2

I am trying to have PAM to use the hosting system's "passwd" and "shadow" file to authenticate a user who is using the web application.

I am using RedHat 6, apache is 2.2, module mod_authnz_pam for the apache.

PAM in apache (httpd.conf) is configured as such:

<Location />
  AuthType Basic
  AuthName "basic_auth"
  AuthBasicProvider PAM
  AuthPAMService httpd
  Require valid-user
</Location>

I created a file named httpd in /etc/pam.d with the following configuration

auth    required    pam_unix.so
account required    pam_unix.so
session required    pam_unix.so

SELinux is enabled. "getenforce" returns "Enforcing" I also ran SELinux is on, getenforce returned Enforcing I also ran the following

setsebool -P allow_httpd_mod_auth_pam 1

So I get prompted asking for user credentials when I try to visit the ip address. But when I entered my system credential I get the following logs

unix_chkpwd[29856]: check pass; user unknown

unix_chkpwd[29856]: password check failed for user (username)

localhost httpd: pam_unix(httpd:auth): authentication failure; logname= uid=48 euid=48 tty= ruser= rhost=xxx.xx.xx.x user=username

SELinux is on, getenforce returned Enforcing I also ran the following

setsebool -P allow_httpd_mod_auth_pam 1

my user name definitely exists in passwd and shadow file, but some how PAM is saying it doesn't exist.

What else am I missing?

  • I'm no expert in apache/httpd nor pam, but I do know many inter-process problems with apache stem from SELinux. Can you give us the output of 'getenforce` to see if it might be related? – 0xSheepdog Dec 18 '17 at 20:31
  • By "RedHat 6", you mean "Red Hat Enterprise Linux 6", right? – mattdm Dec 18 '17 at 20:33
  • @mattdm to the rescue. :) – 0xSheepdog Dec 18 '17 at 20:37
  • @0xSheepdog I turned off SELinux so I assumed there shouldn't been any security context issues. But for sanity's check I will enable it, restart, then use the setbool command – ShamanOfTheFrontier Dec 18 '17 at 20:52
  • Yes, please do. Setting SELinux to permissive mode is great for testing. Not for final state. Good luck! Humor but serious > stopdisablingselinux.com – 0xSheepdog Dec 18 '17 at 20:58
0

Set up /etc/pam.d/httpd like this, or similar.

#%PAM-1.0
auth       include    system-auth
account    required   pam_nologin.so
account    include    system-auth
password   include    system-auth
session    optional   pam_keyinit force revoke
session    include    system-auth
session    required   pam_loginuid.so

The idea is you're having the pam stack look at the other files instead for trying to attempt to verify the login. system-auth is typically called by many other pam services such as login, su, and sudo.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.