/pam.d/nginx:

auth    required    pam_unix.so

and grant for www-data user right to read /etc/shadow, unix authorization works fine. But script auth doesn't work.

I can't understand, where the trouble is. Is it in the nginx module, or in the pam_script module?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

The nginx PAM module also runs the PAM account operation, so you need to also configure this. You can use the pam_permit module to always succeed:

auth    required    pam_script.so dir=/path/to/my/auth_scripts
account required    pam_permit.so
share|improve this answer

Try following the auth log (tail -f /var/log/auth.log) while authenticating, it will show you all pam requests and maybe also the error/warning/exception which will make it al clear to you.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.