pam-mysql-general — A general list for PAM-MYSQL, subscribe if you want to ask anything :)

[Pam-mysql-general] problem with auth..

[D M. <dm...@es...>]

Hi,

I am setting up authentication (for ssh, pop3, and ftp) via pam-mysql on =
freebsd 4.6.1-rc2,=20
it works as long as I add the user to /etc/passwd (with or without a =
password locally)..

How can I avoid having to do this?

Thanks,
Duncan

Re: [Pam-mysql-general] NSS-MySQL and Pam-MySQL

[Yann V. <ya...@in...>]

On Wed, 26 Jun 2002 13:07:04 -0700
"Jefferson Cowart" <je...@co...> wrote:

> The major issue that I foresee in doing this is that users that are
> stored in /etc/passwd (root for example) will be unable to login as
> they won't have that flag in the mysql db as they don't exist there.

No problem. Just use "sufficient" rather than "required" in the account
and auth lines in your PAM configuration. That lets you log on when
either allows it.

I just got pam_mysql to work on our server, which uses MD5 hashes (not
md5 crypt). Here's a patch to make this work with OpenSSL, not just
FreeBSD:

Index: Makefile
===================================================================
RCS file: /cvsroot/pam-mysql/pam_mysql/Makefile,v
retrieving revision 1.1
diff -u -r1.1 Makefile
--- Makefile    12 Oct 2000 18:52:27 -0000      1.1
+++ Makefile    27 Jun 2002 07:06:33 -0000
@@ -7,7 +7,8 @@
        -ansi -D_POSIX_SOURCE -Wall -Wwrite-strings \
        -Wpointer-arith -Wcast-qual -Wcast-align -Wtraditional \
        -Wstrict-prototypes -Wmissing-prototypes -Wnested-externs
-Winline \
-       -Wshadow -pedantic -fPIC
+       -Wshadow -pedantic -fPIC -DHAVE_OPENSSL
+export LDLIBS=-lcrypto
 export MKDIR=mkdir -p
 export LD_D=gcc -shared -Xlinker -x -L/usr/lib/mysql
 endif
Index: pam_mysql.c
===================================================================
RCS file: /cvsroot/pam-mysql/pam_mysql/pam_mysql.c,v
retrieving revision 1.10
diff -u -r1.10 pam_mysql.c
--- pam_mysql.c 19 Feb 2001 16:07:50 -0000      1.10
+++ pam_mysql.c 27 Jun 2002 07:06:33 -0000
@@ -25,6 +25,10 @@
  */
 #ifdef HAVE_MD5DATA
 #include <md5.h>
+#else
+#ifdef HAVE_OPENSSL
+#include <openssl/md5.h>
+#endif
 #endif
 
 #include <mysql/mysql.h>
@@ -101,6 +105,21 @@
        const char *newpass, int isRoot );
 int breakArgs( const char *in, char **lhs, char **rhs );
 
+#ifdef HAVE_OPENSSL
+void hexify(unsigned char *data, int len)
+{
+       int i=len*2;
+       unsigned char b;
+
+       data[i]=0;
+       do {
+               b=data[--i>>1];
+               b=((i&1)?b:b>>4)&0xf;
+               data[i]=b>9?'a'-10+b:'0'+b;
+       } while(i);
+}
+#endif
+
 /* breakArgs() breaks up a long string argument into its component
chunks,
    accounting for escape chars and quoted strings as PAM doesn't (yet).
    It also looks for name-value pairs, so it probably still won't go
away
@@ -365,6 +384,12 @@
                        if (md5buf != NULL)
                                free(md5buf);
                        break;
+#else
+#ifdef HAVE_OPENSSL
+               case 3: MD5(passwd, strlen(passwd), encryptedPass);
+                       hexify(encryptedPass,MD5_DIGEST_LENGTH);
+                       break;
+#endif
 #endif /* HAVE_MD5DATA */
        }
 
@@ -524,6 +549,15 @@
                                md5buf = NULL;
                        }
                break;
+#else
+#ifdef HAVE_OPENSSL
+               case 3:
+                       encNew = malloc(MD5_DIGEST_LENGTH*2+1);
+                       encNew[MD5_DIGEST_LENGTH*2]=0;
+                       MD5(newpass, strlen(newpass), encNew);
+                       hexify(encNew,MD5_DIGEST_LENGTH);
+               break;
+#endif
 #endif
                default:
                        encNew = malloc(sizeof('\0'));
@@ -688,7 +722,7 @@
                                } else if ((!strcmp(myval, "2")) ||
                                        (!strcasecmp(myval, "mysql"))) {
                                                options.crypt = 2;
-#ifdef HAVE_MD5DATA
+#if defined(HAVE_MD5DATA) || defined(HAVE_OPENSSL)
                                } else if ((!strcmp(myval, "3")) ||
                                        (!strcasecmp(myval, "MD5"))) {
                                                options.crypt = 3;

[Pam-mysql-general] NSS-MySQL and Pam-MySQL

[Jefferson C. <je...@co...>]

I am in trying to get my system working with authentication using a
mixture of both of these programs. I want the nss-mysql part so I can
have users in my mysql table owning files on the HD and such other low
level auth issues. I want the pam-mysql module however so I can do where
statements limiting access to services. For instance I have a column in
my users table called "ssh". I use that column as a y/n flag about
permitting ssh access. I couple this with a where statement in my sshd
config file in /etc/pam.d. I would like to be able to spread this along
to almost all my programs (login, ftp, etc.) that use pam for
authentication. The major issue that I foresee in doing this is that
users that are stored in /etc/passwd (root for example) will be unable
to login as they won't have that flag in the mysql db as they don't
exist there. What I think I want is a setup where it will check either
/etc/passwd directly and if the user is there allow them access or check
the mysql db (through Pam-mysql) and if the user is there allow them
access if the flag for that service is set to a y. Is this possible? 

----------------
Thanks
Jefferson Cowart
Je...@co... 

Support Open Instant Messaging Protocols
http://www.petitiononline.com/openIM/petition.html

[Pam-mysql-general] replacing /etc/passwd?

[Ian P. C. <po...@po...>]

Am I correct in assuming that this does not *replace* /etc/passwd?

I've been playing with this module for a while now, and the only way I can
get it to work is if a user exists in /etc/passwd.

Just for experimentation, I have edited /etc/pam.d/su to use auth via sql.
When I try to su to a user that is in the database, and not in /etc/passwd,
I get 'Unknown id: <user>'.
Is this right?

I was hoping I could replace the entire user auth system with a mysql
database. is this not possible?

Many Thanks,

Ian.

[Pam-mysql-general] Hello & patch for basic failover

[Patrick H. <pa...@pa...>]

Hello,

First of all, thanks for taking the time to make this publicly available. 

I work at an ISP that's coming up on various unix hard limits, so we've 
been using pam_mysql to accomplish our remote authentication needs, and
hacking mysql support into other applications (not much hacking, actually,
most of the daemons we use have mysql support hacked into them). 

I noticed that in 0.4.7 there isn't any support for failover if the main
mysql authentication database is down (other than the local database), so
I added a "host1" option to the module. Give it a whirl, any comments,
feedback would be appreciated. 


Thanks,
patrick.
+--
Patrick Haller               Network Administrator               +1 717 249 7270
pa...@pa...                                                 http://www.pa.net

[Pam-mysql-general] pam-mysql releases

[Anders N. <an...@fi...>]

Hello,

I can see from CVS that pam-mysql is updated every now and then, and that
important fixes has been applied. Now, the latest release is from
september 6, 2000. Any plans to roll a new release? I'd like to express
a wish for new releases when important changes have been made (and
tested to work, if possible). :-)

Cheers,

-- 
Anders.

[Pam-mysql-general] question

[Support <roh...@wi...>]

i'm looking to set up a box that can authenticate users of the form

"us...@do..." instead of just the normal "user" for various
services and i was wondering if mysql module for pam is able to deal with
this? thanks for any info.. 

-j

[Pam-mysql-general] Cannot get it to work under SuSE 6.3

[Tobias H. <tu...@gm...>]

Hi folks!

I went through your code for some hours, and solved most problems on my machine. But now I'm at a point, 
where something goes wrong that I can't explain. So let the syslog speak:

Dec 17 20:58:03 saturn login: pam_mysql: select user from customers where user='tobi' and password='secure' 
and priv=2
Dec 17 20:58:03 saturn login: pam_mysql: acct_mgmt called but not implemented. Dont panic though :)
Dec 17 20:58:03 saturn login: pam_mysql: setcred called but not implemented.
Dec 17 20:58:03 saturn login: Cannot make/remove an entry for the specified session
                              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This confused me a lot, because it seems as if the problem wasn't in the pam_mysql-Module. This message also 
appears on my Telnet-console.

Could anyone please help me? :) - The system is a SuSE 6.3 with standard kernel (Linux saturn 2.2.13 #1 Mon 
Nov 8 15:08:22 CET 1999 i586 unknown)

tobi.


 

Re: [Pam-mysql-general] suggestion

[Anders N. <an...@fi...>]

Hello,

On Mon, Nov 20, 2000 at 08:04:45PM +0100, Dr Gabriele Gallacci wrote:
>  I've worked a lot with Mysql (since 2 years), and I find it a speedy,
> manageable db server.
>  But it suffers a lot from not having some functions, like transaction and
> triggers: I think they are very important, expecially in a pam-sql project.

Transactions were introduced to MySQL in may this year.

>  The point: why do you use MySQL, and not for example, PostgreSQL?

MySQL is being actively developed, and given a little time I think it will
mature. Besides, it is the most popular opensource database engine, is easy to
use, is/can be integrated with lots of opensource software, and is quite fast+
feature rich already.

Cheers,

-- 
Anders.

[Pam-mysql-general] suggestion

[Dr G. G. <gab...@ga...>]

Hello,
 I've worked a lot with Mysql (since 2 years), and I find it a speedy,
manageable db server.
 But it suffers a lot from not having some functions, like transaction and
triggers: I think they are very important, expecially in a pam-sql project.

 The point: why do you use MySQL, and not for example, PostgreSQL?

with regards

gabriele


gabriele gallacci

mailto: gab...@ga...
http://www.gallacci.com