From: Brian Candler <B.Candler@...>
Date: 2003-07-05T04:44:20+09:00
Subject: Re: Using ruby-pam in a CGI

On Sat, Jul 05, 2003 at 03:18:56AM +0900, Samuel Tesla wrote:
> I'm looking at writing some simple control panel software for my
> webhosting business, and part of what I need to do is authenticate
> users.  I'd like to simply use their system passwords (so that way
> they only have to remember one).  For that reason, I'd like to use
> ruby-pam to authenticate them.
> 
> Since this is going to be running in a CGI environment, I can't prompt
> the user for information the way PAM would have me do.  When I tried
> to do this with Authen::PAM in Perl, I could never get it to work.
> 
> Do any of you have suggestions?

You won't be able to authenticate users using PAM unless you are running as
root, because you need root privileges to read /etc/shadow or its
equivalent.

Perhaps the easiest kludgy way to get it working is to run a POP3 server,
and your script can then attempt a POP3 login to validate a
username/password pair.

Other options would be to run a radius server (one which uses PAM and runs
as root), or a password-checking daemon such as Cyrus' pwcheck or Courier's
authdaemond (but you'll have to write client-side code to talk the
appropriate protocol)

Or you could write a little setuid-root C program for checking passwords,
taking care not to introduce any security holes.

I just came across another option which is a patched version of PAM which
allows password checking from non-root accounts:
http://www.e-admin.de/pam_exim/ (but I don't know how it actually works)

Regards,

Bran.