EDIT

# Apache [[MySQL]] Authentication for Debian Etch

This how-to describes the setup of redirecting the authentication of the Apache Web Server to a [[MySQL]] Database for Debian Etch.

Usually, this is done by Apache's _auth-mysql_ module. But, the relating Debian package _libapache2-mod-auth-myaql_ is currently not maintained and therefore not in the stable release (http://packages.qa.debian.org/liba/libapache-mod-auth-mysql.html).

There are two possible solutions:

* Using [[MySQL]] authentication via PAM

* Compiling the Apache module _auth-mysql_

Debian recommends to use PAM->MySQL authentication. It works fine, but the current Debian package does not support (non-crypt) MD5-password storage.

Thus, finally self-compiling the auth-mysql module appears to be the best solution. But, we have to pay attention to possible security advices concerning the module.

## PAM-MySQL Authentication

The recommended Debian way is to use the packages libapache2-mod-auth-pam and libpam-mysql instead.

~~~

# apt-get install libapache2-mod-auth-pam libpam-mysql

~~~

The usage of the PAM authentication module has to be configured in Apache2. To use [[MySQL]] authentication with our [[ShibbolethIdPInstallDebianEtch|IdP configuration]], we change the shibboleth authentication location in the idp configuration script as follows:

~~~

  <Location /shibboleth-idp/SSO>

    AuthPAM_Enabled 	on

    AuthPAM_FallThrough off

    AuthUserFile /dev/null

    AuthBasicAuthoritative Off

    AuthName               "Shibboleth IdP"

    AuthType               Basic

    require                valid-user

  </Location>

~~~

With regard to the security advice of the file "/usr/share/doc/libapache2-mod-auth-pam/README.Debian" 

~~~

SECURITY

  To use with standard Debian configuration you have to add "www-data" user to

  "shadow" group. Be careful! It means it can be readable by anyone who can run

  its own CGI script!

  The passwords are sent by net as clear text. You should use SSL to protect

  them.

~~~

we should add the user www-data to the shadow group.

~~~

# adduser www-data shadow

~~~

Next, we have to configure the PAM-MySQL module for Apache2.

Edit _/etc/pam.d/apache2_, add the following line setting the values such as they match your configuration

~~~

account required pam_mysql.so user=webadmin passwd=secret host=160.45.63.30 db=drupal5 table=_shared_users usercolumn=name passwdcolumn=pass crypt=1

~~~

More detailed information about the possible values can be retrieved reading _/usr/share/doc/libpam-mysql/README.gz_

~~~

# zless /usr/share/doc/libpam-mysql/README.gz

~~~

Finally, restart apache2 and see if it works.

## Compiling and Installing Apache's _auth-myaql_ module

~~~

 apt-get install apache2-prefork-dev apache2-prefork-dev

  155  apt-get -f install

  156  apt-get -f install

  157  apt-get install apache2-prefork-dev apache2-prefork-dev

  158  cd /usr/src/

  159  mkdir auth_mysql

  160  cd auth_mysql/

  161  wget http://download.nuxwin.com/apache2.2-modules/auth_mysql/mod_auth_mysql-3.0.0.tar.gz

  162  tar xzf mod_auth_mysql-3.0.0.tar.gz

  163  ls

  164  wget http://download.nuxwin.com/apache2.2-modules/auth_mysql/patch/apache2.2.diff

  165  mv apache2.2.diff mod_auth_mysql-3.0.0/

  166  cd mod_auth_mysql-3.0.0

  167  patch -p0 < apache2.2.diff mod_auth_mysql.c

  168  apt-get install patch

  169  patch -p0 < apache2.2.diff mod_auth_mysql.c

  170  apxs2 -c -L/usr/lib/mysql -I/usr/include/mysql -lmysqlclient -lm -lz mod_auth_mysql.c

  171  apt-get install build-essentials

  172  apxs2 -c -L/usr/lib/mysql -I/usr/include/mysql -lmysqlclient -lm -lz mod_auth_mysql.c

  173  apt-get install gcc

  174  apxs2 -c -L/usr/lib/mysql -I/usr/include/mysql -lmysqlclient -lm -lz mod_auth_mysql.c

  175  apt-get install libmysqlclient15-dev

  176  apxs2 -c -L/usr/lib/mysql -I/usr/include/mysql -lmysqlclient -lm -lz mod_auth_mysql.c

  177  apxs2 -i mod_auth_mysql.la

  178  echo "LoadModule mysql_auth_module /usr/lib/apache2/modules/mod_auth_mysql.so" > /etc/apache2/mods-available/auth_mysql.load

  179  a2enmod auth_mysql

  180  /etc/init.d/apache2 force-reload

  181  /etc/init.d/apache2 force-reload

  182  less /var/log/apache2/access.log

  183  less /var/log/apache2/error.log

  184  less /var/log/auth.log

~~~