I am trying to have PAM to use the hosting system's "passwd" and "shadow" file to authenticate a user who is using the web application.

I am using RedHat 6, Apache is 2.2, module mod_authnz_pam for the Apache.

PAM in apache (httpd.conf) is configured as such:

<Location />
  AuthType Basic
  AuthName "basic_auth"
  AuthBasicProvider PAM
  AuthPAMService httpd
  Require valid-user

I created a file named httpd in /etc/pam.d with the following configuration:

auth    required    pam_unix.so
account required    pam_unix.so
session required    pam_unix.so

SELinux is enabled. getenforce returns "Enforcing".  I also ran the following

setsebool -P allow_httpd_mod_auth_pam 1

So I get prompted asking for user credentials when I try to visit the IP address. But when I entered my system credentials, I get the following logs

unix_chkpwd[29856]: check pass; user unknown

unix_chkpwd[29856]: password check failed for user (username)

localhost httpd: pam_unix(httpd:auth): authentication failure; logname= uid=48 euid=48 tty= ruser= rhost=xxx.xx.xx.x user=username

My user name definitely exists in passwd and shadow file, but somehow PAM is saying it doesn't exist.

What else am I missing?

  • I'm no expert in apache/httpd nor pam, but I do know many inter-process problems with apache stem from SELinux. Can you give us the output of 'getenforce` to see if it might be related?
    – 0xSheepdog
    Dec 18, 2017 at 20:31
  • By "RedHat 6", you mean "Red Hat Enterprise Linux 6", right?
    – mattdm
    Dec 18, 2017 at 20:33
  • @mattdm to the rescue. :)
    – 0xSheepdog
    Dec 18, 2017 at 20:37
  • @0xSheepdog I turned off SELinux so I assumed there shouldn't been any security context issues. But for sanity's check I will enable it, restart, then use the setbool command Dec 18, 2017 at 20:52
  • Yes, please do. Setting SELinux to permissive mode is great for testing. Not for final state. Good luck! Humor but serious > stopdisablingselinux.com
    – 0xSheepdog
    Dec 18, 2017 at 20:58

1 Answer 1


Set up /etc/pam.d/httpd like this, or similar.

auth       include    system-auth
account    required   pam_nologin.so
account    include    system-auth
password   include    system-auth
session    optional   pam_keyinit force revoke
session    include    system-auth
session    required   pam_loginuid.so

The idea is you're having the pam stack look at the other files instead for trying to attempt to verify the login. system-auth is typically called by many other pam services such as login, su, and sudo.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .