Lighttpd

I would also like to see this option, i understand the concerns about running lighttpd as root but why not leave it as a option?

-- Shaun.Reitan <isat> NDCHost.com

You shouldn't need to have lighttpd run as root. You could just set the group of /etc/shadow to lighttpd and allow group read. If lighty supported it, I could move a few of my clients across.

-- richard

I would like to see PAM too... lighty's authentication options are a bit lacking at the moment. PAM would open the way to using MySQL, SQLite and every other PAM module out there. This is preventing me migrating an Apache instance over at the moment.

-- David Anderson

Count one more for PAM; it would be especially helpful when coordinating small development with Trac and Mercurial-over-SSH.

-- blinks

The reason I'd like PAM is mainly just to work with the existing users on my system (that have SSH access). Will the other options allow this?

-- blinks

Replying to blinks@acm.org:

The reason I'd like PAM is mainly just to work with the existing users on my system (that have SSH access). Will the other options allow this?

sure. i can understand that. but the price is too high imho.
even if you give lighttpd read permissions on the file and not run it as root. with a simple hole in a webapplication your shadow file could be retrieved and the whole server would be compromised.

the other options would allow pam auth yes.

Replying to darix:

the other options would allow pam auth yes.

That's just fine, then.

Newer versions of PAM do no longer require pam_unix.so to be run as root, which I guess was the main argument against this feature in lighttpd. Maybe someone could look at it again?

I'm not a PAM expert, but I saw that MariaDB (MySQL fork) recently added a PAM authentication plugin. IMHO a database server has similar constraints about not running as root as a webserver.

In their wiki-page ( http://kb.askmonty.org/en/pam-authentication-plugin ) they have the following note:

if you configure PAM to use pam_unix.so and notice that MariaDB needs to run as a root user to be able to access /etc/shadow — try to upgrade your PAM installation. Newer versions of PAM do not require pam_unix.so to be run as root.

You would either need a daemon running as root providing access (but then it wouldn't be pam_unix anymore), or you need a suid binary. There is only a suid binary for checking the password for your own user (for things like locking the screen).

Providing a simple way of checking passwords for local users would be STUPID (preventing that is the point of shadow after all).

sravas wrote:

The same patch updated for 1.4.45.

Hello sravas, can you please share some information with me on how you've integrated the patch. I'm running 1.4.48 version of lighttpd, but it should not matter.

1. How did you compile --with-pam? Any dependencies included?
2. After compilation, you've moved mod_authn_pam.so to libraries folder and included "mod_authn_pam" in the lighttpd config?

The issue I'm having, is I'm able to compile with just the --with-pam flag, after I can see that lighttpd has pam included in the list of modules. Lighttpd restarts successfully, however, I get out of memory issues if I include the "mod_authn_pam".

I would highly appreciate, if you share some of your knowledge.

Also, would be nice to see a sample of your pam configuration from lighttpd.config

Thanks!