Apache PAM Auth module

[Les Mikesell]

Heiko Hund wrote:
> Hi,
> 
> On Monday 31 March 2008 20:42:05 Kenneth Geisshirt wrote:
>> The reason for my interest is that I (and a group of friends) have a
>> subversion repositories with HTTP access. It seems like a good idea to
>> use PAM as part of the .htaccess file.
> 
> have you considered using mod_auth(nz)_external or mod_auth(n)_sasl for this 
> task? The main concern I had using mod_auth_pam in httpd was that it does not 
> work with shadow passwords unless you grant httpd access to /etc/shadow. I 
> think that's a bad idea.
> 
> With the modules mentioned above you can use PAM as well, but the actual 
> authentication is done after an indirection and takes place outside of the 
> httpd process. Of course you need some other elevated entity to 
> access /etc/shadow then. In case of mod_auth(nz)_external that is a suid-root 
> binary (pwauth). In case of mod_auth(n)_sasl it is saslauthd, which you might 
> already be using if you host secure SMTP, IMAP or LDAP on the box.

I can't find much documentation on how to glue these together but it 
does sound like it would work for my situation if the performance hit 
from an external process to authenticate every page isn't too bad.

Is there an example of the configuration needed for web authentication 
with no account info somewhere?  I'm using Centos and am fairly sure the 
smtp and imap authentication already tracks the system PAM configuration 
so the sasl/pam setup is probably already there.

-- 
   Les Mikesell
    lesmikesell at gmail.com