shall a pam-enabled application be setuid root to be able to pam_authenticate system users ?

[Sebastien Cabaniols]

Le Jeudi 15 Mars 2007 19:13, Ludvig Ericson a écrit :
>> From: Sebastien Cabaniols <sebastien.cabaniols at hp.com>
>> To: pam-list at redhat.com
>> Date: Thu, 15 Mar 2007 15:07:20 +0100
>> Subject: shall a pam-enabled application be setuid root to be able to
>> pam_authenticate system users ? Hello list,
>>
>> I am quite new to pam and I have currently managed to integrate pam to a
>> short hello world application but I don't understand if my application has
>> to run as root or not:
>>
>> I have defined a /etc/pam.d/test which contains the following:
>>
>> auth    required        pam_unix_auth.so
>> account required        pam_unix_acct.so
>>
>> My application will start after pam_authenticate succeds (I am simply
>> using the standard misc_conv from pam_misc.)
>>
>> If I am running my application on behalf of the non-priviledged user
>> 'seb', then I can only pam_authenticate the user 'seb'. To be able to
>> authenticate other users, I have to run the process as root or setuid or
>> sudo.
>>
>> How can an application (such as a webservice) run on behalf of an
>> unpriviledged user and still refuse to run if you can't provide a valid
>> user/password on the linux system ?
>>
>> Many thanks in advance for any help.
>
>As far as I know, no, you don't. I've run things as my own user and
>still been able to authenticate properly. It might have something to
>do with your settings for that service; try to assume another
>service's identity and authenticate as that instead, and perhaps just
>look at other services' configuration files.
>
I am surprised because I have checked (on different distros) a few basic 
programs pam-linked and they all are setuid or run as root: login/sshd for 
example.
The only exception is the xlock program which uses a special binary to 
do /etc/password authentication...

>Ludvig Ericson
>
>_______________________________________________
>Pam-list mailing list
>Pam-list at redhat.com
>https://www.redhat.com/mailman/listinfo/pam-list