./0040755000000000000000000000000013367657777007751 5ustar rootrootusr/0040755000000000000000000000000013367657777010425 5ustar rootrootusr/libexec/0040755000000000000000000000000013367657777012040 5ustar rootrootusr/libexec/pwauth0104755000000000000000000002436013367657777013304 0ustar rootrootELF> @@!@8 @@@@@@88@8@@@dd `` @@`@`TT@T@ Ptd@@TTQtdRtd``/lib64/ld-linux-x86-64.so.2GNU     }  `"h + : xN libcrypt.so.1_ITM_deregisterTMCloneTable__gmon_start___Jv_RegisterClasses_ITM_registerTMCloneTablecryptlibc.so.6exitstrncpytimestdinfgetsgetpwnamstrlen__errno_locationlseekbzerogetspnamgetenvgetuidsetrlimitcloseopenstrchrsleepfcntlaccessstrcmp__libc_start_mainwriteGLIBC_2.2.5 ui (nui (```` ` ` `( `0 `8 `@ `H ` P ` X ` ` ` h ` p `x ` ` ` ` ` ` ` ` ` ` `HH HtH5 % @% h% h% h%z h%r h%j h%b h%Z hp%R h`%J h P%B h @%: h 0%2 h %* h %" h% h% h%  h% h% h% h% h% h% f1I^HHPTI@H@H` @fDH= H UH)HHvH Ht ]fD]@f.H=y H5r UH)HHHH?HHtHY Ht ]f]@f.=1 ubUHW H( HATSHK L%< H)HHH9s@HH AH H9r[A\] H= H?u .fDH HtUH]UHHPHHDžHHHHƿ6EEEEH `tEH `;EuۋEH `;Et 2H HH/Ht H HHHu 3H HHEH}tHEH HvHEH}tHEHHHHǸEHHHHHH}uuE}u# EUHH0H}HuHEHFHEE.‰ ‰)‰ЉEH}u  u 5 HEHHEH}u HE@; - + = HEHPHEHHǸHEHEHPHEHH'tpHEH@8HxHEHP8EHH9}JHEH@Hu6HEH@ Hx$HEHPHEH@ H‹EHH9}UHH@\@HEa@HEHH d@HH}t5HEHH=w!HEHHJ$HHg/H}t!HEHHJ$HH?ƅi@"E}xX HcHHHHHHHEHΉFHE$HΉE3UHz@t ]UHH@}fEfEHEHEB@HE}xHUЋEǸ7Ẻ]EAWAVAAUATL%v UH-n SIIL)HHHt 1LLDAHH9uH[]A\A]A^A_Ðf.f.@H Ht(UHSH HHHHuH[]HoHHOSTIPhttp/var/log/lastlog/etc/nologin/var/run/pwauth.lock;P dl F$|DddzRx *zRx $0FJ w?;*3$"DAC dxAC s <AC 7 6AC q 0xAC s DeBBE B(H0H8M@r8A0A(B BBB,n @ @ H@x@@8@ 4  `(@@x o`@oo$@@` @ @ @ @ @ @ @ @ @ @& @6 @F @V @f @v @ @ @ @ @ @ @ @HPGCC: (GNU) 5.3.0GCC: (GNU) 5.5.0.shstrtab.interp.note.ABI-tag.hash.dynsym.dynstr.gnu.version.gnu.version_r.rela.dyn.rela.plt.init.plt.got.text.fini.rodata.eh_frame_hdr.eh_frame.ctors.dtors.jcr.dynamic.got.plt.data.bss.comment 8@8T@T !x@x' 8@8/@47o$@$:Do`@`@S@x]B@(g@ @@ $bp @p m @ v @ G|H@HX@XD@T@t`(`(8`8@`@q`  `  `  ` 0 "!usr/lib64/0040755000000000000000000000000013367657777011345 5ustar rootrootusr/lib64/httpd/0040755000000000000000000000000013367657777012470 5ustar rootrootusr/lib64/httpd/modules/0040755000000000000000000000000013367657777014140 5ustar rootrootusr/lib64/httpd/modules/mod_authnz_external.so0100755000000000000000000004457013367657777020567 0ustar rootrootELF>@B@8@55 ;; ; 8 (>(> (> Ptd000QtdRtd;; ; HH%5)$ '34!1,2-"+0 &.* # %(/hnuE A 'LA V () Zx1 &SF_A 5SA 6a `A p8 kR"h(__gmon_start___init_fini_ITM_deregisterTMCloneTable_ITM_registerTMCloneTable__cxa_finalize_Jv_RegisterClassesap_register_auth_providerap_hook_optional_fn_retrieveapr_dynamic_fn_retrieveauthz_owner_get_file_groupstrcasecmpauthnz_external_modulegetenvapr_pstrcatap_get_remote_hostapr_table_getap_getword_whiteapr_procattr_createapr_procattr_io_setapr_procattr_cmdtype_setapr_procattr_detach_setapr_procattr_child_errfn_setapr_signalapr_proc_createapr_pool_note_subprocessstrlenapr_file_write_fullapr_file_putcapr_file_closeapr_proc_waitap_log_rerror___errno_locationapr_file_open_stderrapr_strerrorap_escape_logitemapr_file_printfap_getword_confapr_table_setapr_array_pushapr_pstrdupapr_pallocapr_table_makeapr_array_makemock_turtle_cacheapr_sha1_base64ap_set_string_slotap_set_flag_slotlibc.so.6_edata__bss_start_endmod_authnz_external.soGLIBC_2.2.5Bui {; @ ; "< ' < >*(< %@< 0-H< K*P< P%h< p-p< ^*x< %< -< n*< $< -< *< 0.< *< p$= `.= *=  $0= .8= *@= #X= -`= *= .= *= @/= *= /= += /@A @A pA )A @&A %A  < A P< 2h= 2= = = ? ?  ? ? )? +? -? 0@  @ (@ 0@ 8@ @@ H@  P@  X@  `@ h@ p@ x@ @ @ @ @ @ @ @ @ @ @ @ @ !@ "@ $@ %@ &A 'A (A *A , A .(A /0A 38A 4HHU+ HtsiH5r+ %t+ @%r+ h%j+ h%b+ h%Z+ h%R+ h%J+ h%B+ h%:+ hp%2+ h`%*+ h P%"+ h @%+ h 0%+ h % + h %+ h%* h%* h%* h%* h%* h%* h%* h%* h%* hp%* h`%* hP%* h@%* h0%* h %* h%* h%z* h%r* h %j* h!%b* h"%Z* h#%R* h$%( f%( fH=* H* UH)HHvH( Ht ]fD]@f.H=* H5* UH)HHHH?HHtHq( Ht ]f]@f.=9* uzH=G( UHATSt H=) BH $ H $ H * L%# H)HHH9s!fDHH) AH) H9r[A\]) Ðf.H=# H?u fDH' HtUH]SL# H HH5AH5Ln# H HH5HA H HH5L# HA[H= 11f.H={H H=H( H& HH@f.AWAVIAUATIUSHHHBHLD$(D$8D$<HD$1HD$ H5LIQH5tL:D$H& D$E1D$$$D$ HcPHHHD$H=H51HH1{IcH51HDpHL1]HcT$$H1H|$HDp1HD|$t'H5{H1H1EHcT$AHDpHEHtH521H1McAJDpHPEHtH51H1AMcJDpHH5EHt"H5H1H1Mc}AJDpHD$EHPHt H}H511AKMcJDpHH5EHt"H5H1H1McAJDpMcJDpA>Lt$HL$E1Lt$HfIA"tLHAWIEHD$H8uH|$@McHJDŽ _t$$T$ H|$@!!9IH|$@փZt$ H|$@tH|$@H50{A1Lt$PLD$@H$HL$pH$ILIwMLHD$Eto|$L8H\$XL=1HLH=H޿ L|$(LLH1HH޿ H^HT$HH8HII~H HItH51HILD$H LLLA*H $QtPHt$L$$;HIHHIE1PH=v1Y^H[]A\A]A^A_DH1[]A\A]A^A_H ME1PHSPf.H Ht(UHSH HHHHuH[]H_H0externalauthnexternal-groupauthzexternal-file-groupap_authn_cache_storeauthz_owner_get_file_groupcheckpasswordUSER=PATHPATH=AUTHTYPE=IP=URI=HostHTTP_HOST=CONTEXT=CookieCOOKIE=mod_authnz_external.cpipespipeGROUP%s: (%d) %s functionPASSAuthExternalDefineExternalAuthAddExternalAuthSetExternalAuthMethodGroupExternalDefineExternalGroupAddExternalGroupSetExternalGroupMethodAuthExternalContextAuthExternalProvideCacheGroupExternalManyAtOnceAuthExternalGroupsAtOncecould not set child process attributesCould not run external authenticator: %d: %sCould not get status from child processExternal authenticator died on signal %dinvalid GroupExternal keyword (%s)Authorization of user %s to access %s failed. User not in Required file group (%s).Authorization of user %s to access %s failed. User not in Required group.No AuthExternal name has been setInvalid AuthExternal keyword (%s)AuthExtern %s [%s]: Failed (%d) for user %sone (or more) keywords indicating which authenticators to usea keyword followed by auth method and path to authentictora keyword followed by a path to the authenticator programa keyword followed by the method by which the data is passeda keyword indicating which group checker to usea keyword followed by auth method type and path to group checkera keyword followed by a path to the group check programAn arbitrary context string to pass to the authenticator in the CONTEXT environment variableShould we forge authentication credentials for mod_authn_socache?Set to 'off' if group authenticator cannot handle multiple group names in one invocationOld version of 'GroupExternalManyAtOnce';x8(H@XX8 P(xzRx $`FJ w?;*3$"DPAd2Kf| BBE B(D0A8JN 8D0A(B BBBK ^LBhHAWbAAPqHHApXUBB H(A0(A BBBC0T8F@IHAPX0A (C BBBJ _8D@U8C0A(A BBB<8jBBD A(OK(A ABBhUBB B(A0A8DPXg`FhApKPF8A0A(B BBBGPuXA`HXAPF 8A0A(B BBBI d8F0A(B BBB1Dl$KAAM wCA,FBAD yCB1Dl$,KAAM wCA,T@FBAD yCB,`/BAD dAB$`cAAL ODA$SAAL BAA4SLAD Jr AAB<BBB B(D0A8DPcXh`BhBpAxASPXO`TXAPI 8A0A(B BBBF D 8C0A(B BBBH bXA`@ "'>*%0-K*P%p-^*%-n*$-*0.*p$`.* $.*#-*.*@/*/+/Bd h ()  @ x  o oo o((> &6FVfv&6FVfv@A 3S)42PA@&% < PGCC: (GNU) 5.5.0.shstrtab.hash.dynsym.dynstr.gnu.version.gnu.version_r.rela.dyn.rela.plt.init.plt.got.text.fini.rodata.eh_frame_hdr.eh_frame.ctors.dtors.jcr.data.rel.ro.dynamic.got.plt.data.bss.comment p !o j.o =  GBxQhh$L`W`'f()()l28)8)t0000; ;; ;; ;; ;H (> (>[? ?8@ @@@A @A A A 0AAusr/doc/0040755000000000000000000000000013367657777011172 5ustar rootrootusr/doc/mod_authnz_external-3.3.2/0040755000000000000000000000000013367657777015705 5ustar rootrootusr/doc/mod_authnz_external-3.3.2/pwauth/0040755000000000000000000000000013367657777017215 5ustar rootrootusr/doc/mod_authnz_external-3.3.2/pwauth/README0100644000000000000000000000611211643055147020044 0ustar rootroot pwauth 2.3.10 Author: Jan Wolter http://www.unixpapa.com/pwauth/ Pwauth is a conceptually a simple program. You run it, giving it a login and a password, and it returns a status code telling whether or not that login/password is valid. It is designed to be combined with mod_auth_external (or mod_authnz_external) and Apache to give reasonably secure HTTP authentication from a Unix password file, though it can be used in other ways too. Mod_auth_external and mod_authnz_external are available from http://www.unixpapa.com/mod_auth_external/ Pwauth ends up being slightly more complex because of the lack of consistancy in the way different versions of Unix do authentication. It includes code for doing low-level authentication in most different versions of Unix. It also can be configured to use one higher-level interface to authentication, PAM. All configuration is compiled in, because in typical applications this program runs very frequently (on every web hit on a protected page), so the cumulative overhead of reading a config file on every run would be substantial. I believe that mod_auth_external, with the included pwauth program, is the most secure method for doing web authentication out of unix shadow password systems. Mod_auth_pam or mod_auth_system can also do this, but since they are internal authenticators, they will only work if you make the shadow password file readable to the http server. This means that if there are any exploitable vulnerabilities in the http server, then it may be possible for people to grab a copy of your shadow password file. Worse, any CGI program on your system which is not run under suExec or cgiwrap also has read access to your shadow password database, and any bugs in these might also expose your entire password database. When mod_auth_external and pwauth are used, neither the http server nor any CGI programs are given access to the shadow database. Only the "pwauth" program does. Since it is a small and simple program, it is much easier to assure that it does not have security weaknesses. Having said that, authenticating from a Unix password file is an idea that many sensible people find seriously questionable. See Apache's FAQ (http://httpd.apache.org/docs/misc/FAQ-G.html#passwdauth) for a overview of some of the issues. Pwauth has features that can address most of the arguments made here, if correctly configured, but you need to be aware of the issues and extremely careful. I've used it for many years without problems on systems that are under almost continuous assault by hackers, but none of those systems are at all typical in their security requirements. You should think hard about using this software and proceed with caution. Installation instructions are in the INSTALL file. The FORM-AUTH file discusses using this in form-based authentication applications. Configuration information is in the comments in the "pwauth.h" file. Versions of pwauth before version 2.2.8 were distributed as part of the mod_auth_external distribution. Author and Maintainer: Jan Wolter http://www.unixpapa.com/ usr/doc/mod_authnz_external-3.3.2/pwauth/CHANGES0100644000000000000000000001041211643055224020151 0ustar rootrootPwauth Change Log ================= VERSION 2.3.10 - Oct 5, 2011 - Changed the serialized sleep code in snooze.c to use fcntl() locking instead of flock() locking. Fcntl() locking is a POSIX standard and is likely to work better on more systems, notably including Solaris which doesn't seem to support flock() at all any more. - Minor fixes to typos in various documentation. VERSION 2.3.9 - May 2, 2011 - Add AUTHENTICATE_AIX option for authenticating via AIX's authentication configuration system. Thanks to Hans Dieter Petersen of the University of Bonn for this implementation. - Renamed PAM_OS_X configuration setting to PAM_OLD_OS_X since it only is needed for OS X 10.5 and older. - Rearranged ifdef's so that undefining SLEEP_LOCK actually completely disables the sleep-on-failure behavior. - Minor documentation fixes VERSION 2.3.8 - Apr 3, 2009 - Undefining SERVER_UIDS now disables the runtime uid check. Documentation added to suggest using this, together with group execution permissions on the binary, to create a group for users who can run pwauth. Thanks to Adi Kriegisch for suggesting this. - Return a distinct status code if authentication fails because we are not running as root. This is currently only done for SHADOW_SUN, SHADOW_BSD, SHADOW_AIX, and SHADOW_MDW. It's just to help confused installers figure out why things aren't working. - Warn installers that they may need to install PAM development packages. VERSION 2.3.7 - Jan 9, 2009 - DOCUMENTATION FIX ONLY - Corrected erroneous AuthBasicProvider command in INSTALL file. VERSION 2.3.6 - May 19, 2008 - Add PAM_OS_X option. - Clarified comments in config.h. - Replace wildly obsolete inclusion of strings.h with inclusion of string.h VERSION 2.3.5 - Dec 17, 2007 - Fixed return codes from AIX and HPUX versions (thanks to Paul Marvin for finding this bug). VERSION 2.3.4 - Nov 11, 2007 - Fixed PAM_SOLARIS define. VERSION 2.3.3 - Sep 1, 2007 - Don't allow logins during inactive period after password expiration. VERSION 2.3.2 - Feb 19, 2006 - Update documentation to discuss usage with mod_authnz_external. - Update documentation to discuss use of mod_authz_unixgroup instead of the unixgroup script. - Drop "development release" notation. VERSION 2.3.1 - Jan 10, 2005 - Fix the checks for expired passwords and expired accounts for LOGIN_CONF_OPENBSD configurations. - Fix the handling of the pam_message argument to the conversation function for Solaris. The old handling was right for Linux PAM and OpenPAM, but not for Solaris. However, the bug occurs only when the PAM modules passes more than one prompt to the conversation function, which should probably never happen. VERSION 2.3.0 - Sep 28, 2004 - Status code values returned by pwauth have changed. 0 is still success, of course, but there is a much wider range of non-zero error codes returned to indicate different causes of login failure. - Pwauth now checks for /etc/nologin file by default. Undefine NOLOGIN_FILE in config.h if you don't want this behavior. - Pwauth now checks if an account is expired and refuses logins if it is. Undefine CHECK_LOGIN_EXPIRATION in config.h if you don't want this behavior. - Pwauth now checks if an account's password has expired and refuses logins if it is and if logins are supposed to be disabled when the password has expired. Undefine CHECK_PASSWORD_EXPIRATION if you don't want this behavior. - Added support for authenticating through login.conf interface on OpenBSD. Support for login.conf systems on other versions of Unix is not yet here. - Added support for OpenBSD failure logs. - Source code split into multiple files. - Added 'checkfaillog' program which CGIs can run to report/reset failures and admins can run to reset failure counts. VERSION 2.2.8 - Sep 25, 2004 - First separate distribution of pwauth. This version is identical to the version in the mod_auth_external version 2.2.8 package, except for repackaging and slight modifications to the documentation. Versions of pwauth previous to version 2.2.8 were distributed as part of the mod_auth_external package, and change-log information is included in pwauth change log. usr/doc/mod_authnz_external-3.3.2/pwauth/INSTALL0100644000000000000000000001763411643053026020222 0ustar rootrootInstallation Notes for pwauth.c ------------------------------- This program is designed to be used with Apache to authenticate users out of the password file. To use it for basic authentication, follow the instructions below. See the FORM_AUTH instructions for notes on using it with other forms of authentication. (1) Install mod_auth_external or mod_authnz_external in Apache. This version of pwauth requires mod_auth_external version 2.1.1 or later. You can either recompile Apache with the new modules, or install them as dynamically loaded modules. See the module installation instructions for detail. (2) Edit the config.h file in this directory to set the configuration appropriate for your system. There are lots of comments in the file. (3) If you are using PAM on Linux, you could be missing the header files you need to compile the auth_pam.c file. You may need to load some sort of PAM development module this isn't part of the standard install to get these headers. (4) Edit the Makefile in this directory, setting appropriate CC, LIB and LOCALFLAGS variables. (5) Do "make" to compile the program. (6) If you are using PAM, you need to do some work on the configuration files. Depending on your operating system, you'll either need to create a /etc/pam.d/pwauth file or edit the /etc/pam.conf file. If you have a /etc/pam.d directory, you need to create a file named "pwauth" inside it. The contents of this file are going to be entirely different for different versions of Unix, since there is no standardization here. Your best bet is probably to take an existing file in that directory and modify it. The few ancient examples listed below should be taken more as examples of the general appearance of these things than as useful prototypes. To authenticate out of the Unix Shadow file under Redhat 6.x, the /etc/pam.d/pwauth file would look something like this: auth required /lib/security/pam_pwdb.so shadow nullok auth required /lib/security/pam_nologin.so account required /lib/security/pam_pwdb.so Under OS X 10.4.11, the following is reported to work (possibly the pam_securityserver line should be removed): auth required pam_nologin.so auth sufficient pam_securityserver.so auth sufficient pam_unix.so auth required pam_deny.so account required pam_permit.so If you have a /etc/pam.conf file instead of a /etc/pam.d directory, then you need to add appropriate lines to that instead. For Solaris 2.6, you need to add lines like this to authenticate out of the shadow file: pwauth auth required /lib/security/pam_unix.so pwauth account required /lib/security/pam_unix.so You can authenticate from a SMB server if you have installed the pam_smb package (available from http://samba.org/samba). On Solaris 2.6, the /etc/pam.conf lines to do this would be something like: pwauth auth required /lib/security/pam_smb_auth.so.1 You may want a "nolocal" flag on that line if you are authenticating from a remote server, or you may not. Note that if you configure pam_smb so that root access isn't required, you should be able to use mod_auth_pam instead of mod_auth_external and pwauth and get faster authentications. (7) Test the pwauth program. As root, you can just run the thing, type in a login (hit return) and a password (hit return), and then check the exit code (in csh: "echo $status" in sh: "echo $?"). It should be 0 for correct login/password pairs and 1 otherwise. (8) Install it in some sensible place (say, /usr/local/libexec/pwauth). Unless you are doing SHADOW_NONE, it should be suid-root, so that it has the necessary access to read the shadow file. That is, the file should be owned by root, and you should do "chmod u+s pwauth" on it. After you've installed it, it is worth su-ing to whatever account your httpd runs under and testing pwauth again from that account. This should confirm that all the uid's and suid-bits are configured correctly. On OpenBSD the master password database is readable (but not writable) to group _shadow, so you should be able to install it sgid to group "_shadow" instead of suid root. However, I've not been able to make this work. (8) If you are using pwauth with mod_auth_external, add to the Apache server configuration file directives that give the full path to wherever you installed this program and designate the pipe method for communicating with the authenticator. For example: AddExternalAuth pwauth /usr/local/libexec/pwauth SetExternalAuthMethod pwauth pipe It is possible to use this module with the "environment" method instead of the "pipe" method by compiling it with the ENV_METHOD flag defined, however this has security problems on some Unixes. (9) Put an .htaccess file in whatever directory you want to protect. (For .htaccess files to work, you may need to change some "AllowOverride None" directives in your httpd.conf file into "AllowOverride AuthConfig" directives). A typical .htaccess file using mod_auth_external would look like: AuthType Basic AuthName Your-Site-Name AuthExternal pwauth require valid-user A typical .htaccess file using mod_authnz_external would look like: AuthType Basic AuthName Your-Site-Name AuthBasicProvider external AuthExternal pwauth require valid-user Alternately, you can put a block with the same directives in your httpd.conf file. (10) Test it by trying to access a file in the protected directory with your web browser. If it fails to accept correct logins, then check Apache's error log file. This should give some messages explaining why authentication failed. If it was unable to execute pwauth, check that the pathnames and permissions are all correct. If it says that pwauth failed, it will give the numeric return code. The numeric return codes returned by pwauth are as follows: 0 - Login OK. 1 - Nonexistant login or (for some configurations) incorrect password. 2 - Incorrect password (for some configurations). 3 - Uid number is below MIN_UNIX_UID value configured in config.h. 4 - Login ID has expired. 5 - Login's password has expired. 6 - Logins to system have been turned off (usually by /etc/nologin file). 7 - Limit on number of bad logins exceeded. 50 - pwauth was not run with real uid not in the SERVER_UIDS list. If you get this error code, you probably have SERVER_UIDS set incorrectly in pwauth's config.h file. 51 - pwauth was not given a login & password to check. The means the passing of data from mod_auth_external to pwauth is messed up. Most likely one is trying to pass data via environment variables, while the other is trying to pass data via a pipe. 52 - one of several possible internal errors occured. You'll have to read the source code to figure these out. 53 - pwauth was not able to read the password database. Usually this means it is not running as root. (PAM and login.conf configurations will return 1 in this case.) If you want to allow users of only certain groups to login, the perl "unixgroup" command included in this directory will do the job, though not very efficiently. If you are using mod_authnz_external, a better approach is to use mod_authz_unixgroup. This will not only allow you to restrict logins to users in particular groups, but restrict access to individual files based on group ownership of the files, if used with the standard Apache module mod_authz_owner. usr/doc/mod_authnz_external-3.3.2/pwauth/FORM_AUTH0100644000000000000000000000475111165563124020500 0ustar rootroot Using PWAUTH with Form Authentication Although 'pwauth' was designed for use with the mod_auth_external Apache module to do "Basic Authentication", it can also be "Form Authentication". In "Form Authentication" you display a login form in HTML, like
Login:
Password:
When a person submits this form, the "login.cgi" program gets run. It checks the login and password, and if they are correct, initiates a session for the user. See http://unixpapa.com/auth/ for more information about this, including explanations about why it is important for good security to use "METHOD=post", and to turn off caching both on the login form page and on the first page transmitted after a successful login. It is possible to use 'pwauth' (or any other authenticator written for mod_auth_external) with this kind of authentication system. All you have to do is have your CGI program run 'pwauth' when it wants to check the password. Here's a sample function in Perl that does exactly this. It assumes that the 'pwauth' program has been compiled with ENV_METHOD *NOT* defined (which is generally more secure). $pwauth_path= "/usr/local/libexec/pwauth"; sub trypass { my $userid= $_[0]; my $passwd= $_[1]; open PWAUTH, "|$pwauth_path" or die("Could not run $pwauth_path"); print PWAUTH "$userid\n$passwd\n"; close PWAUTH; return !$?; } Obviously the $pwauth_path should be defined to wherever you install pwauth, and the die() call should be replaced with whatever is an appropriate way to handle a fatal error in your CGI program. Note that pwauth must be configured so that SERVER_UIDS includes whatever uid your CGI program runs as. Normally this is the same user ID that httpd runs as, but if your CGIs are running under suExec, then you may need to include other uid numbers. You may want to examine the return code from pwauth more carefully than is done in this example, so that you can tell the user if his login was rejected due to logins being turned off, his account being expired, or his password being expired. Though in some configurations pwauth will return different return codes for bad password and bad login name, it is generally considered good practice NOT to tell the user which of these two occured. With reasonable caution, this is as secure as using 'pwauth' with mod_auth_external or mod_authnz_external. usr/doc/mod_authnz_external-3.3.2/UPGRADE0100644000000000000000000001201211643333402016653 0ustar rootrootHow to upgrade from mod_auth_external to mod_authnz_external: (0) Read the section entitled "Authn / Authz" in the README file. This will probably make understanding this new version of the module easier. (1) Make sure mod_auth_external is no longer being loaded. You cannot load both mod_auth_external and mod_authnz_external without problems. This means ensuring that there is no "LoadModule" or "AddModule" line for mod_auth_external. You could also remove the mod_auth_external.so file from the Apache 'modules' directory. (2) Install mod_authnz_external as described in the INSTALL file. (3) The server-level configuration directives in the httpd.conf file are the same as before. There has been no change to the way "AddExternalAuth", "AddExternalGroup", "AddExternalAuthMethod", and "AddExternalGroupMethod" work. (4) In the per-directory configurations (either in .htaccess files or in a block in httpd.conf) need to include a new directive to tell mod_auth_basic to use mod_authnz_external for authentication. For mod_auth_external, the per-directory configurations normally looked something this: AuthType Basic AuthName AuthExternal require valid-user For mod_authnz_external, you need to add the "AuthBasicProvider" directive. AuthType Basic AuthName AuthBasicProvider external AuthExternal require valid-user The directive "AuthType Basic" tells apache that you want to use the mod_auth_basic module to do "basic authentiation". The directive "AuthBasicProvider external" tells mod_auth_basic to use mod_authnz_external to check the correctness of passwords. Note that the "AuthBasicProvider" directive is only needed if you are using mod_authnz_external for password checking. If you are using it only for group checking, then this is not needed. (5) If you were using mod_auth_external in a non-authoritative mode, then your per-directory configuration probably included the directive: AuthExternalAuthoritative off This command will no longer work. If upgrading to Apache 2.2, you should use one or both of the following commands: AuthBasicAuthoritative off GroupExternalAuthoritative off The "AuthBasicAuthoritative" directive effects password checking, which is done through mod_auth_basic. The "GroupExternalAuthoritative" effects only group checking. That is if you had both "GroupExternal" directive setting up an external program for group checking, and an "AuthGroupFile" directive setting up a group file, then it would control whether the first module to process a "Require group admin" directive was the only one to run, or whether each group checker was given a chance to decide if the user was in that group based on it's group database. In Apache 2.4, all of this is handled quite differently. I need to document this. (6) If you were using multiple Require directives, the behavior may change under Apache 2.2. Suppose you wanted to allow access to user "pete" and members of the group "admins". You might have do: Require group admin Require user pete Under Apache 2.0, both of these directives would have been checked by mod_auth_external, and it would have correctly allowed access if either of the two conditions were satisfied. In Apache 2.2, however, only "Require group" and "Require file-group" directives are checked by mod_authnz_external. "Require user" and "Require valid-user" are checked by mod_authz_user, a standard module that comes with Apache. How the two directives interact depends on whether they are authoritative or not. mod_authz_user is Authoritative by default, so to get the old behavior, you will need to do GroupUserAuthoritative off Again, in Apache 2.4, all of this is handled quite differently, and this document needs updating. (7) Note that a new type of functionality is available under Apache 2.2 with mod_authnz_external. Thanks to mod_authz_owner, you can now do: Require file-owner or Require file-group The first checks if the name of the authenticated user matches the name of the unix account that owns the file. The second checks if, according to whatever group database has been configured for the current directory, the currently authenticated user is in a group with the same name as the Unix group that owns the file. Normally these are rather strange directives, because normally unix accounts have no relationship to accounts in whatever database is being used for http authentication, but for people using 'pwauth' with mod_authnz_external, these really check if the user has been authenticated as the unix user who owns the file. In Apache 2.4, this is the same, except the latter of the two becomes: Require external-file-group usr/doc/mod_authnz_external-3.3.2/TODO0100644000000000000000000000170511205135454016341 0ustar rootrootJan Wolter: - Look into developing a "socket" method, in which we first try open a socket connecting to the external authenticator, and only launch a new one if the initial connection attempt fails. This would avoid launching a new authenticator for each hit. Instead the authenticator would be a persistant process that can hold open a connection to the database and even do caching of recent authentications. - Improve Windows support. Theoretically version 3.2.0 should work on windows, but I don't do windows development and can't test it or document installation procedures. - I think the apache data structure r->subprocess_env is a table into which various modules place environment variable definitions that they want to have passed into CGI programs, for example, mod_ssl puts HTTPS and a bunch of other variables here. Should I load all of them into the environment for the external authenticator? Needs study. usr/doc/mod_authnz_external-3.3.2/README0100644000000000000000000002633312252353504016536 0ustar rootroot Mod_Authnz_External version 3.3.x Original Coder: Nathan Neulinger Previous Maintainer: Tyler Allison Current Maintainer: Jan Wolter http://www.unixpapa.com Apache 2.0 Port: Dave Woolaway Sven Koch Apache 2.2 Port: Jan Wolter http://www.unixpapa.com Caution: -------- Mod_Auth_External can be used to quickly construct secure, reliable authentication systems. It can also be mis-used to quickly open gaping holes in your security. Read the documentation, and use with extreme caution. Versions: --------- Mod_authnz_external version 3.3.x is designed for use with Apache version 2.4.x. It will not work with Apache 2.2 or 2.0. For older versions of Apache you will need older branches of mod_authnz_external: Apache 1.3 mod_auth_external-2.1.x Apache 2.0 mod_auth_external-2.2.x Apache 2.2 mod_authnz_external-3.1.x or mod_authnz_external-3.2.x Apache 2.4 mod_authnz_external-3.3.x This module was developed from "mod_auth_external". It has been restructured to fit into the authn/authz structure introduce in Apache 2.1. It can be used in any application where mod_auth_external was previously used. No changes will be needed to the external authentication programs, but the exact Apache configuration commands needed will be different. It is possible to use the old "mod_auth_external-2.2" with Apache-2.2, but mod_authnz_external is preferable. If you are upgrading from "mod_auth_external" to "mod_authnz_external" then read the file "UPGRADE" for advice. Introduction: ------------- Mod_Authnz_External is an Apache module used for authentication. The Apache HTTP Daemon can be configured to require users to supply logins and passwords before accessing pages in some directories. Authentication is the process of checking if the password given is correct for a user. Apache has standard modules for authenticating out of several different kinds of databases. Mod_Authnz_External is a flexible tool for creating authentication systems based on other databases. Mod_Authnz_External can be used in either of two somewhat divergent ways: External Authentication: When a user supplies a login and password, mod_authnz_external runs a program you write, passing it the login and password. Your program does whatever checking and logging it needs to, and then returns a Accept/Reject flag to Apache. This is slower than doing the authentication internally because it has the overhead of launching an external program for each authentication. However, there are at least two situations where it is very useful: - Rapid prototyping. The external authentication program can be a shell script or perl program. It can be written without knowing much about building Apache modules. Bugs in it will not endanger the overall integrity of the Apache server. Later, as performance becomes more of an issue, you can write a custom Apache module to do the job more efficiently (perhaps using the HARDCODE option below). - Access restrictions. There are situations where you do not want to make your user database readable to the user-id that Apache runs under. In these cases the external authentication program can be an suid program that has access to databases Apache cannot access. For example, if you want to authentication out of a Unix shadow password database, and you aren't foolish enough to run Apache as root, a carefully written suid-root external authentication program can do the job for you. Pwauth, an external authentication program for securely authenticating out of a Unix shadow password database available from http://www.unixpapa.com/pwauth/ . Hardcoded Authentication: Some hooks have been inserted into mod_authnz_external to make it easy to replace the call to the external authentication program with a call to a hardcoded internal authentication routine that you write. This is sort of a half-way measure to just writing your own Apache module from scratch, allowing you to use some of the logic from mod_authnz_external. Example functions for authenticating out of a RADIUS server or Sybase database are included in this distribution. Compatibility: -------------- The current version of mod_authnz_external is designed for use with Apache 2.2. It will not work with older versions of Apache. Mod_authnz_external has been tested on a wide variety of Unix platforms. In theory versions after 3.2.0 should work on any non-Unix platforms supported by Apache, but it has been tested only under Unix. Mod_authnz_external is also compatible with authenticators using the checkpassword interface. See http://cr.yp.to/checkpwd.html for more information. Authn / Authz ------------- Users of mod_authnz_external may find it helpful understand a bit more of it's internal structure. It is actually best thought of as two functionally separate modules, mod_authn_external and mod_authz_external, which have combined into a single module simply because they share a lot of code. In any particular application, you may only be using one of these two modules, or you may be using both. The mod_authn_external part is an authentication provider for the mod_auth_basic module. Mod_auth_basic handles all the negotiations with the browser, while all mod_authn_external does is check if a password submitted by the user is correct (which it does by running an external program to perform the check). The mod_authz_external part does access control. It has no relation to mod_auth_basic. It comes into play after authentication is complete, when a "Require group" or "Require file-group" directive is given. It checks if the authenticated user is in the list of required groups (which it does by running an external program to perform the check). Digest Authentication --------------------- The new authentication structure introduced in Apache 2.1 makes it much easier for modules like this one to support digest authentication as an alternative to basic authentication. Mod_Authnz_External, however, does not yet support digest authentication. I hope to support this in the future, but it really isn't a very attractive alternative and I don't expect many people will want to use it. It will not be possible to use the same external authentication programs that are used for basic authentication - they would have to be rewritten. It will only work if the database being accessed by the external program either has passwords in plaintext, or has them encrypted in a very specific way. This means it could not be used for unix password database authentication or with most other password databases not specifically designed for this application. And password databases specifically designed for this application might as well be designed in a format where they could be accessed by mod_authn_file or mod_authn_dbm. Security Considerations: ------------------------ By default, mod_authnz_external passes the user's login and password to the external authentication program by sending them through a pipe. This is very secure. In older versions of mod_auth_external, the login and password were by default passed in environment variables called USER and PASS. This is still an option, but we do NOT recommend using option. On some versions of Unix (including SunOS and IRIX) any user logged onto the server can see these values by doing a "ps -e" command. This would obviously be a problem if there are ever untrusted users on your server. Other versions of Unix (including Linux) restrict "ps -e" so you can only see your own processes, but this may still be a problem if untrusted people can put CGI programs on your server, since those may run as the same user as your authentication program does. Some versions of Unix don't seem to have a "ps -e" command at all, but even then it is best to be careful. Although the default "ps" command on Solaris won't display environment variables, the backwards compatible "/usr/ucb/ps" command does. Are you sure there isn't and won't be an old-style ps command installed on your system? Use of this module requires development of an external authentication program or a hardcoded internal function. These are typically very simple programs, but there are more ways to screw up your security by doing them badly than we could possibly list. See the file AUTHENTICATORS for more information on implementing authenticators. Example Authentication Routines in this Distribution: ----------------------------------------------------- test/ Several small dummy external authentication programs written in Perl (there is also a PHP version of one of them). These are meant only for testing of mod_authnz_external. They accept any user whose password and login name are identical. They write lots of debugging info to the error_log file. Author and Maintainer: Jan Wolter http://unixpapa.com/ Author of PHP Version: Claus Andersen Example Authentication Routines Formerly Included in this Distribution: ----------------------------------------------------------------------- In the interest of cleaning up the distribution, several other examples that were formerly distributed with this module are now only available separately. pwauth A C program for authenticating out of unix shadow password files or PAM. Author and Maintainer: Jan Wolter http://unixpapa.com/ Available from: http://code.google.com/p/pwauth/ MYSQL-auth A Perl program for authenticating out of a MySQL database. This is written in Perl using the DBI interface, so it could be trivially adapted to work with any other SQL database server that has a DBI interface (that is to say all of them). Author and Maintainer: Anders Nordby Available From: http://anders.fix.no/software/#unix sybase-internal-auth An example of a hardcoded internal authentication function for use with mod_auth_external or mod_authnz_external. It's designed for doing authentication out of a sybase database, which these days would be better done using mod_authn_dbd. Author: Available From: http://code.google.com/p/mod-auth-external/downloads mae-radius Another example or a hardcoded internal authentication function. This does radius authentication. It may not be fully open source. Available From: http://unixpapa.com/software/mae_radius.tar.gz Checkpassword Authenticators ---------------------------- There are various "checkpassword" compatible authenticators available on the net which can be used with mod_authnz_external. These authenticators are most commonly used with qmail pop servers but it is sometimes useful to be able to use the same authentication system for some web pages. I've listed some of the ones that look useful for mod_authnz_external, but I've tested only 'checkpassword'. checkpassword http://cr.yp.to/checkpwd.html Dan J. Bernstein Authentication from a Unix shadow password file, similar to the the pwauth program. radcheckpassword http://www.tic.ch/e-image/andrew/software/radcheckpassword/ Andrew Richards Radius authentication. usr/doc/mod_authnz_external-3.3.2/mod_authnz_external.SlackBuild0100644000000000000000000001736713367657777023731 0ustar rootroot#!/bin/sh # $Id: mod_authnz_external.SlackBuild,v 1.4 2018/11/02 23:08:37 root Exp root $ # Copyright 2010, 2013, 2018 Eric Hameleers, Eindhoven, NL # All rights reserved. # # Permission to use, copy, modify, and distribute this software for # any purpose with or without fee is hereby granted, provided that # the above copyright notice and this permission notice appear in all # copies. # # THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED # WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF # MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. # IN NO EVENT SHALL THE AUTHORS AND COPYRIGHT HOLDERS AND THEIR # CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, # SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT # LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF # USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND # ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, # OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT # OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF # SUCH DAMAGE. # ----------------------------------------------------------------------------- # # Slackware SlackBuild script # =========================== # By: Eric Hameleers # For: mod_authnz_external # Descr: Apache External Authentication Module # URL: https://github.com/phokz/mod-auth-external # Needs: # Changelog: # 3.2.5-1: 12/Nov/2010 by Eric Hameleers # * Initial build. # 3.3.1-1: 15/oct/2013 by Eric Hameleers # * Update (also with newer pwauth). # 3.3.2-1: 02/nov/2018 by Eric Hameleers # * Update. # # Run 'sh mod_authnz_external.SlackBuild' to build a Slackware package. # The package (.tgz) and .txt file as well as build logs are created in /tmp . # Install it using 'installpkg'. # # ----------------------------------------------------------------------------- # Set initial variables: PRGNAM=mod_authnz_external VERSION=${VERSION:-3.3.2} PWAUTH=${PWAUTH:-2.3.10} BUILD=${BUILD:-1} TAG=${TAG:-alien} # Define the user-ids you want to be able to use pwauth: SERVER_UIDS=${SERVER_UIDS:-"72,80"} # nobody,apache DOCS_MOD="AUTHENTICATORS CHANGES INSTALL* README TODO UPGRADE" DOCS_PWAUTH="CHANGES FORM_AUTH INSTALL README" # Where do we look for sources? SRCDIR=$(cd $(dirname $0); pwd) # Place to build (TMP) package (PKG) and output (OUTPUT) the program: TMP=${TMP:-/tmp/build} PKG=$TMP/package-$PRGNAM OUTPUT=${OUTPUT:-/tmp} SOURCE[0]="$SRCDIR/${PRGNAM}-${VERSION}.tar.gz" SRCURL[0]="https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/mod-auth-external/${PRGNAM}-${VERSION}.tar.gz" SOURCE[1]="$SRCDIR/pwauth-${PWAUTH}.tar.gz" SRCURL[1]="https://github.com/phokz/pwauth/archive/pwauth-${PWAUTH}.tar.gz" ## ## --- with a little luck, you won't have to edit below this point --- ## ## # Automatically determine the architecture we're building on: if [ -z "$ARCH" ]; then case "$(uname -m)" in i?86) ARCH=i586 ;; arm*) readelf /usr/bin/file -A | egrep -q "Tag_CPU.*[4,5]" && ARCH=arm || ARCH=armv7hl ;; # Unless $ARCH is already set, use uname -m for all other archs: *) ARCH=$(uname -m) ;; esac export ARCH fi case "$ARCH" in i?86) SLKCFLAGS="-O2 -march=${ARCH} -mtune=i686" SLKLDFLAGS=""; LIBDIRSUFFIX="" ;; x86_64) SLKCFLAGS="-O2 -fPIC" SLKLDFLAGS="-L/usr/lib64"; LIBDIRSUFFIX="64" ;; armv7hl) SLKCFLAGS="-O2 -march=armv7-a -mfpu=vfpv3-d16" SLKLDFLAGS=""; LIBDIRSUFFIX="" ;; *) SLKCFLAGS="-O2" SLKLDFLAGS=""; LIBDIRSUFFIX="" ;; esac # Exit the script on errors: set -e trap 'echo "$0 FAILED at line ${LINENO}" | tee $OUTPUT/error-${PRGNAM}.log' ERR # Catch unitialized variables: set -u P1=${1:-1} # Save old umask and set to 0022: _UMASK_=$(umask) umask 0022 # Create working directories: mkdir -p $OUTPUT # place for the package to be saved mkdir -p $TMP/tmp-$PRGNAM # location to build the source mkdir -p $PKG # place for the package to be built rm -rf $PKG/* # always erase old package's contents rm -rf $TMP/tmp-$PRGNAM/* # remove the remnants of previous build rm -rf $OUTPUT/{configure,make,install,error,makepkg}-$PRGNAM.log # remove old log files # Source file availability: for (( i = 0; i < ${#SOURCE[*]}; i++ )) ; do if ! [ -f ${SOURCE[$i]} ]; then echo "Source '$(basename ${SOURCE[$i]})' not available yet..." # Check if the $SRCDIR is writable at all - if not, download to $OUTPUT [ -w "$SRCDIR" ] || SOURCE[$i]="$OUTPUT/$(basename ${SOURCE[$i]})" if [ -f ${SOURCE[$i]} ]; then echo "Ah, found it!"; continue; fi if ! [ "x${SRCURL[$i]}" == "x" ]; then echo "Will download file to $(dirname $SOURCE[$i])" wget --no-check-certificate -nv -T 20 -O "${SOURCE[$i]}" "${SRCURL[$i]}" || true if [ $? -ne 0 -o ! -s "${SOURCE[$i]}" ]; then echo "Fail to download '$(basename ${SOURCE[$i]})'. Aborting the build." mv -f "${SOURCE[$i]}" "${SOURCE[$i]}".FAIL exit 1 fi else echo "File '$(basename ${SOURCE[$i]})' not available. Aborting the build." exit 1 fi fi done if [ "$P1" == "--download" ]; then echo "Download complete." exit 0 fi # --- PACKAGE BUILDING --- echo "++" echo "|| $PRGNAM-$VERSION" echo "++" cd $TMP/tmp-$PRGNAM echo "Extracting the source archive(s) for $PRGNAM..." for (( i = 0; i < ${#SOURCE[*]}; i++ )) ; do tar -xvf ${SOURCE[$i]} done chown -R root:root * chmod -R u+w,go+r-w,a+X-s * # First, pwauth: ( cd pwauth-${PWAUTH} sed -i -e "s/SERVER_UIDS .*$/SERVER_UIDS $SERVER_UIDS/" config.h make 2>&1 | tee $OUTPUT/make-pwauth.log ) || false cd ${PRGNAM}-${VERSION} ## A patch is required to compile 3.3.1 against apache 2.4: #if [ -n "$(/usr/sbin/apachectl -v | grep Apache/2.4)" ]; then # cat $SRCDIR/patches/mod_authnz_external_apache-2.4.patch | \ # patch -p1 --verbose 2>&1 | tee $OUTPUT/patch-%{PRGNAM}.log #fi echo Building ... export LDFLAGS="$SLKLDFLAGS" export CXXFLAGS="$SLKCFLAGS" export CFLAGS="$SLKCFLAGS" apxs -c mod_authnz_external.c 2>&1 | tee $OUTPUT/make-${PRGNAM}.log # Manually install stuff: mkdir -p $PKG/usr/lib${LIBDIRSUFFIX}/httpd/modules install -m755 .libs/mod_authnz_external.so \ $PKG/usr/lib${LIBDIRSUFFIX}/httpd/modules/mod_authnz_external.so # Add the pwauth program: mkdir -p $PKG/usr/libexec install -m4755 ../pwauth-$PWAUTH/pwauth $PKG/usr/libexec/pwauth # Add documentation: mkdir -p $PKG/usr/doc/$PRGNAM-$VERSION cp -a $DOCS_MOD $PKG/usr/doc/$PRGNAM-$VERSION || true mkdir $PKG/usr/doc/$PRGNAM-$VERSION/pwauth ( cd ../pwauth-$PWAUTH cp -a $DOCS_PWAUTH $PKG/usr/doc/$PRGNAM-$VERSION/pwauth ) || true cat $SRCDIR/$(basename $0) > $PKG/usr/doc/$PRGNAM-$VERSION/$PRGNAM.SlackBuild chown -R root:root $PKG/usr/doc/$PRGNAM-$VERSION find $PKG/usr/doc -type f -exec chmod 644 {} \; # Strip binaries (if any): find $PKG | xargs file | grep -e "executable" -e "shared object" | grep ELF \ | cut -f 1 -d : | xargs strip --strip-unneeded 2> /dev/null || true # Add a package description: mkdir -p $PKG/install cat $SRCDIR/slack-desc > $PKG/install/slack-desc # Build the package: cd $PKG makepkg --linkadd y --chown n $OUTPUT/${PRGNAM}-${VERSION}-${ARCH}-${BUILD}${TAG}.${PKGTYPE:-tgz} 2>&1 | tee $OUTPUT/makepkg-${PRGNAM}.log cd $OUTPUT md5sum ${PRGNAM}-${VERSION}-${ARCH}-${BUILD}${TAG}.${PKGTYPE:-tgz} > ${PRGNAM}-${VERSION}-${ARCH}-${BUILD}${TAG}.${PKGTYPE:-tgz}.md5 cd - cat $PKG/install/slack-desc | grep "^${PRGNAM}" > $OUTPUT/${PRGNAM}-${VERSION}-${ARCH}-${BUILD}${TAG}.txt # Restore the original umask: umask ${_UMASK_} usr/doc/mod_authnz_external-3.3.2/CHANGES0100644000000000000000000003662712252345737016671 0ustar rootrootv3.3.2 (Jan Wolter - Dec 12, 2013) ---------------------------------------------- * Replaced reference to remote_ip field of the connection record with useragent_ip, due to the elimination of remote_ip in Apache 2.4.1. Thanks to davidsansome and cjwatson for pointing out the need for this. * Fixed a bug with setting of GROUP environment variable. Thanks to ddarbyson for reporting this, and Guoan Hu for posting the fix. * Added test/test.pipe.php, a PHP version of test/test.pipe contributed by Claus Andersen. v3.3.1 (Jan Wolter - Oct 12, 2011) ---------------------------------------------- * Deleted most of the sample authenticators from the distribution. They are mostly old and crufty or available elsewhere. No need to clutter the main distribution with them. * Added code to support caching authentications with mod_authn_socache. This is enabled by the "AuthExternalProvideCache On" directive. This feature should be considered experimental, since mod_authn_socache still seems buggy and it's interface may not have been finalized. v3.3.0 (Jan Wolter - Oct 6, 2011) ---------------------------------------------- * Revised to work with Apache 2.3 / 2.4. Will not work with previous Apache versions. * Deleted 'GroupExternalAuthoritative' and 'AuthzExternalAuthoritative' directives which are obsolete. * Deleted 'GroupExternalError' directive which is superceded by Apache's 'AuthzSendForbiddenOnFailure' directive. v3.2.6 (Jan Wolter - Oct 6, 2011) ----------------------------------------------- * Modified parsing of "Require groups" line so that you can have group names that include spaces by enclosing them in quotes. This change suggested by David Homborg. * Default action of Makefile changed to "build" not "install". * Corrected an exploitable SQL injection flaw in the sample mysql authenticator. * Add references to version 3.3.x to documentation. v3.2.5 (Jan Wolter - Oct 29, 2009) ----------------------------------------------- * Fixed a bug introduced in 3.2.0 in which data for checkpassword-type authenticators is written to the authenticator's stdin instead of stderr. v3.2.4 (Jan Wolter - May 20, 2009) ----------------------------------------------- * Dropped the radius code from the distribution, because of possible problems with it's license. Thanks to Hai Zaar for pointing out this problem. * Modified AuthExternal directive to be able to take more than one authenticator name. If more than one is defined, then each authenticator is run in turn, until one succeeds or all have failed. Probably a similar change should be made to GroupExternal, but it hasn't been done yet because it's a more complex change and nobody has asked for it. Thanks to Andreas Ntaflos for suggesting this change. * Inserted code to restore SIGCHLD to default before running the authenticator. Sometime other modules (like php built with the --enable-sigchild option) leave SIGCHLD messed up, which would cause problems with getting the return code back from authenticators. We restore SIGCHLD to whatever state it was in originally after the authenticator terminates. Thanks to Stefan Mehlhorn for reporting this problem and providing the help needed to diagnose it. * Clean-up of handling of return codes from apr_proc_wait() to be more formally correct. v3.2.3 (Jan Wolter - Feb 26, 2009) ----------------------------------------------- * Added GroupExternalError directive, which allows you to specify the HTTP error code to be returned if the group access check fails. Defaut is 401, but you may want to return 403 if you want to show the user an error page instead of asking him to login again. Thanks to Peter Crawshaw for this patch. * In hopes of getting to a more consistantly named set of directives, added new aliases for two old directives: GroupExternalAuthoritative alias for AuthzExternalAuthoritative GroupExternalManyAtOnce alias for AuthExternalGroupsAtOnce Documentation updated to refer primarily to the new names. v3.2.2 (Jan Wolter - Dec 1, 2008) ----------------------------------------------- THIS RELEASE UPDATES DOCUMENTATION ONLY! * Improved documentation of AuthExternalContext directive in the INSTALL file. * Added documentation to the UPGRADE file on interactions between multiple Require directives. v3.2.1 (Jan Wolter - Jul 31, 2008) ----------------------------------------------- * Added AuthExternalContext directive, which defines a string that will be passed to the authenticator in the CONTEXT environment variable. This can be set from the .htaccess file or the block to give slightly different behavior from the same authenticator in different directories. Thanks to Olivier Thauvin for this patch. v3.2.0 (Jan Wolter - Jan 7, 2007) ----------------------------------------------- * Rewrite external authenticator launching code to use Apache's cross-OS process/thread library instead of directly calling Unix functions. Theoretically this should get us much closer to being usable on non- Unix platforms. * Support alternate syntax for configuration, using DefineAuthExternal and DefineAuthGroup commands. * More detailed error logging. * Much cleanup of documentation. v3.1.0 (Jan Wolter - Feb 17, 2006) ----------------------------------------------- * New authn/authz version for Apache 2.2. * Renamed from "mod_auth_external" to "mod_authnz_external" to agree with new module naming conventions. * The more secure "pipe" method is now the default, instead of the old insecure "environment" method. * Eliminated "AuthExternalAuthoritative" directive. Instead use "AuthBasicAuthoritative" for authentication and "AuthzExternalAuthoritative" for access control. * Substantially rewritten to function as an authentication provider for mod_auth_basic instead of a stand-alone authentication module. * Eliminated duplication of documentation inside mod_authnz_external.c file. * Addition of UPGRADE document, and update of all other documentation. * Normalization of many variable names and other clean up of code. v2.2.10 (Jan Wolter - Sep 29, 2005) ----------------------------------------------- * Renamed module from "external_auth_module" to "auth_external_module". This seems to be what is wanted for static linking. v2.2.9 (Jan Wolter - Sep 25, 2004) ----------------------------------------------- * Small corrections to 2.0 defines, thanks to Guenter Knauf . * Pwauth removed from this package. It is now distributed separately. v2.2.8 (Jan Wolter - Jun 30, 2004) ----------------------------------------------- * Trivial documentation improvement. * Clarification of docomentation on use of pwauth options UNIX_LASTLOG, FAILLOG_JFH, and MIN_UNIX_UID with PAM. v2.2.7 (Jan Wolter - Oct 23, 2003) ----------------------------------------------- * Pwauth gains IGNORE_CASE and DOMAIN_AWARE options, both aimed at making work more easily for those used to authentication in Microsoft environments. Thanks to Peter Eggimann for these enhancemen * Fix one bit of remaining Apache 1.3 api inside HARDCODE block. * Grammar corrections in AUTHENTICATORS file. v2.2.6 (Jan Wolter - Aug 14, 2003) ----------------------------------------------- * Minor improvements to debugging notes in the INSTALL document. v2.2.5 (Jan Wolter - Jul 11, 2003) ----------------------------------------------- * Pass local hostname (or virtual hostname) to authenticator in HTTP_HOST environment variable. Thanks to Steve Horan for submitting this modification. v2.2.4 (Jan Wolter - Jan 12, 2003) ----------------------------------------------- * Documentation updates for OpenBSD and minor OpenBSD portability fixes to pwauth. v2.2.3 (Jan Wolter - Oct 21, 2002) ----------------------------------------------- * More update of installation instructions. Thanks to Sven Koch and Joshua Polterock . v2.2.2 (Jan Wolter - Oct 14, 2002) ----------------------------------------------- * Partial update of installation instructions. v2.2.1 (Jan Wolter - Jun 24, 2002) ----------------------------------------------- * Corrected undefined symbol in _HARDCODE_ option. Thanks to Phil Benchoff . v2.2.0 (Dave Woolaway, Sven Koch & Jan Wolter - Jun 22, 2002) -------------------------------------------------------------- * Ported to work with Apache 2.0.28 by Dave Woolaway * Independently ported to work with Apache 2.0.39 by Sven Koch * Version merger and insufficient documentation updates by Jan Wolter. v2.1.15 (Jan Wolter - Jan 22, 2002) ----------------------------------- * Added MySQL-auth to distribution. Contributed by Anders Nordby . v2.1.14 (Jan Wolter - Jan 1, 2002) ----------------------------------- * Minor clarification to documentation on virtual hosts. * Minor update of description of pwauth in README file. * Correction of AIX compilation instructions. Thanks to Mathieu Legare for this. * Fixed name of GROUP environment variable in pwauth/unixgroup script. Thanks to Jeroen Roodnat for pointing this out. v2.1.13 (Jan Wolter - Jul 31, 2001) ----------------------------------- * Pass AUTHTYPE environment variable to external authenticator. This is PASS if we are doing password authentication, GROUP if we are doing group authentication, so the same authentication program can easily be used to do both. Thanks to Dan Thibadeau for this. * pwauth can now be configured to work for more than one UID. * pwauth/FORM_AUTH updated to discuss suExec. v2.1.12 (Jan Wolter - Jul 9, 2001) ----------------------------------- * Fixed erroneous variable names in _HARDCODE_ stuff. Thanks to Phil Benchoff for this fix. * Added pwauth/unixgroup, a simple perl unix group authenticator. Hope to replace this with a better solution someday. v2.1.11 (Jan Wolter - Apr 25, 2001) ----------------------------------- * Arguments may now be specified for authenticators on the AddAuthExternal command. The whole command must be in quotes, no shell meta characters may be used, and there is a limit of 32 arguments. * Support for the checkpassword protocol, allowing use of checkpassword compatible authenticators. Thanks go to Matthew Kirkwood for submitting patches for this. * Mod_auth_external now passes the URI environment variable to all authenticators, giving the URL of the requested page minus hostname, and CGI arguments. Thanks to Charles Clancy and Niall Daley for independently submitting similar patches for this. * Fixed a possible buffer overflow problem in the HARDCODE section. This is unlikely to have been an exploitable security problem but could cause a crash in rare circumstances. Thanks go to Bradley S. Huffman for pointing this out. * Example programs in test directory log command-line arguments. v2.1.10 (Jan Wolter - Jan 9, 2001) ---------------------------------- * Fix a pwauth bug that could cause segmentation faults when compiled with the ENV_METHOD option. * Add documentation on how to use pwauth for form authentication. * Clarify documentation on configuration for SSL servers. v2.1.9 (Jan Wolter - Jul 7, 2000) ---------------------------------- * Correct documentation to reflect the fact that Solaris *does* have a ps command that displays environment variables. Thanks to Piotr Klaban for pointing this out. v2.1.8 (Jan Wolter - May 3, 2000) ---------------------------------- * By default, pass all group names at once to group authenticators. To get old one-group-at-a-time behavior back, use the new directive "AuthExternalGroupsAtOnce off". This modification contributed by Rudi Heitbaum . Thanks. v2.1.7 (Jan Wolter - Apr 3, 2000) ---------------------------------- * Pass COOKIE environment variable to authenticator with cookies from current request. Is this a good idea? * Added rather dubious HP-UX support to pwauth. Untested. v2.1.6 (Jan Wolter - Mar 23, 2000) ---------------------------------- * Added documentation about installing as a dynamically loaded module. * Added documentation about "AddModule" command for RedHat installs. * Lots of other small documentation improvements. v2.1.5 (Jan Wolter - Jan 6, 2000) ---------------------------------- * Improved documentation on writing authenticators. v2.1.4 (Jan Wolter - Jan 4, 2000) ---------------------------------- * Oops, PAM support in v2.1.3 didn't work after all. Many fixes, including Work-around for Solaris 2.6 appdata_ptr=NULL bug. Huge thanks again to Peter Arnold for help with testing. * Generate compile-time error if Apache version is older than 1.3.1 * Better code to get lastlog path for pwauth. v2.1.3 (Jan Wolter - Dec 17, 1999) ---------------------------------- * AuthExternalAuthoritative directive added. This code contributed by Mike Burns (burns@cac.psu.edu). * Testing of PAM support in pwauth under Solaris 2.6 by Peter Arnold . * Many clarifications to install manual and other documentation. v2.1.2 beta (Jan Wolter - Jun 28, 1999) ---------------------------------- PAM support and minor bug fixes. PAM support in pwauth is based on code contributed by Karyl Stein (xenon313@arbornet.org). Not been fully tested. v2.1.1 (Jan Wolter - Mar 10, 1999) ---------------------------------- Various small enhancements making better use of Apache API. * Better memory management, eliminating all use of fixed sized arrays. * Child process calls ap_cleanup_for_exec() to close any resources (file descriptors, etc) left open in the pools. * Cleanup of error messages. v2.1.0 (Jan Wolter - Mar 5, 1999) --------------------------------- Significant rewrite, rolling in changes from various divergent versions and a number of bug fixes, and small enhancements. Changes include: * Better checking against overflow of various fixed sized arrays. (There was already some protection, so there probably wasn't a big security problem here.) * Set environment variables in child process, not parent process. This prevents them from being inherited by future spawned children. * Check WIFEXITED before acceping WEXITSTATUS. * Elimination of memory leak in strdup() calls. * Check return code from pipe(). * Don't close standard output on child process, instead direct it to error log file, just like stderr. * Don't use system() calls. Instead do direct execl() for faster launch and better security. * In pipe method, the "user=" and "pass=" tags are no longer given on the login and password line. * Pipe method is supported for group authenticators as well as user authenticators. * ip-address and host-name are made available to authenticator in IP and HOST environment variables. * Updated and expanded comments up front. v2.0.1 (Tyler Allison) ---------------------- I received a patch update to mod_auth_external v2.0 that supposedly fixes some pipe related bugs. I do not have a program that uses pipes so I can not test it myself. I have included the original v2.0 with no patch applied that you should use if you run into problems and you DO NOT need pipe support. usr/doc/mod_authnz_external-3.3.2/INSTALL0100644000000000000000000007151612252352632016713 0ustar rootroot How To Install mod_authnz_external.c Version 3.3.x NOTES: * If you want to use the HARDCODE function option follow the instructions in the INSTALL.HARDCODE file in this directory before following these instructions. * These instructions are for Apache version 2.4. This version of mod_authnz_external will not work with older versions of Apache. Other versions are available for different releases of Apache: Apache 1.3 mod_auth_external-2.1.x Apache 2.0 mod_auth_external-2.2.x Apache 2.2 mod_authnz_external-3.1.x or mod_authnz_external-3.2.x Apache 2.4 mod_authnz_external-3.3.x You can check your apache version by running it from the command line with the -v flag. * If you are upgrading from mod_auth_external to mod_authnz_external, read the UPGRADE file. * Starting with version 3.2.x, mod_authnz_external is designed to work on any platform supported by Apache. Previous versions were Unix-only. So mod_authnz_external might work on Windows, but the author doesn't really do Windows development and doesn't even own a Windows C compiler. So it has not been tested at all, no pre-compiled Windows code is available, and there are no installation instructions for non-Unix platforms. If you figure any of this out, please consider contributing your findings. * Originally, mod_auth_external was a stand-alone module. However a new authentication module structure was introduced in Apache-2.1, where mod_auth_basic and mod_auth_digest are the only top-level authentication modules. All other authentication modules simply provide authentication services to these modules, and have names starting with "mod_authn_" for authentication modules, or "mod_authz_" for access control modules, or "mod_authnz_" for modules that provide both services. Mod_Authnz_External is designed to fit into this new structure. It has essentially the same features as mod_auth_external, but there are differences in the configuration commands. It should be noted that it is still possible to use older-style independent authentication modules in Apache 2.2, and mod_auth_external-2.2.x can be made to work with only a little difficulty arising from mod_auth_basic's reluctance to be turned off. See the mod_auth_external INSTALL document for information on using it with Apache 2.2 * Do not, however, install both mod_auth_external and mod_authnz_external in your httpd. I don't know what exactly would happen, but it won't be good. * There are two ways of installing mod_authnz_external on a Unix system. (1) You can statically link it with Apache. This requires rebuilding Apache in such a way that mod_authnz_external will be compiled in. Nobody does this anymore. (2) You can make mod_authnz_external a dynamically loaded module. If your Apache has been built to support dynamically loaded modules you can do this without rebuilding Apache, so it is pretty easy. Performance may be slightly worse with this option. For information on dynamically loaded modules see http://www.apache.org/docs/dso.html Instructions for both options are given here. The dynamic loading option will probably be prefered on virtually all modern installations. * There is also documentation in the README file and in the AUTHENTICATORS file. If you find this document unclear, reading those may help. INSTALL METHOD A: Dynamically Linking Mod_auth_external using apxs: ------------------------------------------------------------------- Step 1: Ensure that your Apache server is configured to handle dynamically loaded modules. To check this, run Apache server with the -l command flag, like httpd -l If mod_so.c is one of the compiled-in modules, then you are ready to go. Note that some installations may give the http daemon different names, like 'apache' or 'httpd2'. Some may have multiple copies of apache sitting in different directories. Be sure you looking at the one that is being run. Step 2: Compile the module using the following command in the mod_authnz_external distribution directory: apxs -c mod_authnz_external.c 'Apxs' is the Apache extension tool. It is part of the standard Apache distribution. If you don't have it, then there may be a Apache development package that needs to be installed on your system, or your Apache server may not be set up for handling dynamically loaded modules. Some systems rename it weirdly, like 'apxs2' in some openSUSE distributions. Apxs should create a file named 'mod_authnz_external.so'. AIX Note: For Apache 1.3 on AIX the 'apxs' command compiled mod_authnz_external.c into mod_authnz_external.o correctly, but generation of the shared library file failed with a message like "No csects or exported symbols have been saved." We don't know if this still happens with Apache 2.0. If it does happen, the fix under Apache 1.3 was to create a file in the current directory named mod_authnz_external.exp which contained the two lines below: #! mod_authnz_external.o authnz_external_module Then run apxs -c mod_authnz_external.c -bE:mod_authnz_external.exp Step 3: Install the module. Apxs can do this for you too. Do the following command (as root so you can write to Apache's directories and config files): apxs -i -a mod_authnz_external.la This will create mod_authnz_external.so and copy it into the proper place, and add appropriate AddModule and LoadModule commands to the configuration files. (Actually, it may get the LoadModule command wrong. See below.) Step 4: Go to the CONFIGURATION instructions below. INSTALL METHOD B: Statically Linking ------------------------------------ Step 1: Read the instructions on how to configure the Apache server in the INSTALL file provided with the Apache source. Step 2: When you run the ./configure script, include an --with-module flag, giving the full pathname to the mod_authnz_external.c file in this distribution. For example, if you have unpacked this distribution in /usr/local/src/mod_authnz_external and are building Apache for installation in /usr/local/apache, you might do: ./configure --prefix=/usr/local/apache \ --with-module=aaa:/usr/local/src/mod_authnz_external/mod_authnz_external.c This will copy the mod_authnz_external.c file into the correct place in the Apache source tree and set things up to link it in. Step 3: Type "make" to compile Apache and "make install" to install it. Step 4: Go to the CONFIGURATION instructions below. CONFIGURATION: -------------- There are three parts to doing the configuration. First, if you are using dynamic loading, you need to configure Apache to load the mod_authnz_external module. If 'apxs' is working correctly, it should do this for you automatically, but it doesn't always. Second you define the external program and communication method to use in your httpd.conf file, identifying them with a keyword. Finally you set up specific directories to use that authenticator, referencing it by keyword. These instructions talk about editing the "httpd.conf" file, as it appears in the standard Apache distributions. In many version of Linux, however, this file will actually just include a lot of other configuration files, some of which may be automatically generated by various GUI configuration tools. I include notes on some of these variations that I have encountered, but you may need to do some of your own figuring to find out how to adapt these instructions to your server configuration. (1) Configuring Module Loading: This step is only required if you are using dynamic loading. In theory, apxs will have done it for you. If you are trustful, you can skip ahead to step 2 and only come back to this if things don't seem to be working. In cases where you are using multiple non-authoritative authenticators you'll probably want to check this manually, even if apxs works right, to ensure that the modules are loaded (and thus envoked) in the desired order. (a) First, you should make sure that there is a proper "LoadModule" command in the httpd.conf file. This should have been put there by 'apxs' but, some older Linux distributions, like Redhat 6.1, messed it up. Basically, the 'LoadModule' command should look a lot like all the other LoadModule commands. Something like LoadModule authnz_external_module modules/mod_authnz_external.so where the second part is the path from Apache's root directory to the location where the module was stored by apxs. Make sure that apxs didn't put this directive inside any inappropriate directives, as some Redhat versions have done in the past. If you previously had mod_authnz_external or mod_auth_external installed and are installing a new version, you may have more than one LoadModule command into httpd.conf. You only need one. Get rid of the old ones. (b) Check you httpd.conf file to see if there is a "ClearModuleList" command. If this exists, then you need to add a command like: AddModule mod_authnz_external.c somewhere below "ClearModuleList" command (probably somewhere among the dozens of other AddModule commands). If you used 'apxs' to install mod_authnz_external, then this should already be done, but it may again be stashed in an inappropriate . The standard Apache configuration files don't have a "ClearModuleList" command and don't need an "AddModule" command. However the standard RedHat configuration files, among others, do. (2) Configurating the External Authenticator In this section we insert commands into httpd.conf that will be run when Apache starts up to tell Apache where your external authenticators are and how to communicate with them. It is possible to configure several different external authenticators into Apache. For each one you need to configure a name, a method of communicating with authenticator, and the location of the authenticator. The structure of Apache httpd.conf differs widely on different systems. The notes below on where to put configuration commands assume that you have something close to a straight apache install, but you probably don't. Very likely there will be comments in your httpd.conf file that tell you where to put local configuration. If you are using virtual hosts, put these commands at the end of the appropriate block. The declarations must be *inside* the block to work for a virtual host. They are not inherited from the primary host to the virtual hosts. Note that most Apache SSL servers are set up as virtual hosts, so you'll probably need to put these definitions in the block for use with an SSL server. Otherwise, just put them anywhere (just before the Virtual Hosts section of the standard Apache config file might make the most sense). Two different command syntaxes are supported in mod_authnz_external. One that is compatible with older releases, and one that is a bit more compact, using one command instead of two. (a) For External Authentication Programs: New-Style Syntax: DefineExternalAuth Old-Style Syntax: AddExternalAuth SetExternalAuthMethod is some name you choose. You can configure multiple different external authenticators by using different keywords for them. defines how the login and password are passed to the external authenticator. The only values that do anything are: pipe read newline-terminated strings from stdin. (default) environment get args from environment variables. checkpassword read null-terminated strings from file descriptor 3. function internal authenticator called as function. Pipe is the default. Environment used to be the default but it is insecure on some versions of Unix. See the README file. tells where to find the authenticator. It's syntax varies somewhat by method (which is why we introduced the new syntax - to keep it closer to the method declaration): For "pipe", "environment", and "checkpassword" methods: is the full path where you installed your external authentication program, like "/usr/local/bin/auth_check". It always starts with a slash. If you put it in quotes, you can include command-line arguments, but these arguments won't be processed by a shell, so you can't use wildcards or I/O redirects or anything like that. (If you need shell processing of arguments, write an sh-script wrapper for your authenticator, and put the path to that here.) For the "function" method: is a string like ":". The part is a string that can be used to select from multiple internal functions. is a string passed to that function and is typically used as config file path. The ":" is required even if the is an empty string. In the old-style syntax, the path declaration should always preceed the method declaration, and the method declaration can be omitted if you want the default. Here are some examples. We give old style syntax only for the first example, but it can be used in all cases: * For external authentication programs using a pipe: DefineExternalAuth archive_auth pipe /usr/local/bin/authcheck - or - AddExternalAuth archive_auth /usr/local/bin/authcheck SetExternalAuthMethod archive_auth pipe * For external authentication programs using environment variables: DefineExternalAuth archive_auth environment /usr/local/bin/authcheck * For external authenticators using the checkpassword protocol: DefineExternalAuth archive_auth checkpassword "/bin/checkpassword /bin/true" * For HARDCODE functions with a configuration file: DefineExternalAuth archive_auth function RADIUS:/usr/local/raddb * For HARDCODE functions with no configuration file: DefineExternalAuth function archive_auth RADIUS: (b) For External Group-Checking Programs: If you want to use an external program to do group checking, add one of the following to your server's httpd.conf. New-Style Syntax: DefineExternalGroup Old-Style Syntax: AddExternalGroup SetExternalGroupMethod is some name you choose to identify this particular group checking method. The keywords for login authenticators and group authenticators are separate name spaces, so it doesn't matter if these keywords match any you defined with DefineExternalAuth or AddExternalAuth defines how the login and group names are passed to the external authenticator. Legal values are: pipe - authenticator reads data from standard input. environment - authenticator gets data from environment variables. Pipe is the default. Environment used to be the default in older versions. The "checkpassword" keyword also works, but doesn't really make a lot of sense since there are no checkpassword authenticators for groups. Examples: * For external authentication programs using a pipe: DefineExternalGroup archive_group pipe /usr/local/bin/grpcheck - or - AddExternalGroup archive_group /usr/local/bin/grpcheck SetExternalGroupMethod archive_group pipe * For external group check programs using environment variables: DefineExternalGroup archive_group environment /usr/local/bin/grpcheck (3) Configuring Web Pages to Use Authentication For any directory you want to protect, you need either a .htaccess file in the directory or a block for the directory in your httpd.conf file. Note that for .htaccess files to work, you must specify "AllowOverride AuthConfig" in the httpd.conf file for any directories they appear under. As distributed, Apache sets "AllowOverride None" for most directories. If this is not changed, .htaccess files will be ignored. * EXTERNAL PASSWORD CHECKING: For normal user authentication, the following directives should be in the .htaccess file or block: AuthType Basic AuthName AuthBasicProvider external AuthExternal Require valid-user Here identifies what we are authenticating for - it usually appears in the browser's pop-up login window. matches a keyword you defined with DefineExternalAuth or AddExternalAuth in step 2. If you only want some users to have access to the directory, as opposed to all valid users, you can list the users on the "require" line, changing it to: Require user ... Or if you want to allow only user's whose login name matches the login name of the unix user who owns the file being accessed, you can say (assuming you have mod_authz_owner installed): Require file-owner It is possible to list more than one authenticator on the AuthExternal command: AuthExternal ... Here each keyword should match an authenticator defined with the DefineExternalAuth command. If the first authenticator fails, then the second one will be run, and so on, until either one authenticator accepts the user's login/password combination or all reject it. * EXTERNAL GROUP CHECKING: If you want to use the external group check program to allow only users in a given group to have access, you could do: AuthType Basic AuthName AuthBasicProvider external AuthExternal GroupExternal Require external-group ... Here matches a name you defined with with the DefineExternalGroup or AddExternalGroup command in step 2. Normally if you have multiple group names on your "Require group" command, then the group checker will be run only once, passing it the whole space-separated list of groups. Some older group checking programs may only be able to handle one group name at a time. So if you want the group checker to be run once for each group name, you can add the directive: GroupExternalManyAtOnce off If you have GroupExternalManyAtOnce turned off, then you can have spaces in your group names by enclosing the names in quote marks. If it is on, then all parsing of the group name list is up to your authenticator. If, instead of listing group names, you want to allow access only to users whose group name (as determined by whatever group database your external group checker uses) matches the unix group name that owns the file being accessed, you can configure an external group checker and then install mod_authz_owner and do: Require external-file-group The GroupExternal directive cannot (yet?) be used with multiple external authenticators. * USE WITH MOD_AUTHN_SOCACHE Mod_authnz_external version 3.3.1 and later can be used with the Apache mod_authn_socache module, which caches authentications. If you do this, then after a successful authentication, mod_socache will remember the user for a settable time (5 minutes by default) and not rerun the external authenticator again to check their password until after the timeout. This can be a very substantial performance improvement. It can also be a very substantial security problem. One common use of mod_authnz_external is to authenticate from databases that are not readable by Apache, and should not be. For example, if you are authenticating out of the a unix password file with pwauth, you don't want make the password file readable to Apache because then an Apache bug would risk exposing your entire password file to the net. But if you turn on caching with mod_authn_socache, then the cache it builds up is essentially an Apache-readable copy of the most sensitive data from your password file. With some settings, it may even be stored on disk rather than on memory. The only good thing you can say for it is that all the passwords in that cache will be encrypted (even if you are dopey enough not to encrypt them in your actual password database). But encryption is a pretty weak defense all by itself. So using mod_authnz_external with mod_authn_socache might be dumb, but, what the heck, when have we passed up a chance to give you more rope to hang yourself with? One note: normally when you use mod_authn_socache with one of the standard Apache modules, a cache entry is created everytime it looks up a user's password in the database, even if the password they submitted wasn't the correct one. With mod_authnz_external it only happens after successful authentications. That's because mod_authnz_external doesn't have direct access to the password database. After a successful authentication we can fake-up something that looks to mod_authn_socache like some credentials out of a database by simple encrypting the password that the user sent us and pretending we got that out of a database. This means we don't get quite the performance gains that mod_authn_socache would give with something like mod_authn_dbd, but we get pretty close. So here's how you do it. First you AuthBasicProvider statement should list both 'socache' and 'external', and it's important that 'socache' should be listed first, so that it tries to look up users in the cache before mod_authnz_external runs the authenticator: AuthBasicProvider socache external Then you need to tell mod_authnz_external to start forging credentials for mod_authn_socache: AuthExternalProvideCache On And you need to tell mod_authn_socache to accept credentials from mod_authnz_external: AuthnCacheProvideFor external And that should do it. You should see many fewer runs of the external authenticator, and perhaps a slight decline in your overall security. * PASSING CONTEXT INFORMATION INTO AUTHENTICATORS: If you want the authentication to work slightly differently in different directories, then you can add a directive like: AuthExternalContext This will simply pass whatever string was given to the authenticator in an environment variable called CONTEXT. The authenticator can use that to modify it's behavior. * MODIFYING ERROR CODES FOR GROUP CHECKING: Normally, if a group authentication fails, then apache will return a 401 error, which will normally cause the browser to pop up a fresh login box so the user can try logging in with a different ID. This may not always be appropriate. If you rejected him because he has a blocked IP address, returning a 403 error, which displays an error page (which you can configure) may be a better choice than asking him to endlessly try new logins and passwords. Previous versions of mod_authnz_external had a 'GroupExternalError' directive that allowed you to change this. This no longer exists Under Apache 2.4 you can control the return code using the 'AuthzSendForbiddenOnFailure' directive. * INTERACTIONS WITH OTHER AUTHENTICATORS: Previous versions of mod_authnz_external had 'GroupExternalAuthoritative' directive. In Apache 2.4, the notion of authoritativeness is thankfully almost entirely gone, so this directive is too. * OLD DIRECTIVES Some of the directives mentioned above used to have different names. One old name still works for backward compatibility. AuthExternalGroupsAtOnce equals GroupExternalManyAtOnce (4) Install the Authenticator Install your external authentication program in the location named by the pathname on your AddExternalAuth directive. Make sure everything is permitted so that whatever account the httpd runs under can execute the authenticator. Typically this requires 'execute' access to the script and all the directories above it. If it is a script, then read access to the script will also be needed. If your script is an set-uid script, then make sure the file is owned by the user it is supposed to run as, and that the suid-bit is set. (5) Restart Apache Restart Apache, so that all the new configuration commands will be loaded. If you have the apachectl command do: apachectl restart For some systems which doesn't have apachectl, you'll want to manually run the startup script for apache. The locations of these vary somewhat in different Unix systems, but they typically are something like this: /etc/init.d/httpd restart (6) Test It Test your changes/code by trying to view a protected page. If it doesn't work, check the apache error logs. They are loaded with helpful information. Some common problems and their usual causes: - Miscellaneous odd behaviors. Did you restart the httpd after the last time you edited the httpd.conf file or recompiled Apache? Confirm that an "Apache configured -- resuming normal operations" message appeared in the error log when you restarted. - Apache complains about not recognizing mod_authnz_external commands in the httpd.conf file like "DefineExternalAuth" and "AddExternalAuth". Either the module didn't get installed (if you staticly linked the module, are you running the newly compiled copy of httpd?), or it isn't enabled (if it is dynamically linked, the AddModule LoadModule commands described above in step (1) may be missing, incorrect, or commented out by an inappropriate ). Sometimes I've found that the httpd.conf file I've been editing is not actually the one being used by the copy of Apache that is running. Sometimes I test this by inserting deliberately invalid commands and checking to see if error messages are generated when Apache is restarted. We leave the choice of invalid command words to be used to your imagination. - It displays pages in a protected directory without asking for a login and password. For some reason Apache is not seeing the directory configuration commands that set up authentication for that directory. If you are using .htaccess files, does your httpd.conf file say "AllowOverride AuthConfig" for the directory? Apache is usually distributed with "AllowOverride None" set, which will cause .htaccess files to be quietly ignored. - All logins are rejected, and the error log says it cannot execute the authentication module. Error messages might look like: exec of '/foo/bar/authcheck' failed: (2) No such file or directory [Thu Nov 15 12:26:43 2007] [error] AuthExtern authcheck [/foo/bar/authcheck]: Failed (-1) for user foo [Thu Nov 15 12:26:43 2007] [error] user foo: authentication failure for /mae/index.html": Password Mismatch The first of these three messages is from Apache's process launching library, and gives the clearest information about what caused the error. Typically it will be either "No such file", which means that the pathname you specified for the authenticator in step (2) does not match the actual location of your external authenticator, or it will be "permission denied", indicating that either the file or one of the directories above it is permitted so whatever account apache is configured to run as does not have execute permission. If it's a script, it also needs read opinion. The second error message is actually generated by mod_auth_external. It just says authentication failed for the user. Normally it would give the status code returned by the authenticator in parenthesis, but if the authenticator could not be executed it will show a phoney status code of -1 (which some systems display as 255). The third error message is from Apache. Don't be mislead by it's saying "Password Mismatch". When mod_auth_external fails, it rejects all access attempts. To apache this looks like a Password Mismatch. - Authentications failed and the message in the error log says it failed with a status code of -2 or 254, for example: [Thu Nov 15 12:26:43 2007] [error] AuthExtern authcheck [/foo/bar/authcheck]: Failed (-2) for user foo [Thu Nov 15 12:26:43 2007] [error] user foo: authentication failure for /mae/index.html": Password Mismatch A status code of -2 (or 254) indicates that the authenticator crashed or was killed before it could return a status code. This could either be because some other process sent it a signal to terminate it, or it crashed due to some kind internal error in the code, causing a segmentation fault or some other similar crash. - Error log says "Failed (X) for user foo" with X being some number other than -1, -2, 255 or 254. The authenticator ran, and exited with the given non-zero return code. You'll have to check the authenticator to see under what conditions it exits with that return code. usr/doc/mod_authnz_external-3.3.2/INSTALL.HARDCODE0100644000000000000000000000523111205135454020050 0ustar rootrootIf you want to use mod_authnz_external.c with a hardcoded internal function, then you first have to hardcode an internal function (who wudda thunk?). ----------------------------------------------------------------------------- Step 1: Edit "mod_authnz_external.c" Step 2: Uncomment the _HARDCODE_ #define. Step 3: Uncomment the line: /* #include "your_function_here.c" */ Replace "your_function_here.c" with the path/name of your function. (Actually, I think it might be better to imbed the function itself directly in this file instead of including it. Modules work better if they are implemented in a single source file.) Your function should start something like: int function_name (char *user_name,char *user_passwd,char *config_path) It should return 0 if the password is correct for the given user, and other values if it is not, pretty much just like external authentication programs do. You'll want to code this very carefully. A crash will crash not just your program but the entire httpd. ** BIG NOTE TO PROGRAMMERS ** -DO NOT- use exit() or other such calls that will cause your function to exit abnormally or dump core. It will take the entire httpd with it and display a message to your browser saying "no data". Use "return" instead of exit(). Step 4: Choose a for your function. ie: 'RADIUS' or 'SYBASE' This will be used for telling mod_authnz_external which hard coded function you want to call. Step 5: Find the exec_hardcode() function inside mod_authnz_external.c. Find the big commented section there. Replace the example call to example() with a call to your function. Also change the name "EXAMPLE" to the name you chose for your function. The function call in exec_hardcode() should look something like: if (strcmp(check_type,"")==0) { code = function_name(c->user,sent_pw,config_file); } Here, we replace "" with the name you chose in step 4. function_name(), of course, should be whatever you called your function in step 3. Step 6: Save your work. Also save some whales. Step 7: Compile and configure mod_authnz_external as described in the INSTALL file. The AddExternalAuth command in your httpd.conf file might look something like AddExternalAuth whatever EXAMPLE:/usr/local/data/configfile Here 'whatever' is the name you will use to invoke this authenticator in the AuthExternal commands in your .htaccess files. 'EXAMPLE' is the name you choose in step 4 and inserted into the "if" statement in step 5. Any data after the colon will be passed into your function. It might be a config file path or something else. usr/doc/mod_authnz_external-3.3.2/AUTHENTICATORS0100644000000000000000000003114712252136771017742 0ustar rootroot How To Implementation External Authentication Programs for mod_authnz_external or mod_auth_external Version 3.3.x LANGUAGES External authenticators can be written in almost any language. The sample authenticators in the 'test' directory are in Perl and PHP. The 'pwauth' authenticator is in ANSI C. The example code fragments in this document are in C. If the authenticator is a script rather than a compiled program, it normally has to start with a "#!/bin/sh" or "#!/usr/bin/perl" type directive. Scripts without such directives may get interpreted by the shell, or may just not work, depending on your installation. SECURITY The authenticator program should be written with great care because it runs as a privileged user and handles privileged data. A poorly written authenticator could substantially compromise the security of your system. You get points for paranoia. Some notes: - Don't make any assumptions about the length of the login names and passwords given by the user. I *think* Apache will never pass you ones that are longer than 8192 characters, but don't depend this. Check very carefully for buffer overflows. - Think about locking. It is possible to get lots of hits at your website very fast, so there may be many programs simultaneously reading your authentication database, plus updates may be going on at the same time. Probably some form of locking is needed to make all this work right. - Think about core dumps. On some systems core dump files can be publically readable. A core dump from your authenticator is likely to contain the user's plain text password, and may include large chunks of your password database that may have been in buffers. For C programs on most versions of Unix, it is possible to disable core dumps by doing something like: rlim.rlim_cur = rlim.rlim_max = 0; (void)setrlimit(RLIMIT_CORE, &rlim); Actually, core dumps seem to be mostly a thing of the past. Most modern Unixes don't seem to generate them. It may not hurt to spend a little time looking at the features of the pwauth authenticator, which is the most secure external authenticator that I have written. PASSWORD AUTHENTICATORS Authenticators communicate their result by the exit status code they return. A value of 0 indicates that the password is correct. Other values indicate that the password is incorrect, or something else is wrong. It can be useful to return different error codes for different kinds of errors. These will be logged in the Apache error log file, and can be helpful in diagnosing problems. This version of mod_authnz_external does not have any provision for returning textual error messages from the external authenticator. You might be able to use syslog() for this. This might be improved in future releases. Returned error codes should not be negative. Negative values are used internally to mod_authnz_external to indicate problems launching your program. How the external authentication program gets its arguments depends on the method used. The method used is determined by the 'SetExternalAuthMethod' command in your Apache configuration file. You need implement only the method that you plan to use in your configuration. PIPE METHOD In the "pipe" method, the arguments are read from standard input. The user name will be on the first line, and the password will be on the second. Here's a typical chunk of C code to read that: main() { char user[100], password[100], *p; if (fgets(user, sizeof(user), stdin) == NULL) exit(2); if ((p= strchr(user, '\n')) == NULL) exit(4) *p= '\0'; if (fgets(password, sizeof(password), stdin) == NULL) exit(3); if ((p= strchr(password, '\n')) == NULL) exit(5) *p= '\0'; if (check_password(user, password) == OK) exit(0); /* Good Password */ else exit(1); /* Incorrect Password */ } Here we simply read two lines from stdin, being careful not to allow buffer overflows and stripping off trailing newlines. We assume "check_password()" is some function that checks the validity of a password and returns 'OK' if it is good. Note that we exit with different non-zero error codes in different error cases. This will be helpful for debugging, as those values will be logged when authentication fails, giving you some clue as to what went wrong. It'd really be better for check_password() to return more detailed error codes, but I wanted to keep the example simple. CHECKPASSWORD METHOD The "checkpassword" method is identical to the "pipe" method, except that the user name and password are terminated by NUL ('\0') characters instead of newline characters, and they must be read from file descriptor 3 instead of standard input. Documentation for the checkpassword interface is at http://cr.yp.to/checkpwd.html. ENVIRONMENT METHOD In the "environment" method, the arguments are passed in environment variables. The user id and the clear-text password are passed in the USER and PASS environment variables respectively. Note that the environment method has fundamental security weaknesses, and should probably not be used unless you have cause to believe it is safe on your system. I wouldn't be surprised if it is marginally faster than the pipe method. Most applications should use the pipe method instead. A typical chunk of C code to authenticate with the environment method might be like: main() { char *user, *password; if ((user= getenv("USER")) == NULL) exit(2); if ((password= getenv("PASS")) == NULL) exit(3); if (check_password(user, password) == OK) exit(0); /* Good Password */ else exit(1); /* Incorrect Password */ } GROUP AUTHENTICATORS Security is generally less of a issue with group authenicators, since they are not handling any data as sensitive as clear-text passwords. They are only passed a user name (presumably already authenticated), and a list of group names. They exit with status code 0 if that user is in one of those groups, and a non-zero code otherwise. In versions of mod_auth_external before 2.1.8, external authenticators were always passed just one group name. If the Apache "require group" directive listed more than one group, then the external authenticator would be called once with each group name, which could be inefficient if you have a large number of groups. Mod_auth_external will still behave this way if you issue the "GroupExternalManyAtOnce off" directive. Newer versions of mod_auth_external and mod_authnz_external will pass all group names, separated by spaces. There will only be multiple calls if more than one "require group" directive applies to the same program (e.g., if different parent directories contain such directives in their .htaccess files - for efficiency, this should be avoided). The list of group names is passed in exactly as they appear on the "require group" directive - if your program can't handle multiple spaces between group names, don't put them there. Arguments are passed in a manner similar to password authenticators. The method used is determined by the 'SetExternalGroupMethod' command in your Apache configuration file. ENVIRONMENT METHOD In the "environment" method, the arguments are passed in environment variables. The user id and the group names are passed in the USER and GROUP environment variables respectively. A typical chunk of C code to fetch the arguments and check each group might be like: main() { char *user, *groups, *group; if ((user= getenv("USER")) == NULL) exit(2); if ((groups= getenv("GROUP")) == NULL) exit(3); group= strtok(groups, " "); while (group != NULL) { if (check_group(user, group) == OK) exit(0); /* User is in group */ group= strtok(NULL, " "); } exit(1); /* User is not in any group */ } Here "check_group()" is some function that looks in your database to see if user is in group and returns 'OK' if he is. PIPE METHOD In the "pipe" method, the arguments are read from standard input. The user name will be on the first line, and the group name will be on the second. Here's a typical chunk of C code to read that: main() { char user[100], groups[100], *group, *p; if (fgets(user, sizeof(user), stdin) == NULL) exit(2); if ((p= strchr(user, '\n')) == NULL) exit(4) *p= '\0'; if (fgets(groups, sizeof(groups), stdin) == NULL) exit(3); if ((p= strchr(groups, '\n')) == NULL) exit(5) *p= '\0'; group= strtok(groups, " "); while (group != NULL) { if (check_group(user, group) == OK) exit(0); /* User is in group */ group= strtok(NULL, " "); } exit(1); /* User is not in any group */ } Here we simply read two lines from stdin, being careful not to allow buffer overflows and stripping off trailing newlines. We loop through all groups, checking each. CHECKPASSWORD METHOD Mod_auth_external will happily try to do group authentication via the checkpassword method, piping NUL terminated user and group names to the child process's file descriptor 3, but this isn't actually allowed for in the checkpassword protocol specification, so I don't recommend it. OTHER ENVIRONMENT VARIABLES In all cases (pipe or environment method, password or group authentication), the following additional environment variables will be supplied to the authenticator: AUTHTYPE either "PASS" or "GROUP" depending on whether we are doing password or group authentication. This is handy if you are using one program to do both. CONTEXT a string whose value is set by an "AuthExternalContext" directive in the .htaccess file or "" block for the directory. This can be used to select different authentication behaviors in different directories. It is undefined if there is no "AuthExternalContext" directive. IP the client's ip-address. HOST the host name corresponding to IP, if Apache has "HostnameLookups On". PATH the httpd's path environment variable. COOKIE all cookie values passed in by the client. HTTP_HOST the server's host name, as given in the HTTP request. May be useful if you have multiple virtual hosts sharing an authenticator. URI the document requested. This is the URL including any extra path information, but not including the hostname or any CGI arguments. These may be useful for logging, or you may want to accept logins from certain users only if they are connecting from certain locations or requesting certain documents. Note that if you have configured Apache with "HostnameLookups Off" then HOST will usually not be set. If you really want hostnames, either turn on HostnameLookups or do your own gethostbyaddr() calls from the authenticator when HOST is not defined. Note that if the user is coming from an unresolvable IP, then hostname lookups can be very slow. Note that using IP addresses to track a user through your site is not reliable. Users of services like AOL and WebTV use proxy servers, so that their IP addresses appear to change constantly since each request may come through a different proxy. A single user's requests for successive pages, or for different images on the same page may all come from different IP addresses. The PATH environment variable passed to the authenticator is just whatever PATH was in effect when Apache was launched, and may differ if the server was launched automatically during a reboot or manually by an admin. Probably your program should set its own PATH if it needs one. The COOKIE environment variable contains all cookies set in the current request. This has the same format as the HTTP_COOKIES ("key=val;key=val") passed to a CGI program. This should be used with caution. Cookies come from the user's computer and might have been created, editted or deleted by the user rather than your website. This severely limits their use for authentication. It is not possible to set cookies from an authentication module. The URI variable is there because various people want it. Mostly it is useful not for authentication ("who is this person?") but for access control ("is this person permitted to do this?"), and good design usually dictates separating those functions. Strictly speaking, an authenticator is not the right place to be doing access control. However, mod_authnz_external is 50% a kludge-builder's tool, so we won't fuss if you want to break the rules. install/0040755000000000000000000000000013367657777011262 5ustar rootrootinstall/slack-desc0100644000000000000000000000204413367657777013213 0ustar rootroot# HOW TO EDIT THIS FILE: # The "handy ruler" below makes it easier to edit a package description. Line # up the first '|' above the ':' following the base package name, and the '|' # on the right side marks the last column you can put a character in. You must # make exactly 11 lines for the formatting to be correct. It's also # customary to leave one space after the ':'. |-----handy-ruler------------------------------------------------------| mod_authnz_external: mod_authnz_external (Apache External Authentication Module) mod_authnz_external: mod_authnz_external: Mod_Auth_External is an Apache authentication module. mod_authnz_external: Apache has standard modules for authenticating out of mod_authnz_external: several different kinds of databases. mod_authnz_external: Mod_Auth_External is a flexible tool for creating mod_authnz_external: authentication systems based on other databases. mod_authnz_external: mod_authnz_external: mod_authnz_external: Homepage: http://code.google.com/p/mod-auth-external/ mod_authnz_external: