Sort of as a follow up to this: Securest way to authenticate users against /etc/shadow using PHP? and because there hasn't been anything relevant that I've seen on Ubuntu 16.04.

I'm trying to authenticate Linux accounts (Ubuntu 16.04) via HTTP with PECL-PAM but the issue that I run into is that www-data has to be in shadow group in order to authenticate against /etc/shadow. The work around that I found was to use mod_authnz_external and pwauth but the issue with that combination is that past authentication there is no identity to the user logged in that I've been able to find so far.

My end goal is to have users authenticate via HTTP/PHP and then be able to manage files from their home directory (that is, /somedir/$user). I was originally using Webmin but encountered some other issues with the usermin filemin module so switched to a more home made solution.

Is it possible to use the PHP/PAM package to authenticate without www-data being in the shadow group? Or if that's not possible, is it possible to use the mod_authnz_external and pwauth and start a session with the user who logged in?


mod_authnz_external sets the variable PHP_AUTH_USER when a user has been successfully authenticated.

You can start a session like this:


if (isset($_SERVER['PHP_AUTH_USER'])) {
    // Your code which uses the username set in `$_SERVER['PHP_AUTH_USER']`
    // to set up a session.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.