lpalgarvio / mod-auth-external Goto Github PK

What steps will reproduce the problem?
1. Download source (or get source with svn)
2. Compile (with apxs2 or make)
3. get errors

What is the expected output? What do you see instead?


What version of the product are you using? On what operating system?


Please provide any additional information below.

[error message]
/usr/share/apr-1.0/build/libtool --silent --mode=compile --tag=disable-static 
i686-linux-gnu-gcc -prefer-pic -DLINUX=2 -D_FORTIFY_SOURCE=2 -D_GNU_SOURCE 
-D_LARGEFILE64_SOURCE -D_REENTRANT -I/usr/include/apr-1.0 
-I/usr/include/openssl -I/usr/include/xmltok -pthread     
-I/usr/include/apache2  -I/usr/include/apr-1.0   -I/usr/include/apr-1.0   -c -o 
mod_authnz_external.lo mod_authnz_external.c && touch mod_authnz_external.slo
mod_authnz_external.c:145:1: error: unknown type name 
'apr_OFN_ap_authn_cache_store_t'
mod_authnz_external.c:614:1: error: unknown type name 'authz_status'
mod_authnz_external.c: In function 'externalgroup_check_authorization':
mod_authnz_external.c:630:25: error: 'AUTHZ_DENIED_NO_USER' undeclared (first 
use in this function)
mod_authnz_external.c:630:25: note: each undeclared identifier is reported only 
once for each function it appears in
mod_authnz_external.c:633:28: error: 'AUTHZ_DENIED' undeclared (first use in 
this function)
mod_authnz_external.c:649:24: error: 'AUTHZ_GRANTED' undeclared (first use in 
this function)
mod_authnz_external.c: At top level:
mod_authnz_external.c:673:1: error: unknown type name 'authz_status'
mod_authnz_external.c: In function 'externalfilegroup_check_authorization':
mod_authnz_external.c:690:25: error: 'AUTHZ_DENIED_NO_USER' undeclared (first 
use in this function)
mod_authnz_external.c:693:28: error: 'AUTHZ_DENIED' undeclared (first use in 
this function)
mod_authnz_external.c:714:27: error: 'AUTHZ_GRANTED' undeclared (first use in 
this function)
mod_authnz_external.c: In function 'mock_turtle_cache':
mod_authnz_external.c:746:26: error: called object 'authn_cache_store' is not a 
function
mod_authnz_external.c: In function 'opt_retr':
mod_authnz_external.c:832:1: error: 'apr_OFN_ap_authn_cache_store_t' undeclared 
(first use in this function)
mod_authnz_external.c:832:2: error: expected expression before ')' token
mod_authnz_external.c: At top level:
mod_authnz_external.c:855:5: warning: initialization from incompatible pointer 
type [enabled by default]
mod_authnz_external.c:855:5: warning: (near initialization for 
'authz_externalgroup_provider.get_user_groups') [enabled by default]
mod_authnz_external.c:856:5: warning: excess elements in struct initializer 
[enabled by default]
mod_authnz_external.c:856:5: warning: (near initialization for 
'authz_externalgroup_provider') [enabled by default]
mod_authnz_external.c:863:5: warning: initialization from incompatible pointer 
type [enabled by default]
mod_authnz_external.c:863:5: warning: (near initialization for 
'authz_externalfilegroup_provider.get_user_groups') [enabled by default]
mod_authnz_external.c:864:5: warning: excess elements in struct initializer 
[enabled by default]
mod_authnz_external.c:864:5: warning: (near initialization for 
'authz_externalfilegroup_provider') [enabled by default]
mod_authnz_external.c: In function 'register_hooks':
mod_authnz_external.c:872:6: error: 'AUTHN_PROVIDER_VERSION' undeclared (first 
use in this function)
mod_authnz_external.c:873:32: error: 'AP_AUTH_INTERNAL_PER_CONF' undeclared 
(first use in this function)
mod_authnz_external.c:876:34: error: 'AUTHZ_PROVIDER_GROUP' undeclared (first 
use in this function)
mod_authnz_external.c:877:6: error: 'AUTHZ_PROVIDER_VERSION' undeclared (first 
use in this function)
mod_authnz_external.c: At top level:
mod_authnz_external.c:889:1: warning: data definition has no type or storage 
class [enabled by default]
mod_authnz_external.c:889:1: warning: parameter names (without types) in 
function declaration [enabled by default]
mod_authnz_external.c:889:1: error: function 'AP_DECLARE_MODULE' is initialized 
like a variable
mod_authnz_external.c:890:5: error: invalid initializer
mod_authnz_external.c:890:5: error: (near initialization for 
'AP_DECLARE_MODULE')
mod_authnz_external.c:890:5: warning: excess elements in scalar initializer 
[enabled by default]
mod_authnz_external.c:890:5: warning: (near initialization for 
'AP_DECLARE_MODULE') [enabled by default]
mod_authnz_external.c:890:5: warning: excess elements in scalar initializer 
[enabled by default]
mod_authnz_external.c:890:5: warning: (near initialization for 
'AP_DECLARE_MODULE') [enabled by default]
mod_authnz_external.c:890:5: warning: excess elements in scalar initializer 
[enabled by default]
mod_authnz_external.c:890:5: warning: (near initialization for 
'AP_DECLARE_MODULE') [enabled by default]
mod_authnz_external.c:890:5: warning: excess elements in scalar initializer 
[enabled by default]
mod_authnz_external.c:890:5: warning: (near initialization for 
'AP_DECLARE_MODULE') [enabled by default]
mod_authnz_external.c:890:5: warning: excess elements in scalar initializer 
[enabled by default]
mod_authnz_external.c:890:5: warning: (near initialization for 
'AP_DECLARE_MODULE') [enabled by default]
mod_authnz_external.c:890:5: warning: excess elements in scalar initializer 
[enabled by default]
mod_authnz_external.c:890:5: warning: (near initialization for 
'AP_DECLARE_MODULE') [enabled by default]
mod_authnz_external.c:890:5: warning: excess elements in scalar initializer 
[enabled by default]
mod_authnz_external.c:890:5: warning: (near initialization for 
'AP_DECLARE_MODULE') [enabled by default]
mod_authnz_external.c:891:5: warning: excess elements in scalar initializer 
[enabled by default]
mod_authnz_external.c:891:5: warning: (near initialization for 
'AP_DECLARE_MODULE') [enabled by default]
mod_authnz_external.c:892:5: warning: excess elements in scalar initializer 
[enabled by default]
mod_authnz_external.c:892:5: warning: (near initialization for 
'AP_DECLARE_MODULE') [enabled by default]
mod_authnz_external.c:893:5: warning: excess elements in scalar initializer 
[enabled by default]
mod_authnz_external.c:893:5: warning: (near initialization for 
'AP_DECLARE_MODULE') [enabled by default]
mod_authnz_external.c:894:5: warning: excess elements in scalar initializer 
[enabled by default]
mod_authnz_external.c:894:5: warning: (near initialization for 
'AP_DECLARE_MODULE') [enabled by default]
mod_authnz_external.c:895:5: warning: excess elements in scalar initializer 
[enabled by default]
mod_authnz_external.c:895:5: warning: (near initialization for 
'AP_DECLARE_MODULE') [enabled by default]
mod_authnz_external.c:897:1: warning: excess elements in scalar initializer 
[enabled by default]
mod_authnz_external.c:897:1: warning: (near initialization for 
'AP_DECLARE_MODULE') [enabled by default]
apxs:Error: Command failed with rc=65536

Currently if a loadbalancer is present the servers IP is sent and processed, 
which of course makes no sense whatsever. In the loadbalancer sends the 
X_FORWARDED_FOR header the authnz_external cannot handle it though. I wrote a 
small patch which sends the X_FORWADED_FOR header to the client in the PROXY 
environment variable


Here's the diff:


diff mod_authnz_external-3.2.6-new/mod_authnz_external.c 
mod_authnz_external-3.2.6/mod_authnz_external.c
100d99
< #define ENV_PROXY "PROXY"
438c437
<     char *child_env[13];

---
>     char *child_env[12];
461c460
<   const char *cookie, *host, *remote_host, *proxy;

---
>   const char *cookie, *host, *remote_host;
498,499d496
< if ((proxy= apr_table_get(r->headers_in, "X-Forwarded-For")) != NULL)
<       child_env[i++]= apr_pstrcat(p, ENV_PROXY"=", proxy, NULL);

The remote_ip field in the conn_rec structure was removed in Apache 2.4.1 and 
replaced with client_ip and useragent_ip.

See:
http://httpd.apache.org/docs/2.4/developer/new_api_2_4.html
http://svn.apache.org/viewvc/httpd/httpd/trunk/include/httpd.h?r1=1204968&r2=120
6291&diff_format=h
http://svn.apache.org/viewvc/httpd/httpd/trunk/include/httpd.h?r1=1211490&r2=121
4003&diff_format=h

Compilation of mod_authnz_external 3.3.1 fails with the following errors:

libtool --silent --mode=compile gcc -std=gnu99 -prefer-pic   -DLINUX=2 
-D_REENTRANT -D_GNU_SOURCE -g -O2 -pthread -c -o mod_authnz_external.lo 
mod_authnz_external.c && touch mod_authnz_external.slo
mod_authnz_external.c: In function 'exec_external':
mod_authnz_external.c:446: error: 'conn_rec' has no member named 'remote_ip'
mod_authnz_external.c:447: error: 'conn_rec' has no member named 'remote_ip'
apxs:Error: Command failed with rc=65536

This patch replaces accesses to remote_ip with client_ip.

What steps will reproduce the problem?
1. use mod-auth-external

What is the expected output? What do you see instead?
$_ENV containing vars like the AUTHENTICATORS file says
Nothing there ...

What version of the product are you using? On what operating system?
Gentoo, apache 2.4.7, mod-auth-external-3.3.2

Please provide any additional information below.

I have the following auth php script .. 

#!/usr/bin/php
<?php
function flog($msg){
        $fh = fopen("/tmp/apache_auth", "a");
        fwrite($fh, date("Y-m-d H:i:s")." - ".$msg."\n");
        fclose($fh);
}
$user = trim(fgets(STDIN));
$pass = trim(fgets(STDIN));
$pass = sha1($pass);
flog($user." - ".$pass);
flog(print_r($_ENV, 1));
foreach ($_ENV as $k => $v){
        flog($k . '=' . $v);
}
$conn = mysql_connect(...);
mysql_select_db(...);
$checkquery = "SELECT `id`, `expiry` FROM `auth` WHERE `user` = 
'".mysql_real_escape_string($user)."' AND `password` = 
'".mysql_real_escape_string($pass)."' AND `enabled` = '1' AND (`expiry` > NOW() 
OR `expiry` = '0000-00-00 00:00:00') LIMIT 1;";
flog($checkquery);
$check = mysql_query($checkquery, $conn) or die(mysql_error($conn));
if (mysql_num_rows($check) > 0){
        $row = mysql_fetch_array($check);
        if($row['expiry'] != '0000-00-00 00:00:00'){
                $update = "UPDATE `auth` SET `expiry` = NOW()+INTERVAL 1 MONTH WHERE `id` = '".$row['id']."' LIMIT 1;";
                $update = mysql_query($update, $conn) or die(mysql_error($conn));
        }
        flog("Yes");
        exit(0);
}else{
        flog("NO");
        exit(1);
}
?>

Here's what /tmp/apache_auth contains:
2013-12-12 19:30:17 - SELECT `id`, `expiry` FROM `auth` WHERE `user` = '...' 
AND `password` = '...' AND `enabled` = '1' AND (`expiry` > NOW() OR `expiry` = 
'0000-00-00 00:00:00') LIMIT 1;
2013-12-12 19:30:17 - Yes
2013-12-12 19:30:17 - dex - ...
2013-12-12 19:30:17 - Array
(
)

Am I doing it wrong ? Do I need to enable special flags in php/apache ?

What steps will reproduce the problem?
1. Create a destination with an external authenticator inside an SSL Virtual 
Host
2. Browse to this destination
3. Enter username and password

What is the expected output? What do you see instead?
Get "500 Internal Server Error".
Nothing logged in error_log

What version of the product are you using? On what operating system?
Apache 2.2.15 running on Linux Fedora 12
mod_authnz_external-3.2.6

Please provide any additional information below.
Relevant snippets from apache configuration:

DefineExternalAuth extauth pipe /usr/lib/httpd/test.pipe

<VirtualHost _default_:443>
...
Alias /myfiles /var/www/secure/myfiles                                          

<Location /myfiles>                                                             
         Order allow,deny                                                       

     Allow from all                                                                                     
     AuthType Basic                                                                                     
     AuthName "MyFiles"                                                                    
     AuthBasicProvider external                                                                         
     AuthExternal extauth                                                                                
     Require valid-user                                                                                 
</Location>                                                                     

Just wanted to thank you for this great module and the outstanding 
documentation!

Excellent work.

P.S.:
Sorry, didn't find any other way to provide you feedback. The mailingslist 
didn't seem appropriate.

What steps will reproduce the problem?
1. Install module 3.2.6 as described by documentation
2. Configure and install pwauth 2.3.10 for PAM authentication 
3. Configure httpd.conf as described by documentation

What is the expected output? What do you see instead?
pwauth works as expected when tested on command line but not through 
authnz_external_module
------------------------------------------------------------
[root@sbctos4 /]# sudo -u apache /usr/local/bin/pwauth
pwtest
m0d3xt3rn@l
[root@sbctos4 /]# echo $?
0
Using wrong name or password returns 1 as expected
-----------------------------------------------------------

What version of the product are you using? On what operating system?

[root@sbctos4 /]# httpd -v
Server version: Apache/2.2.15 (Unix)
Server built:   Feb 13 2012 22:31:42

[root@sbctos4 /]# uname -a
Linux sbctos4 2.6.32-220.el6.x86_64 #1 SMP Tue Dec 6 19:48:22 GMT 2011 x86_64 
x86_64 x86_64 GNU/Linux

authnz_external_module: 3.2.6
pwauth: 2.3.10


Please provide any additional information below.
Same configuration works on CentOS 5  (2.6.18-308.4.1.el5) but not on CentOS 6.2

CentOS 6.2 Configuration follows:
-----------------------------------------------------------------
-rwsr-xr-x. 1 root root 20382 Jun  9 17:29 /usr/local/bin/pwauth
-----------------------------------------------------------------
pwauth config.h and Makefile attached
/etc/pam.d/pwauth attached
/etc/httpd/conf/httpd.conf attached

Hi!

I'm trying for 2 days now to write a custom PAM script which authenticates with 
sys user and pass.
I made examples in C, python and perl but I have the same problem with all of 
them.

When I test the script in my shell everything works well.
I test them with 

# ./script;echo $?

And get 0 or 1 back.

But as soon as I try to use it with mod_authz_external and Apache it stops 
working.
Even with a valid user I get an 1 back and are not able to log in.

It seems that there is a problem with PAM and maybe the Apache environment.
I read somewhere that I have to set the environment variables to use PAM but I 
have no clue how.

I attached examples in C, Perl and Python.
Choose whatever you like, they work all the same... returning the exit code 0 
or 1.

Every help or hint would be appreciated!

Thanks!

Currently if a loadbalancer is present the servers IP is sent and processed, 
which of course makes no sense whatsever. In the loadbalancer sends the 
X_FORWARDED_FOR header the authnz_external cannot handle it though. I wrote a 
small patch which sends the X_FORWADED_FOR header to the client in the PROXY 
environment variable


Here's the diff:


diff mod_authnz_external-3.2.6-new/mod_authnz_external.c 
mod_authnz_external-3.2.6/mod_authnz_external.c
100d99
< #define ENV_PROXY "PROXY"
438c437
<     char *child_env[13];

---
>     char *child_env[12];
461c460
<   const char *cookie, *host, *remote_host, *proxy;

---
>   const char *cookie, *host, *remote_host;
498,499d496
< if ((proxy= apr_table_get(r->headers_in, "X-Forwarded-For")) != NULL)
<       child_env[i++]= apr_pstrcat(p, ENV_PROXY"=", proxy, NULL);

What steps will reproduce the problem?

1. install mod_authnz_external 3.2.x version
2. configure external authenticator to use the checkpassword method
3. attempt to authenticate with checkpassword compatible authenticator
(like vcheck).

What is the expected output? What do you see instead?

Expected login when correct credentials are entered.


What version of the product are you using? On what operating system?

3.2.x versions, on CentOS.  3.1.x on same system seems fine.

Please provide any additional information below.

What seems to be happening is that the user and password are being sent in
on descriptor 0, not 3 like it should be.  

Hello,

I think it would be a nice feature (or make it default) to be able to pass the 
data in base64 to the external authentication program.

Yesterday i wrote some little script to check username/password with SQL and 
thought: "oh, here you have to be very carefully.."

But mod-auth-external makes it very easy to implement an own script and I think 
not everyone would realize that you have to check the input..

esco

What steps will reproduce the problem?
1. Build the program
2.
3.

What is the expected output? What do you see instead?
a "make" tries to install the program instead of just building it.

What version of the product are you using? On what operating system?
newest on RHEL5.6

Please provide any additional information below.
Just a small makefile syntax addition to set default build target to   I've 
included a patch.

Mod-auth-external was originally written by Nathan Neulinger, who passed 
maintenance to Tyler Allison. I've been the maintainer for nearly 15 years now. 
I've pretty much completely rewritten it more than once as Apache has evolved.

It's been years since I've done any active development, beyond just keeping up 
with changes in Apache, and lately I haven't done the latter very well. I don't 
actually maintain any production servers these days. To test mod-auth-external, 
I set up a dummy server on my desktop linux box to work as a test bed.

I moved this project into code.google.com partly in hopes of smoothing the 
transition to a new maintainer when the time comes to do so. I think that the 
time has come for someone else to take the job.

At a minimum, the job entails updating mod-auth-external each time Apache 
modifies their API, which is really just a few times a year. I think there are 
possibilities for new development - such as supporting authentication daemons - 
but I don't think there is any clamor for that. I get user questions at a rate 
of about ten to twelve a year, which I try to answer to the best of my ability. 
So this is not a huge job.

You'd also be taking over support of mod_authz_unixgroup and probably pwauth. 
Though possibly different people could maintain different parts. In fact, it 
might not be a bad idea to have more than one maintainer. This google code 
system certainly makes that easy.

Anyway, I'd appreciate hearing from volunteers. This is hardly the cutting edge 
of open source software, but it's still useful and widely used.

"In theory it should now work on any operating system supported by Apache, 
including Windows. However, I do not know that anyone has tried this. If you 
experiment with this, please let us know the results."

I created a 32-bit build of the module at version 3.2.6 on Ubuntu 11.10 i386 
with default compiler flags.  My understanding is that Apache 2 has its own 
dynamic loader and can run module dynamic libs in a platform independent way?

Anyway, this build cannot be correctly loaded in 32-bit Apache 2.2 running on 
Windows 2008 Server R2.  Apache fails with error "not a valid Win32 
application" (or similar).

I haven't tried a Windows build yet but would probably have more success I 
imagine, or at least be able to pinpoint the error.

What steps will reproduce the problem?
1. Normal install and setup can work but the provided environment does not 
include REQUEST_METHOD?
2.
3.

What is the expected output? What do you see instead?
ENV{'REQUEST_METHOD'} is null

What version of the product are you using? On what operating system?
3.2.4

Please provide any additional information below.
This is more of a feature request than an issue.  It will be very useful to 
also know the request_method used such as "GET" "POST" "PUT" - mostly valuable 
if you are using authnz_external on a DAV folder so you can decide 
read-only/read-write permissions by understanding the request_method.

The code would just need a patch to add request_method to the environment.  
Happy to contribute the patch if you would like for me to!

Vijay 

Fixed an exploitable SQL injection flaw - should be considered a "critical" 
update for any users of this code.  Patch copied from 
http://anders.fix.no/software/#unix

What steps will reproduce the problem?
1. Regular Setup

What is the expected output? What do you see instead?
Using PHP "print_r($_SERVER['GROUP'])" is empty, i expect to see the group name 
via
Require external-group developer test

What version of the product are you using? On what operating system?
3.3.1

Please provide any additional information below.
'GROUP' variable is not being passed to external script

This is how I set up a "stress test" for Apache:

1. Set up a web page that issues 100 AJAX requests within a short period of time
2. Using the about:config page in Firefox, modify the parameter 
network.http.max-persistent-connections-per-server to allow 50 simultaneous 
connections 
3. Set up Apache so that the MPM operates in worker mode (rather than prefork).

What is the expected output? What do you see instead?

When I run the stress test, about 10% of the AJAX requests are lost, and the
Apache error logs contain entries like this:

[cgid:error] [pid 27442:tid 1] AH01239: cgid daemon process died, restarting

There are several ways I can make the problem go away: (1) change the MPM
to use prefork rather than worker, (2) change the authentication mode to use
file authentication instead of external authentication, (3) decrease the 
number of simultaneous connections used by Firefox.  However it appears that
mod_authnz_external is unable work properly under heavy loads when threading
is used.

What version of the product are you using? On what operating system?

I am running Apache 2.4.10 with version 3.2.3 of mod_authnz_external

Please provide any additional information below.

I did my testing on an HP Integrity box running HP-UX 11.31.  

If mod_authnz_external simply does not support thread safety, then I will set 
up my Apache server to use prefork, but I would like to use threading if
possible.

What steps will reproduce the problem?
1. use mod-auth-external

What is the expected output? What do you see instead?
I expect the dirindex to show right away .. but it doesn't .. I have to wait a 
whole minute ..

What version of the product are you using? On what operating system?
Gentoo 2.4.7, mod 3.3.1

Please provide any additional information below.

http://apaste.info/etlt
http://apaste.info/538w

What steps will reproduce the problem?
1. Put the following in a .htaccess file:
AuthType Basic
AuthBasicProvider external file
AuthExternal pwauth
AuthUserFile /web/htpasswd
Require valid-user
2. Access a URL under that tree
3. Offer credentials of a user described in /web/htpasswd

What is the expected output? What do you see instead?
Page should load. Instead, I get back "401 Authorization Required". The
error log shows the following:
[Thu May 27 11:57:51 2010] [error] [client 128.zzz.xxx.yyy] AuthExtern
pwauth [/usr/local/bin/pwauth]: Failed (1) for user htphil
[Thu May 27 11:57:51 2010] [error] [client 128.zzz.xxx.yyy] user htphil:
authentication failure for "/test/": Password Mismatch
Apparently, mod_authn_file was never consulted

What version of the product are you using? On what operating system?
Package libapache2-mod-authnz-external version 3.1.0-1ubuntu2 on Ubuntu
8.04.4 Hardy

Please provide any additional information below.
The documentation says that mod_auth_basic handles the issue of treating
the auth[nz] modules non-authoritatively, but that doesn't quite seem to be
the case.