Re: [gentoo-user] [OT?] /etc/shadow perms group shadow?

[Michael Higgins]

On Sat, 15 Nov 2008 06:45:54 +0000
Stroller <stroller@××××××××××××××××××.uk> wrote:

>
> On 15 Nov 2008, at 00:57, Michael Higgins wrote:
> > ...
> > An application runs as a web server. In this application I have
> > hooks to PAM. The results I was getting from attempting to
> > authorize against PAM were fruitless, until I looked at making a
> > way for the user running this to read /etc/shadow.
> >
> > At any rate, I wound up making a group "shadow" and making /etc/
> > shadow owned by group shadow and group-readable, adding my user to
> > this group. Now it works great.
> >
> > Isn't this something Gentoo should have a mechanism for handling
> > already, or am I totally off the mark here? Does anyone know if
> > this ability to read /etc/shadow to authenticate on a system is
> > somehow deprecated in favor of something else, or just overlooked
> > in Gentoo land... or what? '-)
>
> Isn't this depreciated in favour of PAM?

Well, my point was to use PAM. But, it would seem my regular user needs higher privileges for this.

> I think you want to be
> looking at why that wasn't working & at fixing it.

It wasn't working, to all appearances, because my user didn't have permission to read /etc/shadow. I didn't write the PAM hook code, just observing results of trying to use it. '-)

> What if an
> administrator wants to install your app on a system where users
> authenticate against LDAP?

They'd use an LDAP hook and probably wouldn't have this problem. '-)

>
> Sorry to sound negative, but there must be some books / HOWTOs about
> PAM which show minimal programming examples. I'd copy one of those
> and see why it won't work on your system or how your code differs.
>

Ah, as I said, the code with the hook is not mine. I'm just observing the behavior of using the code, and all experiments show that giving the user permission to read /etc/shadow is the fix. 

Other distros _seem_ to include a group to allow use of PAM by arbitrary users added to this group. Unfortunately, I don't run any other distros so to be able to confirm or deny this. (Was hoping someone else might.)

If I can get some feeling as to why Gentoo *doesn't* include this group, it would inform my reply to the maintainer of the PAM hook code. 

In other words, if the PAM suite was modified at some point to provide access to the needed information without superuser privileges, I'd need to have some references to this fact. I've not found any. :(

Rather, it seemed from posts about several other similar problems solved that in other distros a 'shadow' group has been created and the perms to /etc/shadow modified to allow reading by this group. Maybe filing a bug report would get me some Gentoo reasoning for why this isn't in place already, but I wanted to grab a sanity check here first. '-)

Thanks!

Cheers,

-- 
 |\  /|        |   |          ~ ~  
 | \/ |        |---|          `|` ?
 |    |ichael  |   |iggins    \^ /
 michael.higgins[at]evolone[dot]org