Score:2

How to authenticate local Linux user with Nginx PAM module?

in flag

I would like to be able to have a local Linux user authenticate with their credentials when accessing a site. I am using the ngx_http_auth_pam_module. In the nginx.conf file I have the following configuration for the location directive:

location / {
        proxy_pass http://somewebsite:5000;
        root   html;
        index  index.html index.htm;
        auth_pam "Secure area";
        auth_pam_service_name "nginx";
    }

With the "auth_pam" and "auth_pam_service_name" syntaxes in my nginx.conf file I get prompted when accessing the site to enter in credentials. In the /etc/pam.d directory I have created an "nginx" service file with the following:

auth required pam_unix.so
account required pam_unix.so

I am running this on a CentOS 7 server. I understand that I would have to create a local Linux user and/or group and possibly provide access to the /etc/shadow file but using the tutorials I found online I am still not able to login with a local user. Would someone please be able to provide me with steps on how to get it to work so that I can login with a local Linux user when accessing the site?

Thank you, any help is appreciated and I can give more information if needed.

Score:3
cz flag

The README for this third party nginx module says:

Note that the module runs as the web server user, so the PAM modules used must be able to authenticate the users without being root; that means that if you want to use the pam_unix.so module to autenticate users you need to let the web server user to read the /etc/shadow file if that does not scare you (on Debian like systems you can add the www-data user to the shadow group).

Note well the security implications of allowing your web server and/or web application to read the shadow file.

Nebek avatar
in flag
Thank you Michael. What would be my web server user, or how can I find out? Would it be Nginx?
Michael Hampton avatar
cz flag
@Nebek It's shown in the process list. You can also check the systemd unit or the nginx configuration file.
Nebek avatar
in flag
Sorry Michael but I am still not understanding. In my nginx configuration file, towards the top, I see the line 'user nobody'. Is 'nobody' the web server user? Should I edit this line? Also, if you can please provide me with steps on how to give the web server user permission to read the /etc/shadow file. Thank you!
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.