<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:p="urn:schemas-microsoft-com:office:powerpoint" xmlns:a="urn:schemas-microsoft-com:office:access" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:s="uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882" xmlns:rs="urn:schemas-microsoft-com:rowset" xmlns:z="#RowsetSchema" xmlns:b="urn:schemas-microsoft-com:office:publisher" xmlns:ss="urn:schemas-microsoft-com:office:spreadsheet" xmlns:c="urn:schemas-microsoft-com:office:component:spreadsheet" xmlns:oa="urn:schemas-microsoft-com:office:activation" xmlns:html="http://www.w3.org/TR/REC-html40" xmlns:q="http://schemas.xmlsoap.org/soap/envelope/" xmlns:D="DAV:" xmlns:x2="http://schemas.microsoft.com/office/excel/2003/xml" xmlns:ois="http://schemas.microsoft.com/sharepoint/soap/ois/" xmlns:dir="http://schemas.microsoft.com/sharepoint/soap/directory/" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:dsp="http://schemas.microsoft.com/sharepoint/dsp" xmlns:udc="http://schemas.microsoft.com/data/udc" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:sps="http://schemas.microsoft.com/sharepoint/soap/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:udcxf="http://schemas.microsoft.com/data/udc/xmlfile" xmlns:wf="http://schemas.microsoft.com/sharepoint/soap/workflow/" xmlns:mver="http://schemas.openxmlformats.org/markup-compatibility/2006" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns:mrels="http://schemas.openxmlformats.org/package/2006/relationships" xmlns:ex12t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:ex12m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv=Content-Type content="text/html; charset=us-ascii"> <meta name=Generator content="Microsoft Word 12 (filtered medium)"> <style>  </style>  </head> <body lang=EN-US link=blue vlink=purple> <div class=Section1> I am trying to get an apache/pam/smb system working happily. Samba swapping spit with AD and I am able to use the wbinfo and getent commands, and also chown/chgrp to domain accounts and groups. I am unsure if apache is configured correctly, but I cannot find any useful logging facility to help with the PAM config. I am running Fedora Core 6 with httpd 2.2.6.<o:p></o:p> <o:p> </o:p> For /etc/pam.d/httpd:<o:p></o:p> #%PAM-1.0<o:p></o:p> auth required pam_winbind.so debug<o:p></o:p> account required pam_winbind.so debug<o:p></o:p> <o:p> </o:p> I am loading the PAM modules via the auth_pam.conf file in the ../conf.d directory:<o:p></o:p> [root@sys01 conf.d]# more auth_pam.conf <o:p></o:p> LoadModule auth_pam_module modules/mod_auth_pam.so<o:p></o:p> LoadModule auth_sys_group_module modules/mod_auth_sys_group.so<o:p></o:p> <o:p> </o:p> Here is my virtual-hosts.conf:<o:p></o:p> <o:p> </o:p> # xx.site.com<o:p></o:p> <VirtualHost 10.66.160.5><o:p></o:p> DocumentRoot /import/www.sites/xx/htdocs<o:p></o:p> ServerName xx.site.com<o:p></o:p> CustomLog logs/xx.site.com-access_log combined<o:p></o:p> ErrorLog logs/xx.site.com-error_log<o:p></o:p> <Directory /import/www.sites><o:p></o:p> AllowOverride All<o:p></o:p> AuthPAM_Enabled on<o:p></o:p> AuthType Basic<o:p></o:p> Require valid-user<o:p></o:p> AuthGROUP_FallThrough on<o:p></o:p> AuthPAM_FallThrough on<o:p></o:p> Options ExecCGI FollowSymLinks +Includes +Indexes<o:p></o:p> IndexOptions FancyIndexing<o:p></o:p> order deny,allow<o:p></o:p> deny from all<o:p></o:p> allow from all<o:p></o:p> </Directory><o:p></o:p> </VirtualHost><o:p></o:p> <o:p> </o:p> Last but not least, the relevant .htaccess file:<o:p></o:p> AuthUserFile …. /.htpasswd<o:p></o:p> AuthGroupFile …./.htgroup<o:p></o:p> AuthName ByPassword<o:p></o:p> AuthType Basic<o:p></o:p> AuthPAM_FallThrough on<o:p></o:p> <Limit GET><o:p></o:p> require group "domain users"<o:p></o:p> require user clientname<o:p></o:p> </Limit><o:p></o:p> <o:p> </o:p> According to my calculations, now httpd should be able to use domain accounts to authenticate. The files in question on this webserver have “domain users” as the group owner and 775 permissions – this is not a filesystem permissions issue. At the apache authentication prompt, when I give a domain account “blah”, apache’s error log says “user blah not found”. Of course the “clientname” account works so Apache+PAM are the prime suspects for a configuration problem. <o:p></o:p> <o:p> </o:p> So here is the question: is there any way to see what apache is doing vis a vis auth_pam? I’d like to get something more useful out of apache’s logging for this, but I do not know how to make that happen. <o:p></o:p> <o:p> </o:p> <o:p> </o:p> <o:p> </o:p> Andrew Sternick System Administrator<o:p></o:p> aQuantive, a Microsoft Corporation subsidiary Leading businesses in digital marketing. 212.798.7320 // direct 212.462.4660 // fax <a href="blocked::http://www.aquantive.com/" title="blocked::http://www.aquantive.com/ http://www.aquantive.com/">www.aQuantive.com</a><o:p></o:p> <o:p> </o:p> </div> </body> </html>