1:05 p.m.
Hello Guys,
Is it possible to password protect folders/address with system account usernames and
passwords?
I thought it would be a mod_auth_* package/module but I can't figure out just which
one it is from the documentation.
Thanks,
1:48 p.m.
On Wed, Dec 21, 2016 at 07:05:41PM +0000, Aero Maxx D wrote:
Is it possible to password protect folders/address with system
account usernames and passwords?
I thought it would be a mod_auth_* package/module but I can't figure
out just which one it is from the documentation.
You can use mod_authnz_pam — documented at
https://www.adelton.com/apache/mod_authnz_pam/
This makes me feel a little bit squicky as a former sysadmin. Make sure
that you're at least using https, and make sure your users are at least
aware of phishing attacks.
--
Matthew Miller
<mattdm(a)fedoraproject.org>
Fedora Project Leader
9:13 a.m.
Sent from my iPhone
On 21 Dec 2016, at 19:48, Matthew Miller
<mattdm(a)fedoraproject.org> wrote:
> On Wed, Dec 21, 2016 at 07:05:41PM +0000, Aero Maxx D wrote:
> Is it possible to password protect folders/address with system
> account usernames and passwords?
>
> I thought it would be a mod_auth_* package/module but I can't figure
> out just which one it is from the documentation.
You can use mod_authnz_pam — documented at
https://www.adelton.com/apache/mod_authnz_pam/
This makes me feel a little bit squicky as a former sysadmin. Make sure
that you're at least using https, and make sure your users are at least
aware of phishing attacks.
--
Matthew Miller
<mattdm(a)fedoraproject.org>
Fedora Project Leader
_______________________________________________
users mailing list -- users(a)lists.fedoraproject.org
To unsubscribe send an email to users-leave(a)lists.fedoraproject.org
Yeah me also, but the machine has no outside access to the real world and only used
internally on an intranet, so am hoping the risk is reduced.
I read somewhere that someone could just hammer the authentication with multiple tries
until they get access!
Thanks,
Daniel
9:39 a.m.
On Thu, Dec 22, 2016 at 03:13:33PM +0000, Aero Maxx D wrote:
I read somewhere that someone could just hammer the authentication
with multiple tries until they get access!
Without further protection, yep. Several things in Fedora you could
use:
- mod_evasive -- an apache module to protect against brute-force
attacks
- fail2ban -- not just for ssh; have it follow the logs and block at
the firewall level
- pam_shield -- count login attempts and ban based on that
--
Matthew Miller
<mattdm(a)fedoraproject.org>
Fedora Project Leader
12:07 p.m.
On 22 Dec 2016, at 15:39, Matthew Miller
<mattdm(a)fedoraproject.org> wrote:
Without further protection, yep. Several things in Fedora you could
use:
- mod_evasive -- an apache module to protect against brute-force
attacks
- fail2ban -- not just for ssh; have it follow the logs and block at
the firewall level
- pam_shield -- count login attempts and ban based on that
I use fail2ban for ssh but wasn't aware of the others, will look into them further and
see how to get fail2ban to look at the logs.
12:02 p.m.
On 21 Dec 2016, at 19:48, Matthew Miller
<mattdm(a)fedoraproject.org> wrote:
You can use mod_authnz_pam — documented at
https://www.adelton.com/apache/mod_authnz_pam/
This makes me feel a little bit squicky as a former sysadmin. Make sure
that you're at least using https, and make sure your users are at least
aware of phishing attacks.
Sorry to ask again but I've installed the module, enabled it, restarted Apache and put
my .htaccess file in the folder I'm wanting to protect, it seems to work as I get the
login prompt in my browser. But I can't login the prompt keeps showing up.
I've looked in /etc/pam.d/ and tried setting AuthPAMService to some of the files in
that folder, but no joy.
I expected it to be passwd, as this one takes the longest to show the login prompt again.
It doesn't help that no information as to why shows up in the error_log.
1:26 p.m.
On Thu, Dec 22, 2016 at 06:02:25PM +0000, Aero Maxx D wrote:
Sorry to ask again but I've installed the module, enabled it,
restarted Apache and put my .htaccess file in the folder I'm wanting
to protect, it seems to work as I get the login prompt in my browser.
But I can't login the prompt keeps showing up.
I've looked in /etc/pam.d/ and tried setting AuthPAMService to some
of the files in that folder, but no joy.
It's been a long time since I set this up, and I'm going from memory
and docs rather than testing this, but....
What you want to do is create a _new_ file in /etc/pam.d, named
something like "mywebstuff", and then use "AuthPAMService
mywebstuff".
In /etc/pam.d/mywebstuff, something like:
auth required pam_unix.so debug
account required pam_unix.so debug
You can remove the "debug" once it's working -- that'll write stuff to
syslog that we can check if there's still a problem. :)
--
Matthew Miller
<mattdm(a)fedoraproject.org>
Fedora Project Leader
10:49 a.m.
On 22 Dec 2016, at 19:26, Matthew Miller
<mattdm(a)fedoraproject.org> wrote:
What you want to do is create a _new_ file in /etc/pam.d, named
something like "mywebstuff", and then use "AuthPAMService
mywebstuff".
In /etc/pam.d/mywebstuff, something like:
auth required pam_unix.so debug
account required pam_unix.so debug
You can remove the "debug" once it's working -- that'll write stuff to
syslog that we can check if there's still a problem. :)
Thanks for all your help, have been trying to get something working but having no joy at
all! I'm getting errors like
mod_authnz_pam: PAM authentication failed for user ***: System error
user ***: authentication failure for "/": Password Mismatch.
Any ideas?
11:53 a.m.
On Fri, Dec 23, 2016 at 04:49:43PM +0000, Aero Maxx D wrote:
Thanks for all your help, have been trying to get something working
but having no joy at all! I'm getting errors like
mod_authnz_pam: PAM authentication failed for user ***: System error
user ***: authentication failure for "/": Password Mismatch.
Any ideas?
No really great ideas except for the probably-obvious observation that
"/" probably isn't actually a user account. Does it say that no matter
what username you give to Apache?
--
Matthew Miller
<mattdm(a)fedoraproject.org>
Fedora Project Leader
3:14 p.m.
On 23 Dec 2016, at 17:53, Matthew Miller
<mattdm(a)fedoraproject.org> wrote:
> On Fri, Dec 23, 2016 at 04:49:43PM +0000, Aero Maxx D wrote:
> I'm getting errors like
>
> mod_authnz_pam: PAM authentication failed for user ***: System error
>
> user ***: authentication failure for "/": Password Mismatch.
>
> Any ideas?
No really great ideas except for the probably-obvious observation that
"/" probably isn't actually a user account. Does it say that no matter
what username you give to Apache?
Oh sorry the *** are where the usernames originally were and the / is pass worded folder
I'm trying to access with Apache.
And yes it does the same with all every user on the server.
Done some googling and others have had problems with pam authentication and getting the
same errors as me, but not found a resolution.
3:19 p.m.
On Fri, Dec 23, 2016 at 09:14:00PM +0000, Aero Maxx D wrote:
> No really great ideas except for the probably-obvious
observation that
> "/" probably isn't actually a user account. Does it say that no
matter
> what username you give to Apache?
Oh sorry the *** are where the usernames originally were and the /
is
pass worded folder I'm trying to access with Apache.
Oh, just to check -- any SELinux AVC logged? From the mod_authnz_pam
page, you need to do `sudo setsebool -P allow_httpd_mod_auth_pam 1`.
Other than that, anything at all else logged?
--
Matthew Miller
<mattdm(a)fedoraproject.org>
Fedora Project Leader
4:38 p.m.
On 23 Dec 2016, at 21:19, Matthew Miller
<mattdm(a)fedoraproject.org> wrote:
Oh, just to check -- any SELinux AVC logged? From the mod_authnz_pam
page, you need to do `sudo setsebool -P allow_httpd_mod_auth_pam 1`.
Other than that, anything at all else logged?
Yeah I've done that still the same as before.
mod_authnz_pam: PAM authentication failed for user <<username here>>:
Authentication failure
user <<username here>>: authentication failure for "/": Password
Mismatch.
5:05 p.m.
On 12/23/2016 02:38 PM, Aero Maxx D wrote:
Yeah I've done that still the same as before.
mod_authnz_pam: PAM authentication failed for user <<username here>>:
Authentication failure
user <<username here>>: authentication failure for "/": Password
Mismatch.
This is probably more apache related than Fedora; have you tried one of
their support lists or forums?
2:04 a.m.
On 23 Dec 2016, at 23:05, Joe Zeff <joe(a)zeff.us> wrote:
This is probably more apache related than Fedora; have you tried one of their support
lists or forums?
I haven't tried that no, mainly due to the mod_authnz_pam being made by from what I
can tell a third party. The documentation is very limited on the website.
I will try some other avenues for support thank you!
5:27 a.m.
On 12/23/2016 05:38 PM, Aero Maxx D wrote:
> On 23 Dec 2016, at 21:19, Matthew Miller
<mattdm(a)fedoraproject.org> wrote:
>
> Oh, just to check -- any SELinux AVC logged? From the mod_authnz_pam
> page, you need to do `sudo setsebool -P allow_httpd_mod_auth_pam 1`.
>
> Other than that, anything at all else logged?
Yeah I've done that still the same as before.
mod_authnz_pam: PAM authentication failed for user <<username here>>:
Authentication failure
user <<username here>>: authentication failure for "/": Password
Mismatch.
_______________________________________________
users mailing list -- users(a)lists.fedoraproject.org
To unsubscribe send an email to users-leave(a)lists.fedoraproject.org
If you put
SELinux in permissive mode does it work? If not, then it
most likely NOT an
SELinux issue.
2:58 p.m.
On 24 Dec 2016, at 11:27, Daniel J Walsh <dwalsh(a)redhat.com>
wrote:
If you put SELinux in permissive mode does it work? If not, then it
most likely NOT an
SELinux issue.
_______________________________________________
users mailing list -- users(a)lists.fedoraproject.org
To unsubscribe send an email to users-leave(a)lists.fedoraproject.org
I typed in that selinux command but I have also just edited the selinux file and changed
it to permissive, and rebooted to be doubly sure it was on.
Still same error as before, I have no idea where to go from here the error message is too
vague!
Googling doesn't help at all can't find anything related, the documentation
isn't that great as it's quite brief.
But I'm appreciating all the help I've been given so far!
3:34 p.m.
On 12/24/2016 12:58 PM, Aero Maxx D wrote:
Still same error as before, I have no idea where to go from here the
error message is too vague!
Glancing at the thread... I'd note that you typically can't use
mod_authnz_pam if you're authenticating against /etc/shadow, because
that file is readable only by the root user. Authentication against
system accounts is much easier if you're using LDAP or Kerberos. I'm a
little unclear because I've never used sssd against local files, but you
might be able to work around the problem by restoring the original httpd
pam file and setting the system up to use sssd for authentication.
11:06 p.m.
Allegedly, on or about 21 December 2016, Aero Maxx D sent:
Is it possible to password protect folders/address with system
account
usernames and passwords?
I thought it would be a mod_auth_* package/module but I can't figure
out just which one it is from the documentation.
You might want to give a more concrete example of what you're trying to
do.
You can always use the same usernames and passwords that people use, by
entering the same details into Apache configuration control files, but I
suspect you're hoping that Apache can simply read whatever the OS is
doing, directly. That sound like the kind of thing that PAM was meant
for.
However, here's the thing: Once people start transmitting unencrypted
usernames and passwords across a network (HTTP logins, FTP, POP, IMAP,
SMTP authentications, etc.), they're very easy to capture and abuse.
I'd be inclined to use different passwords, or learn about HTTPS (as
well as enforcing encryption on any other protocols you're allowing
people to use - such as the mail services I just mentioned).
Though HTTPS advice comes with a proviso that the original [basic] way
of authenticating with Apache sends such authentication data before
making the HTTPS connection. I've not looked into whether that has
changed, but that's why most secure websites get you to enter your
details into a form on a secure page, rather than using the browser's
own username and password GUI.
--
[tim@localhost ~]$ uname -rsvp
Linux 3.9.10-100.fc17.x86_64 #1 SMP Sun Jul 14 01:31:27 UTC 2013 x86_64
Boilerplate: All mail to my mailbox is automatically deleted, there is
no point trying to privately email me, I only get to see the messages
posted to the mailing list.
George Orwell's '1984' was supposed to be a warning against tyranny, not
a set of instructions for supposedly democratic governments.
2702
days inactive
2705
days old
17 comments
6 participants
participants (6)
-
Aero Maxx D -
Daniel J Walsh -
Gordon Messmer -
Joe Zeff -
Matthew Miller -
Tim