57236

How to check login credentials in linux when not running as root?

Question:

I have written a cgi-bin application in C that runs in a browser and allows the user to open an interactive shell and view & edit files on a Linux machine. It runs as the standard apache "www-data" user. I just added a login screen to it where the user types in their name and password (in a form) but I cannot authenticate the user using <strong>getspnam</strong> since this function only works when running as root.

What options do I have to check the login credentials of a user when not running as root?

PS: In my interactive shell I can type "su root" and then type in my password and it does elevate to root fine so it obviously can be done interactively.

Answer1:

With regard to your PS: Well, when you do a su root you're switching to the root user. So yes, of course, root can read the shadow file, you all ready said that.

With regard to your problem: Can't you have your apache processes temporarily elevate to root (by calling setuid or similar) to perform the authentication?

Good luck!

Answer2:

I think you want to take a look at <a href="http://en.wikipedia.org/wiki/Linux_PAM" rel="nofollow">Pluggable authentication modules</a>. AFAIK, PAM handles all the messy stuff for you and you just need to do a few function calls to authenticate the user on whatever the backend to authenticate users on the Linux host is (be it shadow passwords, nis, ldap, whatever)

Here's a short <a href="http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/Linux-PAM_MWG.html" rel="nofollow">guide</a> about integrating your C code with them.

Answer3:

As suggested, I think PAM is the modern way to do this. But if you want to go old school, you need to create a setuid-root program (not a script) to do your authentication.

There are lots of gotchas with setuid-root programs, which is why PAM is likely better.

<a href="http://nob.cs.ucdavis.edu/bishop/secprog/" rel="nofollow">Here's a link</a> to some good papers on safely writing setuid-root programs.

Recommend

  • Curl works, requests doesn't
  • office365 Authentication
  • cant connect to kafka from external machine
  • Cache TFS login credentials for git-tf
  • Zend Studio formatter uses wrong format
  • Change AD Password using PHP/COM/ADSI/LDAP
  • PassportJs, local strategy cannot be found
  • How to add a custom HTTP header to ajax request with js or jQuery
  • Validate Expired Password in active directory
  • Slim Framework Method not allowed. Must be one of: POST (405)
  • Office365 authentication without login redirection
  • ASP.NET windows authentication should always ask for credentials
  • Authentication failed with Azure Active Directory in Windows Phone
  • JBoss External Properties Files in Classpath
  • Using a canvas object in a thread to do simple animations - Java
  • htaccess add www if not subdomain, if subdomain remove www
  • How to run “Deployd” on port 80 instead of port 5000 in webserver.
  • Avoid links criss cross / overlap in d3.js using force layout
  • Jenkins: How To Build multiple projects from a TFS repository?
  • Javascript simulate pressing enter in input box
  • Deleting and Updating values from a cusrsor adapter
  • How to recover from a Spring Social ExpiredAuthorizationException
  • script to move all files from one location to another location
  • Modifying destination and filename of gulp-svg-sprite
  • ILMerge & Keep Assembly Name
  • 'TypeError' while using NSGA2 to solve Multi-objective prob. from pyopt-sparse in OpenMDAO
  • ActionScript 2 vs ActionScript 3 performance
  • Large data - storage and query
  • How can I estimate amount of memory left with calling System.gc()?
  • Apache 2.4 - remove | delete | uninstall
  • WOWZA + RTMP + HTML5 Playback?
  • NSLayoutConstraint that would pin a view to the bottom edge of a superview
  • How can I get HTML syntax highlighting in my editor for CakePHP?
  • Authorize attributes not working in MVC 4
  • Binding checkboxes to object values in AngularJs
  • How can i traverse a binary tree from right to left in java?
  • UserPrincipal.Current returns apppool on IIS
  • Net Present Value in Excel for Grouped Recurring CF
  • jQuery Masonry / Isotope and fluid images: Momentary overlap on window resize
  • How to load view controller without button in storyboard?