Forum OpenACS Development: [Announcement] ns_pam module available

Collapse
Posted by Mat Kovach on
Ladies, Gentlemen, and Talli:

I'm late in this announcement but....

There is now a slightly tested ns_pam module for AOLserver.  It allows your to create a PAM domain (or use a current pam domain) to authenticate in AOLserver.

You can download it at: http://braindamage.alal.com/software/nspam.html

Big note:

``This module will not allow authentication to PAM modules that require root to authenticate.  This includes anything that uses the shadow passwords.  Yes, there ways to manipulate the system files to allow this but there are some security risks involved.  I don't recommend doing that solution, refuse to mention it, and will not support it.''

Usage:

ns_pam auth username password

This is the auth command syntax.  You supply the username and password to the command and you will be returned either:

o 1 for a valid login

o 0 Indicating a bad username/password combo

o It will return NS_ERROR and the string of the PAM error if there is an error.

if {[catch {set auth_p [ns_parm auth $username $password]} errrpt]} {
        ns_puts "There was an error: $errrpt"
    exit TCL_ERROR
}

This function out return 1 if the combo was valid and return 0 if there  was an invalid login or throw an error.

ns_pam chpass username oldpassword newpasswd

This is the change password command syntax.  You supply the username old password and new password.  you will be returned either:

o 1 for a valid login

o 0 Indicating a bad username/password combo

o It will return NS_ERROR and the string of the PAM error if there is an error.

Collapse
Posted by Jamie Rasmussen on
Cool!  I've added this to my list of AOLserver modules at http://empoweringminds.mle.ie/openacs/aolserver_modules  If anyone knows of other modules I should add or update, please let me know.  Is the official name of the module nspam or ns_pam?
Collapse
Posted by Mat Kovach on
The published name is ns_pam (nspam looks too much like SPAM).  Internally it is call Harvey.

I still have the issue of using programs that require root access (for using /etc/shadow).  I'm looking at the best way to implement a ns_extauth but I haven't worked up the best (and least expensive resource-wise) implementation yet.