2

This question is split between the realm of SO and SF. It's for a coding project but I believe the error I'm encountering has more to do with system administration than code, so I'll put it here.

I'm trying to make a PHP login page that authenticates users on their pre-existing system user accounts. I installed the php5 pam authentication module and followed the documentation to configure it.

I created /etc/pam.d/php with the following contents:

# /etc/pam.d/php
#
# note: both an auth and account entry are required

auth    sufficient      /lib/security/pam_pwdb.so shadow nodelay
account sufficient      /lib/security/pam_pwdb.so

I added "pam.servicename = "php";" to my /etc/php5/apache2/php.ini file and then restarted my apache service.

Every time my script uses the pam_auth function, the following appears in my auth.log:

Jan  6 08:56:33 cobalt apache2: PAM unable to dlopen(/lib/security/pam_pwdb.so)
Jan  6 08:56:33 cobalt apache2: PAM [error: /lib/security/pam_pwdb.so: cannot open shared object file: No such file or directory]
Jan  6 08:56:33 cobalt apache2: PAM adding faulty module: /lib/security/pam_pwdb.so

How can I fix this? For something as simple (or so I thought), should I just write my own functions to parse /etc/shadow and /etc/passwd? I'm not trying to log the user into the system itself, I just need to let the user log into my script with their system user/password and check that they belong to an appropriate group to run a given report.

DWilliams
  • 953
  • 2
  • 20
  • 29

2 Answers2

4

You should use pam_unix instead of pam_pwdb Which OS/distribution are you running?

Mircea Vutcovici
  • 17,619
  • 4
  • 56
  • 83
  • 1
    This put me on the right path. I changed it to pam_unix in /etc/pam.d/php. It now logs an authentication error when I try to log in. After reading the documentation, it seems that this is because only root is allowed to read /etc/shadow. It recommended using chgrp to set /etc/shadow's group to the webserver's group. I am a bit wary of doing this. The pre-set group on /etc/shadow is "shadow". Will changing that mess anything up? Also, I forgot to mention in my question that I'm running Ubuntu Server 8.04 LTS – DWilliams Jan 06 '10 at 18:08
0

Looks like your /lib/security/pam_pwdb.so file doesn't exist

Deimosfr
  • 594
  • 2
  • 5