How to debug apache + pam + pam_uinix

Couling · 09-08-2011, 10:11 AM

Hi All

I'm trying to get a section of my intranet to authenticate with system passwords through pam. I'm reasonably experienced at working with apache configuration but very new to PAM.

The problem I'm facing is that it's just not letting me login and I'm struggling to find any helpful debug output.

Any hints on what I may have donw wrong or how I can get more helpful debug would be great.

Apache error log for the vhost lists:

Code:

[Thu Sep 08 14:20:52 2011] [error] [client 127.0.0.1] PAM: user 'phil' - not authenticated: Authentication failure

/var/log/auth lists:

Code:

Sep  8 14:20:50 zbox unix_chkpwd[4739]: check pass; user unknown
Sep  8 14:20:50 zbox unix_chkpwd[4739]: password check failed for user (phil)
Sep  8 14:20:50 zbox apache2: pam_unix(apache2:auth): authentication failure; logname= uid=33 euid=33 tty= ruser= rhost=127.0.0.1  user=phil

/etc/pam.d/apache2 is configured as

Code:

auth      required  pam_securetty.so
auth      required  pam_unix.so shadow audit
auth      required  pam_nologin.so
account   required  pam_unix.so

Relavent apache config for the vhost :

Code:

    <Directory / >
        AuthPAM_Enabled on
        AuthType Basic
        AuthName "svn.pedal.me.uk"
    </Directory>

...


    <Directory /path/to/content >
        Options Indexes FollowSymLinks
        AllowOverride None

        Order allow,deny
        Allow from all

        require user phil
    </Directory>

Couling · 09-11-2011, 01:09 PM

Solved it.

It turns out there were a number of things wrong. To get mod_auth_pam you appear to need the authentication architecture loaded, but mod_auth_pam is not an auth provider itself, so I had to make sure the following were loaded:

mod_auth_basic
mod_authN_file
mod_authz_user

Once that was done I also needed to set this in the apache config:
AuthBasicAuthoritative off

mod_auth_pam isn't a Basic Auth provider (despite its appearances). The result is that you need to have another auth provider (mod_authn_file is easiest) to fail to find the user first before mod_auth_pam will kick in.

To keep the error log quiet I've also added in an empty auth file and configured apache to use that:
AuthUserFile config/authn

Hope this helps someone else