ApacheMySQLAuthentication » History » Version 11
Markus Döring, 08/21/2007 06:08 PM
1 | 8 | Lutz Suhrbier | [[[PageOutline(2-9Table|of Contents,outline)]]] |
---|---|---|---|
2 | |||
3 | |||
4 | 1 | Lutz Suhrbier | |
5 | 6 | Lutz Suhrbier | # Apache [[MySQL]] Authentication for Debian Etch |
6 | 1 | Lutz Suhrbier | |
7 | 6 | Lutz Suhrbier | This how-to describes the setup of redirecting the authentication of the Apache Web Server to a [[MySQL]] Database for Debian Etch. |
8 | 3 | Lutz Suhrbier | |
9 | 1 | Lutz Suhrbier | |
10 | 6 | Lutz Suhrbier | Usually, this is done by Apache's _auth-mysql_ module. But, the relating Debian package _libapache2-mod-auth-myaql_ is currently not maintained and therefore not in the stable release (http://packages.qa.debian.org/liba/libapache-mod-auth-mysql.html). |
11 | |||
12 | |||
13 | There are two possible solutions: |
||
14 | |||
15 | * Using [[MySQL]] authentication via PAM |
||
16 | |||
17 | * Compiling the Apache module _auth-mysql_ |
||
18 | |||
19 | |||
20 | Debian recommends to use PAM->MySQL authentication. It works fine, but the current Debian package does not support (non-crypt) MD5-password storage. |
||
21 | |||
22 | |||
23 | Thus, finally self-compiling the auth-mysql module appears to be the best solution. But, we have to pay attention to possible security advices concerning the module. |
||
24 | |||
25 | |||
26 | |||
27 | 1 | Lutz Suhrbier | ## PAM-MySQL Authentication |
28 | 3 | Lutz Suhrbier | |
29 | 6 | Lutz Suhrbier | The recommended Debian way is to use the packages libapache2-mod-auth-pam and libpam-mysql instead. |
30 | 3 | Lutz Suhrbier | |
31 | ~~~ |
||
32 | 1 | Lutz Suhrbier | # apt-get install libapache2-mod-auth-pam libpam-mysql |
33 | ~~~ |
||
34 | |||
35 | 6 | Lutz Suhrbier | The usage of the PAM authentication module has to be configured in Apache2. To use [[MySQL]] authentication with our [[ShibbolethIdPInstallDebianEtch|IdP configuration]], we change the shibboleth authentication location in the idp configuration script as follows: |
36 | 1 | Lutz Suhrbier | |
37 | ~~~ |
||
38 | 6 | Lutz Suhrbier | <Location /shibboleth-idp/SSO> |
39 | AuthPAM_Enabled on |
||
40 | AuthPAM_FallThrough off |
||
41 | AuthUserFile /dev/null |
||
42 | AuthBasicAuthoritative Off |
||
43 | 5 | Lutz Suhrbier | AuthName "Shibboleth IdP" |
44 | 1 | Lutz Suhrbier | AuthType Basic |
45 | require valid-user |
||
46 | </Location> |
||
47 | ~~~ |
||
48 | 3 | Lutz Suhrbier | |
49 | 6 | Lutz Suhrbier | With regard to the security advice of the file "/usr/share/doc/libapache2-mod-auth-pam/README.Debian" |
50 | 1 | Lutz Suhrbier | |
51 | 3 | Lutz Suhrbier | ~~~ |
52 | 6 | Lutz Suhrbier | SECURITY |
53 | 3 | Lutz Suhrbier | |
54 | To use with standard Debian configuration you have to add "www-data" user to |
||
55 | "shadow" group. Be careful! It means it can be readable by anyone who can run |
||
56 | its own CGI script! |
||
57 | |||
58 | The passwords are sent by net as clear text. You should use SSL to protect |
||
59 | them. |
||
60 | 6 | Lutz Suhrbier | ~~~ |
61 | we should add the user www-data to the shadow group. |
||
62 | 3 | Lutz Suhrbier | |
63 | 6 | Lutz Suhrbier | ~~~ |
64 | # adduser www-data shadow |
||
65 | ~~~ |
||
66 | 3 | Lutz Suhrbier | |
67 | 6 | Lutz Suhrbier | Next, we have to configure the PAM-MySQL module for Apache2. |
68 | 3 | Lutz Suhrbier | |
69 | 6 | Lutz Suhrbier | Edit _/etc/pam.d/apache2_, add the following line setting the values such as they match your configuration |
70 | 3 | Lutz Suhrbier | |
71 | ~~~ |
||
72 | 9 | Lutz Suhrbier | auth sufficient pam_mysql.so verbose=1 user=webuser passwd= host=160.45.63.30 db=drupal5 table=drupal5._shared_users usercolumn=drupal5._shared_users.name passwdcolumn=drupal5._shared_users.pass crypt=3 |
73 | 1 | Lutz Suhrbier | ~~~ |
74 | 9 | Lutz Suhrbier | |
75 | 6 | Lutz Suhrbier | More detailed information about the possible values can be retrieved reading _/usr/share/doc/libpam-mysql/README.gz_ |
76 | 3 | Lutz Suhrbier | |
77 | 6 | Lutz Suhrbier | ~~~ |
78 | # zless /usr/share/doc/libpam-mysql/README.gz |
||
79 | ~~~ |
||
80 | |||
81 | 3 | Lutz Suhrbier | Finally, restart apache2 and see if it works. |
82 | 2 | Lutz Suhrbier | |
83 | 1 | Lutz Suhrbier | |
84 | |||
85 | |||
86 | 9 | Lutz Suhrbier | ## Compiling and Installing Apache's _auth-mysql_ module |
87 | 1 | Lutz Suhrbier | |
88 | 7 | Lutz Suhrbier | Regarding this objective, we mainly rely on the following documentation http://forum.nuxwin.com/index.php/topic,736.msg3590.html#msg3590 (in french). |
89 | 1 | Lutz Suhrbier | |
90 | 7 | Lutz Suhrbier | |
91 | We need to install the following packages in order to compile and install the module: |
||
92 | |||
93 | 1 | Lutz Suhrbier | ~~~ |
94 | 7 | Lutz Suhrbier | apt-get install apache2-prefork-dev libmysqlclient15-dev gcc patch |
95 | 1 | Lutz Suhrbier | ~~~ |
96 | 7 | Lutz Suhrbier | |
97 | Create the directory _/usr/src/auth_mysql_ and change to it: |
||
98 | |||
99 | ~~~ |
||
100 | # mkdir /usr/src/auth_mysql |
||
101 | # cd /usr/src/auth_mysql |
||
102 | ~~~ |
||
103 | |||
104 | Download the module's source files and the relating patch for Apache 2.2 |
||
105 | |||
106 | ~~~ |
||
107 | # wget http://download.nuxwin.com/apache2.2-modules/auth_mysql/mod_auth_mysql-3.0.0.tar.gz |
||
108 | # wget http://download.nuxwin.com/apache2.2-modules/auth_mysql/patch/apache2.2.diff |
||
109 | ~~~ |
||
110 | |||
111 | Unpack the sources and apply the patch file to the sources: |
||
112 | |||
113 | ~~~ |
||
114 | tar xzf mod_auth_mysql-3.0.0.tar.gz |
||
115 | # cp apache2.2.diff mod_auth_mysql-3.0.0/ |
||
116 | # cd mod_auth_mysql-3.0.0 |
||
117 | # patch -p0 < apache2.2.diff mod_auth_mysql.c |
||
118 | ~~~ |
||
119 | |||
120 | Compiling the module and check the output produced: |
||
121 | |||
122 | ~~~ |
||
123 | # apxs2 -c -L/usr/lib/mysql -I/usr/include/mysql -lmysqlclient -lm -lz mod_auth_mysql.c |
||
124 | |||
125 | /usr/share/apr-1.0/build/libtool --silent --mode=compile --tag=disable-static i486-linux-gnu-gcc -prefer-pic -D_GNU_SOURCE -D_LARGEFILE64_SOURCE -DLINUX=2 -D_REENTRANT -I/usr/include/apr-1.0 -I/usr/include/openssl -I/usr/include/postgresql -I/usr/include/xmltok -pthread -I/usr/include/apache2 -I/usr/include/apr-1.0 -I/usr/include/apr-1.0 -I/usr/include/postgresql -I/usr/include/mysql -c -o mod_auth_mysql.lo mod_auth_mysql.c && touch mod_auth_mysql.slo |
||
126 | /usr/share/apr-1.0/build/libtool --silent --mode=link --tag=disable-static i486-linux-gnu-gcc -o mod_auth_mysql.la -L/usr/lib/mysql -lmysqlclient -lm -lz -rpath /usr/lib/apache2/modules -module -avoid-version mod_auth_mysql.lo |
||
127 | ~~~ |
||
128 | |||
129 | Install the module and check the output produced: |
||
130 | |||
131 | @-LLIBDIR' |
||
132 | |||
133 | flag during linking and do at least one of the following: |
||
134 | |||
135 | - add LIBDIR to the @ |
||
136 | |||
137 | |||
138 | Create the module's load configuration file: |
||
139 | |||
140 | ~~~ |
||
141 | # echo "LoadModule mysql_auth_module /usr/lib/apache2/modules/mod_auth_mysql.so" > /etc/apache2/mods-available/auth_mysql.load |
||
142 | ~~~ |
||
143 | |||
144 | Enable the module and restart apache2: |
||
145 | |||
146 | ~~~ |
||
147 | # a2enmod auth_mysql |
||
148 | # /etc/init.d/apache2 force-reload |
||
149 | ~~~ |
||
150 | |||
151 | You can check your configuration observing the following log-files |
||
152 | |||
153 | * /var/log/apache2/access.log |
||
154 | |||
155 | * /var/log/apache2/error.log |
||
156 | |||
157 | * /var/log/auth.log |
||
158 | 10 | Markus Döring | |
159 | |||
160 | 1 | Lutz Suhrbier | |
161 | 11 | Markus Döring | ### Subversion w/ mod_auth_mysql |
162 | 1 | Lutz Suhrbier | |
163 | 11 | Markus Döring | Configure Apache to use mod_auth_mysql for subversion: |
164 | |||
165 | httpd.conf |
||
166 | |||
167 | ~~~ |
||
168 | <VirtualHost *> |
||
169 | DAV svn |
||
170 | SVNPath /var/lib/svn/edit |
||
171 | SVNIndexXSLT /svnindex/svnindex.xsl |
||
172 | |||
173 | AuthType Basic |
||
174 | AuthName "EDIT SUbversion" |
||
175 | |||
176 | # how to authenticate a user |
||
177 | AuthBasicAuthoritative Off |
||
178 | AuthMySQLHost 192.168.2.10 |
||
179 | AuthMySQLUser subversion |
||
180 | AuthMySQLPassword XXX |
||
181 | AuthMySQLDB drupal5 |
||
182 | AuthMySQLUserTable _shared_users |
||
183 | AuthMySQLNameField name |
||
184 | AuthMySQLPasswordField pass |
||
185 | AuthMySQLPwEncryption md5 |
||
186 | AuthzSVNAccessFile /var/lib/svn/access.conf |
||
187 | |||
188 | # For any operations other than these, require an authenticated user. |
||
189 | <LimitExcept GET PROPFIND OPTIONS REPORT> |
||
190 | Require group edit |
||
191 | </LimitExcept> |
||
192 | |||
193 | </VirtualHost> |
||
194 | ~~~ |
||
195 | |||
196 | |||
197 | |||
198 | 1 | Lutz Suhrbier | ### Trac w/ mod_auth_mysql |
199 | 11 | Markus Döring | |
200 | Configure Apache to use mod_auth_mysql for Trac: |
||
201 | |||
202 | httpd.conf |
||
203 | |||
204 | |||
205 | ~~~ |
||
206 | AuthName "EDIT Trac" |
||
207 | AuthType Basic |
||
208 | |||
209 | AuthBasicAuthoritative off |
||
210 | AuthMySQLAuthoritative on |
||
211 | |||
212 | AuthMySQLHost 192.168.2.10 |
||
213 | AuthMySQLUser xxx |
||
214 | AuthMySQLPassword xxx |
||
215 | AuthMySQLDB drupal5 |
||
216 | AuthMySQLUserTable _shared_users |
||
217 | AuthMySQLNameField name |
||
218 | AuthMySQLPasswordField pass |
||
219 | AuthMySQLPwEncryption md5 |
||
220 | |||
221 | Require valid-user |
||
222 | ~~~ |