Nginx with PAM authentication through pam_script

Question

Have anyone set up such a configuration? It's not working for me.

I've installed nginx-extras on Ubuntu 12.04 (it's built with PAM module), and added to site config:

location ^~ /restricted_place/ {
    auth_pam              "Please specify login and password from main_site";
    auth_pam_service_name "nginx";
}

Afterwards, in /etc/pam.d/nginx:

auth    required    pam_script.so dir=/path/to/my/auth_scripts

And wrote simplest /path/to/my/auth_scripts/pam_script_auth (also I've tried to write complicated scripts)

#!/bin/sh
exit 0 # should allow anyone

Doesn't work. The script is launched (I've wrote full functional script, that successfully executes, check credentials, writes to its own log and returns correct exit code, and executes noticeably long). But no access is granted, only rejected.

In /var/log/nginx/error.log appears this line:

2012/09/13 10:44:42 [alert] 1666#0: waitpid() failed (10: No child processes)

If I specify in /etc/pam.d/nginx:

auth    required    pam_unix.so

and grant for www-data user right to read /etc/shadow, unix authorization works fine. But script auth doesn't work.

I can't understand, where the trouble is. Is it in the nginx module, or in the pam_script module?

Answer 1

The nginx PAM module also runs the PAM account operation, so you need to also configure this. You can use the pam_permit module to always succeed:

auth    required    pam_script.so dir=/path/to/my/auth_scripts
account required    pam_permit.so

Answer 2

Try following the auth log (tail -f /var/log/auth.log) while authenticating, it will show you all pam requests and maybe also the error/warning/exception which will make it al clear to you.