Re: pam_unix.so and unix_chkpw setgid - does it work for regular users?

On Thu, Aug 02, 2012 at 05:36:55PM +0200, Wolfgang Draxinger wrote:
> I'm currently trying to configure user authentication on a webserver,
> that shall use the normal system user names and passwords. I'm using
> Nginx as webserver, together with the auth_pam module, as packages by
> Debian wheezy.

> I expected that since unix_chkpw is set setgid shadow I could use
> pam_unix.so for the webserver service just as is. However it turned
> out, that the user for the webserver process must be in the group
> "shadow" for authentication to work. If the webserver can't read shadow
> it doesn't work.

> I was under the impression the idea of unix_chkpw was to have process
> separation and by having a thoroughly audited helper program, that can
> be setgid safely so that a regular user can perform pam_unix.so tests.

It's so that a regular user can *self* authenticate.  Allowing users to call
this setgid helper directly for other accounts would let them use it for
brute forcing of passwords.  So no, what you're asking for is disallowed by
design.

-- 
Steve Langasek                   Give me a lever long enough and a Free OS
Debian Developer                   to set it on, and I can move the world.
Ubuntu Developer                                    http://www.debian.org/
[email protected]                                     [email protected]

_______________________________________________
Pam-list mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/pam-list

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAEBCAAGBQJQGtlXAAoJEFaNMPMhshM9JkQP/3ZwxM4z0ubwN0966EPmmCAl
Gxwtzrxw+XbLObUAzEdVXHQDD9nm7QX0glyD4OxKRAEfMelsxSuG6+JSDhAR6ikd
uEFKmQPATh844CUjRdlKkWMytNXHbZ7v2M+lNYKxw4WEdcd7JPnTNMOEBiA0Ogis
CDcsh/1wVwT8yaZBETERhfP5xHMd2h1FrLXGaKDAdddCeG7v4l9nR6ZfzFjD/Uvh
k9PRsT7G9qq5aBFKZHZfJNXrwEx5qTFI16UR2xcITNXptjXXEqQSwgi85nRAo8Q5
Ot8OwD5fQog6kNfxzybsY3+aXhZnJA/s9vK+WhZUZFvYaUzHly5RYid7gH71S3hR
/t6xly+goz7VA08dAmjChJaFff6M5n3w5NKgN2fYtiht1/+mh5KWc84b/8+wbSmR
Aws17dBvskqLKA3F2a0xlqb6MC3CDkRN+JNnuo/yBKWdti4kNG9TAqzDcH9bdPmZ
KPgnfkavf7zlisJM/4by00Afo+cGaL14jhUIuMwA/joczRyTAJKBVifGiMQy7ofs
IDeKD31jpNjGzvFgbv5/F+RrVGZ3mJkkBSOCtEELcLIVgcaZfPonQfW+SmQw0ADs
X8qkVLMHfYkl0Tt2WjBzM7zaxVJMqnsCK8NINHOySgDr2ATx8gAVB/Ne7EmmUbwa
64Yp4utNSCzfc/b1cSJo
=70Ge
-----END PGP SIGNATURE-----