mod_auth_pam is not supported and/or developed any longer and the latest available version works only with apache 2.0.x. The new apache 2.2 uses a new authentication mechanism and the old mod_auth_pam does not work, if you only install it to your local apache and use it with the follow configuration:
-
AuthPAM_Enabled On
-
AuthPAM_FallThrough Off
-
AuthType Basic
-
AuthName "Testingarea"
You have to turn off the new apache 2.2 basic authentication to get the module up and running. You can do this in two different ways. The first one is to disable the hole module, the second and better one is to disable it through a directive.
For the first solution, you can use the tool a2dismod to disable the module mod_auth_basic.
For the second way, you have to add this lines to the configuration above.
-
…
-
AuthPAM_Enabled On
-
AuthPAM_FallThrough Off
-
AuthBasicAuthoritative Off
-
…
In the second way, the error.log of apache shows the following lines:
-
[Wed Feb 21 20:01:35 2007] [error] Internal error: pcfg_openfile() called with NULL filename
-
[Wed Feb 21 20:01:35 2007] [error] [client 192.168.0.201] (9)Bad file descriptor: Could not open password file: (null)
The positive message is: you can ignore them ;-) It means, that the mod_auth_pam does not register an AuthBasicProvider and therefore it is null and crashes. Not nice, but it works.
Thanx, for the detailed information on how to get the PAM plugin to work again and saving me a lot of time figuring out this weird pcfg_openfile() error.
Thanks for the info, you saved me lots of head scratching. Also I found if you add the directive (in addition to your second method):
AuthUserFile /dev/null
the error messages are no longer added to the apache log file.
Works perfectly. Thank you :-)
Thanks Josh for this kewl workaround!
Not working for me. Anyone else experiencing this?
Fedora 8 – Apache/2.2.6
AuthPAM_Enabled On
AuthPAM_FallThrough Off
AuthBasicAuthoritative Off
AuthType Basic
AuthName “Testingarea”
require group staff
If I’m missing something please email.
Thanks to those who emailed me (Thomas). I found my sanity and a solution that works for me using mod_auth_shadow and mod_auth_pam.
http://www.fedoraforum.org/forum/showthread.php?p=953570#post953570
Hope this helps someone else.
I had to add the shadow module before any others loaded.
Cheers.
Or look at http://mod-auth.sourceforge.net/docs/mod_authn_pam/, which integrates with the new Apache 2.2 auth structure as a provider for the basic auth module.
Don’t forget to give apache user (usually nobody or www-data) read perms to /etc/shadow file adding that user to the shadow group:
usermod -G shadow www-data
or
usermod -G shadow nobody