Feedback on Chkpass.pl Idea

"Adam Aube" <[email protected]> Mon, 4 Aug 2003 11:24:26 -0400
Newsgroups gmane.comp.djb.checkpassword
Message-ID <[email protected]>
I've written and released a Perl-based checkpassword implementation
that uses a Squid basic auth helper for the actual authentication.

The program is available at:

http://www.firstindependent.net/chkpass.tar.gz

Squid's auth helpers are designed to run continuously, so starting
and terminating the helper for every chkpass instance causes some
unnecessary overhead. There's also memory overhead in the additional
modules needed.

I was considering rewriting the program to be a two-part system. A
daemonized Perl program would open a named pipe and spawn a single
instance of the auth helper. It would then listen for messages from
the individual chkpass instances. It would not have to run as root.

Upon receiving a message, it would query the auth helper and reply
by sending a signal to the chkpass instance (SIGCONT = Auth succeeded,
SIGHUP = Auth failed). This daemon program would also handle logging
for the chkpass instances.

This would reduce some overhead in spawing the Squid auth helper and
in logging, but the daemon process would process messages from the
chkpass instances serially, so there could be more latency.

The question is, is the tradeoff worth it? Any opinions?

Adam
---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.237 / Virus Database: 115 - Release Date: 3/7/2001