pax_global_header00006660000000000000000000000064144443446220014521gustar00rootroot0000000000000052 comment=d9429ba93cdbe022196290c2c1dd529a59595315 ngx_http_auth_pam_module-1.5.5/000077500000000000000000000000001444434462200166075ustar00rootroot00000000000000ngx_http_auth_pam_module-1.5.5/ChangeLog000066400000000000000000000050001444434462200203540ustar00rootroot000000000000002023-06-20 sto@mixinet.net * Version 1.5.5. * Update previous patch to apply it only if the nginx version is 1.23.0 or higher to avoid compilation failures with older versions. 2023-06-19 sto@mixinet.net * Version 1.5.4. * Set next WWW-Authenticate header to NULL to prevent segmentation faults (patch provided by tanshaoyi, see https://github.com/sto/ngx_http_auth_pam_module/pull/28). 2021-08-23 sto@mixinet.net * Version 1.5.3. * Always load after ngx_http_access_module (patch provided by khimaros, see https://github.com/sto/ngx_http_auth_pam_module/pull/26) 2020-06-23 sto@mixinet.net * Version 1.5.2. * Log authentication errors as errors instead of debug (patch provided by Juha Koho, see https://github.com/sto/ngx_http_auth_pam_module/pull/11) * Send client IP address to PAM (patch provided by Marcin Łojewski, see https://github.com/sto/ngx_http_auth_pam_module/pull/14) 2016-04-06 sto@iti.es * Version 1.5.1. * Fix building alongside other modules in nginx 1.9.11+ (patch provided by Graham Edgecombe ) 2016-03-23 sto@iti.es * Version 1.5. * Added support to build module dynamically (patch provided by Sjir Bagmeijer ). * Log PAM error and info messages to nginx log files (patch provided by André Caron ). 2015-02-04 sto@iti.es * Version 1.4. * Cleanup PAM responses on error, the module was not doing it, causing memory leaks (thanks to Michael Koziarski for the report). 2013-09-17 sto@iti.es * Version 1.3. * Added support to export HOST and REQUEST variables to the PAM ENVIRONMENT. Thanks to Ruben Jenster for the initial patch, his version is available from https://github.com/r10r/ngx_http_auth_pam_module; my version uses his implementation but only if the user sets the ``pam_auth_set_pam_env`` flag. * Fixed bug from http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=+721702 (ngx_module_t commands array should end with a ngx_null_command); the bug was already fixed on the PAM_ENV patch, but I forgot about it until I went back to my svn repository to add the debian patch... better latter than never... ;) 2010-11-15 sto@iti.upv.es * Version 1.2. * Fixed possible memory leak when authentication fails, pam_end has to be called to free memory (thanks to Neil Chintomby). 2009-01-26 sto@iti.upv.es * Version 1.1. * Fixed ngx_log_debugX calls, no we use the correct X value on each call. 2008-09-17 sto@iti.upv.es * Initial version (1.0). ngx_http_auth_pam_module-1.5.5/LICENSE000066400000000000000000000024711444434462200176200ustar00rootroot00000000000000/* * Copyright (C) 2008-2023 Sergio Talens Oliag * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY AUTHOR AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL AUTHOR OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * */ ngx_http_auth_pam_module-1.5.5/README.md000066400000000000000000000063741444434462200201000ustar00rootroot00000000000000# ngx_http_auth_pam_module ## Nginx module to use PAM for simple http authentication ### Compilation When compiling from source build as usual adding the ``--add-module`` option: ./configure --add-module=$PATH_TO_MODULE or if you want to build the module as dynamic use the ``--add-dynamic-module`` option. If you are using a Debian GNU/Linux distribution install the ``nginx-full`` package; the module has been included in the debian package since version ``1.1.6-1``, so it is available on all stable distributions since the *wheezy* release. ### Configuration The module only has two directives: - ``auth_pam``: This is the http authentication realm. If given the value ``off`` the module is disabled (needed when we want to override the value set on a lower-level directive). - ``auth_pam_service_name``: this is the PAM service name and by default it is set to ``nginx``. ### Examples To protect everything under ``/secure`` you will add the following to the ``nginx.conf`` file: location /secure { auth_pam "Secure Zone"; auth_pam_service_name "nginx"; } Note that the module runs as the web server user, so the PAM modules used must be able to authenticate the users without being root; that means that if you want to use the ``pam_unix.so`` module to autenticate users you need to let the web server user to read the ``/etc/shadow`` file if that does not scare you (on Debian like systems you can add the ``www-data`` user to the ``shadow`` group). As an example, to authenticate users against an LDAP server (using the ``pam_ldap.so`` module) you will use an ``/etc/pam.d/nginx`` like the following: auth required /lib/security/pam_ldap.so account required /lib/security/pam_ldap.so If you also want to limit the users from LDAP that can authenticate you can use the ``pam_listfile.so`` module; to limit who can access resources under ``/restricted`` add the following to the ``nginx.conf`` file: location /restricted { auth_pam "Restricted Zone"; auth_pam_service_name "nginx_restricted"; } Use the following ``/etc/pam.d/nginx_restricted`` file: auth required /lib/security/pam_listfile.so onerr=fail item=user \ sense=allow file=/etc/nginx/restricted_users auth required /lib/security/pam_ldap.so account required /lib/security/pam_ldap.so And add the users allowed to authenticate to the ``/etc/nginx/restricted_users`` (remember that the web server user has to be able to read this file). ### PAM Environment If you want use the ``pam_exec.so`` plugin for request based authentication the module can add to the PAM environment the ``HOST`` and ``REQUEST`` variables if you set the ``auth_pam_set_pam_env`` flag:: location /pam_exec_protected { auth_pam "Exec Zone"; auth_pam_service_name "nginx_exec"; auth_pam_set_pam_env on; } With this configuration if you access an URL like: http://localhost:8000/pam_exec_protected/page?foo=yes&bar=too the PAM environment will include the following variables: HOST=localhost:8000 REQUEST=GET /pam_exec_protected/page?foo=yes&bar=too HTTP/1.1 You may use this information for request based authentication. You need a recent pam release (>= version 1.0.90) to expose environment variables to pam_exec. ngx_http_auth_pam_module-1.5.5/VERSION000066400000000000000000000000061444434462200176530ustar00rootroot000000000000001.5.5 ngx_http_auth_pam_module-1.5.5/config000066400000000000000000000010321444434462200177730ustar00rootroot00000000000000ngx_addon_name=ngx_http_auth_pam_module if test -n "$ngx_module_link"; then ngx_module_type=HTTP ngx_module_name=ngx_http_auth_pam_module ngx_module_incs= ngx_module_deps= ngx_module_srcs="$ngx_addon_dir/ngx_http_auth_pam_module.c" ngx_module_libs="-lpam" ngx_module_order="$ngx_module_name ngx_http_access_module" . auto/module else HTTP_MODULES="$HTTP_MODULES ngx_http_auth_pam_module" NGX_ADDON_SRCS="$NGX_ADDON_SRCS $ngx_addon_dir/ngx_http_auth_pam_module.c" CORE_LIBS="$CORE_LIBS -lpam" fi ngx_http_auth_pam_module-1.5.5/ngx_http_auth_pam_module.c000066400000000000000000000353751444434462200240460ustar00rootroot00000000000000/* * Copyright (C) 2008-2023 Sergio Talens-Oliag * * Based on nginx's 'ngx_http_auth_basic_module.c' by Igor Sysoev and apache's * 'mod_auth_pam.c' by Ingo Luetkebolhe. * * File: ngx_http_auth_pam_module.c */ #include #include #include #include #define NGX_PAM_SERVICE_NAME "nginx" /* Module context data */ typedef struct { ngx_str_t passwd; } ngx_http_auth_pam_ctx_t; /* PAM authinfo */ typedef struct { ngx_str_t username; ngx_str_t password; ngx_log_t *log; } ngx_pam_authinfo; /* Module configuration struct */ typedef struct { ngx_str_t realm; /* http basic auth realm */ ngx_str_t service_name; /* pam service name */ ngx_flag_t set_pam_env; /* flag that indicates if we should export variables to PAM or NOT */ } ngx_http_auth_pam_loc_conf_t; /* Module handler */ static ngx_int_t ngx_http_auth_pam_handler(ngx_http_request_t *r); /* Function that authenticates the user -- is the only function that uses PAM */ static ngx_int_t ngx_http_auth_pam_authenticate(ngx_http_request_t *r, ngx_http_auth_pam_ctx_t *ctx, ngx_str_t *passwd, void *conf); static ngx_int_t ngx_http_auth_pam_set_realm(ngx_http_request_t *r, ngx_str_t *realm); static void *ngx_http_auth_pam_create_loc_conf(ngx_conf_t *cf); static char *ngx_http_auth_pam_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child); static ngx_int_t ngx_http_auth_pam_init(ngx_conf_t *cf); static char *ngx_http_auth_pam(ngx_conf_t *cf, void *post, void *data); static ngx_conf_post_handler_pt ngx_http_auth_pam_p = ngx_http_auth_pam; static int ngx_auth_pam_talker(int num_msg, const struct pam_message ** msg, struct pam_response ** resp, void *appdata_ptr); static ngx_command_t ngx_http_auth_pam_commands[] = { { ngx_string("auth_pam"), NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LMT_CONF |NGX_CONF_TAKE1, ngx_conf_set_str_slot, NGX_HTTP_LOC_CONF_OFFSET, offsetof(ngx_http_auth_pam_loc_conf_t, realm), &ngx_http_auth_pam_p }, { ngx_string("auth_pam_service_name"), NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LMT_CONF |NGX_CONF_TAKE1, ngx_conf_set_str_slot, NGX_HTTP_LOC_CONF_OFFSET, offsetof(ngx_http_auth_pam_loc_conf_t, service_name), NULL }, { ngx_string("auth_pam_set_pam_env"), NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LMT_CONF |NGX_CONF_FLAG, ngx_conf_set_flag_slot, NGX_HTTP_LOC_CONF_OFFSET, offsetof(ngx_http_auth_pam_loc_conf_t, set_pam_env), NULL }, ngx_null_command }; static ngx_http_module_t ngx_http_auth_pam_module_ctx = { NULL, /* preconfiguration */ ngx_http_auth_pam_init, /* postconfiguration */ NULL, /* create main configuration */ NULL, /* init main configuration */ NULL, /* create server configuration */ NULL, /* merge server configuration */ ngx_http_auth_pam_create_loc_conf, /* create location configuration */ ngx_http_auth_pam_merge_loc_conf /* merge location configuration */ }; ngx_module_t ngx_http_auth_pam_module = { NGX_MODULE_V1, &ngx_http_auth_pam_module_ctx, /* module context */ ngx_http_auth_pam_commands, /* module directives */ NGX_HTTP_MODULE, /* module type */ NULL, /* init master */ NULL, /* init module */ NULL, /* init process */ NULL, /* init thread */ NULL, /* exit thread */ NULL, /* exit process */ NULL, /* exit master */ NGX_MODULE_V1_PADDING }; /* * Function to free PAM_CONV responses if an error is returned. */ static void free_resp(int num_msg, struct pam_response *response) { int i; if (response == NULL) return; for (i = 0; i < num_msg; i++) { if (response[i].resp) { /* clear before freeing -- may be a password */ bzero(response[i].resp, strlen(response[i].resp)); free(response[i].resp); response[i].resp = NULL; } } free(response); } /* * ngx_auth_pam_talker: supply authentication information to PAM when asked * * Assumptions: * A password is asked for by requesting input without echoing * A username is asked for by requesting input _with_ echoing */ static int ngx_auth_pam_talker(int num_msg, const struct pam_message ** msg, struct pam_response ** resp, void *appdata_ptr) { int i; ngx_pam_authinfo *ainfo; struct pam_response *response; ainfo = (ngx_pam_authinfo *) appdata_ptr; response = NULL; /* parameter sanity checking */ if (!resp || !msg || !ainfo) return PAM_CONV_ERR; /* allocate memory to store response */ response = malloc(num_msg * sizeof(struct pam_response)); if (!response) return PAM_CONV_ERR; /* copy values */ for (i = 0; i < num_msg; i++) { /* initialize to safe values */ response[i].resp_retcode = 0; response[i].resp = 0; /* select response based on requested output style */ switch (msg[i]->msg_style) { case PAM_PROMPT_ECHO_ON: /* on memory allocation failure, auth fails */ response[i].resp = strdup((const char *)ainfo->username.data); break; case PAM_PROMPT_ECHO_OFF: response[i].resp = strdup((const char *)ainfo->password.data); break; case PAM_ERROR_MSG: ngx_log_error(NGX_LOG_ERR, ainfo->log, 0, "PAM: \'%s\'.", msg[i]->msg); break; case PAM_TEXT_INFO: ngx_log_error(NGX_LOG_INFO, ainfo->log, 0, "PAM: \'%s\'.", msg[i]->msg); break; default: free_resp(i, response); return PAM_CONV_ERR; } } /* everything okay, set PAM response values */ *resp = response; return PAM_SUCCESS; } static ngx_int_t ngx_http_auth_pam_handler(ngx_http_request_t *r) { ngx_int_t rc; ngx_http_auth_pam_ctx_t *ctx; ngx_http_auth_pam_loc_conf_t *alcf; alcf = ngx_http_get_module_loc_conf(r, ngx_http_auth_pam_module); if (alcf->realm.len == 0) { return NGX_DECLINED; } ctx = ngx_http_get_module_ctx(r, ngx_http_auth_pam_module); if (ctx) { return ngx_http_auth_pam_authenticate(r, ctx, &ctx->passwd, alcf); } /* Decode http auth user and passwd, leaving values on the request */ rc = ngx_http_auth_basic_user(r); if (rc == NGX_DECLINED) { return ngx_http_auth_pam_set_realm(r, &alcf->realm); } if (rc == NGX_ERROR) { return NGX_HTTP_INTERNAL_SERVER_ERROR; } /* Check user & password using PAM */ return ngx_http_auth_pam_authenticate(r, ctx, &ctx->passwd, alcf); } /** * create a key value pair from the given key and value string */ static void set_to_pam_env(pam_handle_t *pamh, ngx_http_request_t *r, char *key, char *value) { if (key != NULL && value != NULL) { size_t size = strlen(key) + strlen(value) + 1 * sizeof(char); char *key_value_pair = ngx_palloc(r->pool, size); sprintf(key_value_pair, "%s=%s", key, value); pam_putenv(pamh, key_value_pair); } } /** * creates a '\0' terminated string from the given ngx_str_t * * @param source nginx string structure with data and length * @param pool pool of the request used for memory allocation */ static char* ngx_strncpy_s(ngx_str_t source, ngx_pool_t *pool) { // allocate memory in pool char* destination = ngx_palloc(pool, source.len + 1); strncpy(destination, (char *) source.data, source.len); // add null terminator destination[source.len] = '\0'; return destination; } /** * enrich pam environment with request parameters */ static void add_request_info_to_pam_env(pam_handle_t *pamh, ngx_http_request_t *r) { char *request_info = ngx_strncpy_s(r->request_line, r->pool); char *host_info = ngx_strncpy_s(r->headers_in.host->value, r->pool); set_to_pam_env(pamh, r, "REQUEST", request_info); set_to_pam_env(pamh, r, "HOST", host_info); } static ngx_int_t ngx_http_auth_pam_authenticate(ngx_http_request_t *r, ngx_http_auth_pam_ctx_t *ctx, ngx_str_t *passwd, void *conf) { ngx_int_t rc; ngx_http_auth_pam_loc_conf_t *alcf; ngx_pam_authinfo ainfo; struct pam_conv conv_info; /* PAM struct */ pam_handle_t *pamh; u_char *service_name; alcf = conf; size_t len; u_char *uname_buf, *p; /** * Get username and password, note that r->headers_in.user contains the * string 'user:pass', so we need to copy the username **/ for (len = 0; len < r->headers_in.user.len; len++) { if (r->headers_in.user.data[len] == ':') { break; } } uname_buf = ngx_palloc(r->pool, len+1); if (uname_buf == NULL) { return NGX_HTTP_INTERNAL_SERVER_ERROR; } p = ngx_cpymem(uname_buf, r->headers_in.user.data , len); *p ='\0'; ainfo.username.data = uname_buf; ainfo.username.len = len; ainfo.password.data = r->headers_in.passwd.data; ainfo.password.len = r->headers_in.passwd.len; ainfo.log = r->connection->log; conv_info.conv = &ngx_auth_pam_talker; conv_info.appdata_ptr = (void *) &ainfo; pamh = NULL; /* Initialize PAM */ if (alcf->service_name.data == NULL) { service_name = (u_char *) NGX_PAM_SERVICE_NAME; } else { service_name = alcf->service_name.data; } if ((rc = pam_start((const char *) service_name, (const char *) ainfo.username.data, &conv_info, &pamh)) != PAM_SUCCESS) { ngx_log_error(NGX_LOG_CRIT, r->connection->log, 0, "PAM: Could not start pam service: %s", pam_strerror(pamh, rc)); return NGX_HTTP_INTERNAL_SERVER_ERROR; } /* send client IP address to PAM */ char *client_ip_addr = ngx_strncpy_s(r->connection->addr_text, r->pool); if ((rc = pam_set_item(pamh, PAM_RHOST, client_ip_addr)) != PAM_SUCCESS) { ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "PAM: Could not set item PAM_RHOST: %s", pam_strerror(pamh, rc)); return NGX_HTTP_INTERNAL_SERVER_ERROR; } if (alcf->set_pam_env) { add_request_info_to_pam_env(pamh, r); } /* try to authenticate user, log error on failure */ if ((rc = pam_authenticate(pamh, PAM_DISALLOW_NULL_AUTHTOK)) != PAM_SUCCESS) { ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "PAM: user '%s' - not authenticated: %s", ainfo.username.data, pam_strerror(pamh, rc)); pam_end(pamh, PAM_SUCCESS); return ngx_http_auth_pam_set_realm(r, &alcf->realm); } /* endif authenticate */ /* check that the account is healthy */ if ((rc = pam_acct_mgmt(pamh, PAM_DISALLOW_NULL_AUTHTOK)) != PAM_SUCCESS) { ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "PAM: user '%s' - invalid account: %s", ainfo.username.data, pam_strerror(pamh, rc)); pam_end(pamh, PAM_SUCCESS); return ngx_http_auth_pam_set_realm(r, &alcf->realm); } pam_end(pamh, PAM_SUCCESS); return NGX_OK; } static ngx_int_t ngx_http_auth_pam_set_realm(ngx_http_request_t *r, ngx_str_t *realm) { r->headers_out.www_authenticate = ngx_list_push(&r->headers_out.headers); if (r->headers_out.www_authenticate == NULL) { return NGX_HTTP_INTERNAL_SERVER_ERROR; } r->headers_out.www_authenticate->hash = 1; #if nginx_version >= 1023000 r->headers_out.www_authenticate->next = NULL; #endif r->headers_out.www_authenticate->key.len = sizeof("WWW-Authenticate") - 1; r->headers_out.www_authenticate->key.data = (u_char *) "WWW-Authenticate"; r->headers_out.www_authenticate->value = *realm; return NGX_HTTP_UNAUTHORIZED; } static void * ngx_http_auth_pam_create_loc_conf(ngx_conf_t *cf) { ngx_http_auth_pam_loc_conf_t *conf; conf = ngx_pcalloc(cf->pool, sizeof(ngx_http_auth_pam_loc_conf_t)); if (conf == NULL) { return NGX_CONF_ERROR; } /* Strings are already NULL, but the flags have to be marked as unset */ conf->set_pam_env = NGX_CONF_UNSET; return conf; } static char * ngx_http_auth_pam_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child) { ngx_http_auth_pam_loc_conf_t *prev = parent; ngx_http_auth_pam_loc_conf_t *conf = child; if (conf->realm.data == NULL) { conf->realm = prev->realm; } if (conf->service_name.data == NULL) { conf->service_name = prev->service_name; } /* By default set_pam_env is off */ ngx_conf_merge_value(conf->set_pam_env, prev->set_pam_env, 0); return NGX_CONF_OK; } static ngx_int_t ngx_http_auth_pam_init(ngx_conf_t *cf) { ngx_http_handler_pt *h; ngx_http_core_main_conf_t *cmcf; cmcf = ngx_http_conf_get_module_main_conf(cf, ngx_http_core_module); h = ngx_array_push(&cmcf->phases[NGX_HTTP_ACCESS_PHASE].handlers); if (h == NULL) { return NGX_ERROR; } *h = ngx_http_auth_pam_handler; return NGX_OK; } static char * ngx_http_auth_pam(ngx_conf_t *cf, void *post, void *data) { ngx_str_t *realm = data; size_t len; u_char *basic, *p; if (ngx_strcmp(realm->data, "off") == 0) { realm->len = 0; realm->data = (u_char *) ""; return NGX_CONF_OK; } len = sizeof("Basic realm=\"") - 1 + realm->len + 1; basic = ngx_palloc(cf->pool, len); if (basic == NULL) { return NGX_CONF_ERROR; } p = ngx_cpymem(basic, "Basic realm=\"", sizeof("Basic realm=\"") - 1); p = ngx_cpymem(p, realm->data, realm->len); *p = '"'; realm->len = len; realm->data = basic; return NGX_CONF_OK; } /* File: ngx_http_auth_pam_module.c */