0

I am working on a PHP-based website where the login form needs to authenticate against local users on the system via PAM - in other words, they should be able to login successfully if they enter a valid username and password for a local user account on the server. The website originally accomplished this using the php-auth-pam module, but since it has been deprecated, I am currently having to look around for an alternative solution.

I eventually came across this answer with a helpful C script for authenticating against PAM. I successfully compiled it into an executable named chkpasswd, and to check a username/password combo I simply run:

./chkpasswd username password

It outputs "Authenticated" if the credentials are valid, and "Not authenticated" if they are not. That part works like a charm, no problems there.

But pretty soon I realized there was a glaring issue - this setup doesn't work properly when passwords contain special characters! It will say the user is not authenticated even when the credentials are correct. I am calling chkpasswd using PHP's exec() function, and using escapeshellarg() to escape the user input. Here's the PHP code:

function pam_auth2($username, $password){
    $result = exec("/usr/local/sbin/chkpasswd ".escapeshellarg($username)." ".escapeshellarg($password));

    if ($result == "Authenticated"){
        return true;
    }
    else{
        return false;
    }

}

So here are my main questions:

  1. Is it possible to modify either the C script or the PHP code that calls it so that the system properly handles passwords with special characters?
  2. How secure is this setup overall? Are there any glaring vulnerabilities I should know about?
  • 1
    The usernames and passwords dangling out in the open in the process table for ps(1) and such to read is one minor issue with this plan. – thrig Sep 11 '15 at 23:16
  • Have you looked at mod_authnz_external and something like pwauth (code.google.com/p/pwauth/wiki/InstallApache), which talks over a pipe rather than as a command argument? – jsbillings Sep 12 '15 at 12:56
  • @jsbillings omg pwauth is perfect, thank you! Can't believe I didn't find that before. – tlng05 Sep 13 '15 at 14:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.