[Debian] libpam-mysql

libpam-mysql [Debian] - Logiciels - Linux et OS Alternatifs

Marsh Posté le 09-01-2007 à 23:26:27    

J'ai une interrogation concernant ce module PAM sur Debian Sarge. Quelqu'un a déjà réussi à le faire fonctionenr avec des mots de passe chiffrés ?
 
J'ai une installation qui fonctionne avec des mots de passe en clair mais si je suis la procédure de la documentation:
 

Code :
  1. crypt (0)
  3.     Specifies the method to encrypt the user's password:
  5.         * 0 (or "plain" ) = No encryption. Passwords stored in plaintext. HIGHLY DISCOURAGED.
  6.         * 1 (or "Y" ) = Use crypt(3) function
  7.         * 2 (or "mysql" ) = Use MySQL PASSWORD() function. It is possible that the encryption function used by pam-mysql is different from that of the MySQL server, as pam-mysql uses the function defined in MySQL's C-client API instead of using PASSWORD() SQL function in the query.
  8.         * 3 (or "md5" ) = Use MySQL MD5() function
  10. md5 (false)
  12.     If set to "true", use MD5 by default for crypt(3) hash. Only meaningful when crypt is set to "Y".


 
J'ai testé toute les possibilités... Et je trovue très peu d'informations sur le sujet sur le net.
Merci  :jap:

Reply

Marsh Posté le 09-01-2007 à 23:26:27   

Reply

Marsh Posté le 10-01-2007 à 10:12:52    

je l'utilise pour une authentication sasl  
le password est crypté en md5  

Reply

Marsh Posté le 10-01-2007 à 17:42:25    

Tu peux me faire deraper gentilment tes fichiers de conf ?

Reply

Marsh Posté le 10-01-2007 à 17:49:15    

je les poste ce soir quand je serai chez moi
mais pour info tu cherches bien a faire une authentication sasl avec postfix ou pas du tout ?

Reply

Marsh Posté le 10-01-2007 à 18:43:18    

thanks you :)  
et dans la base mysql tu as juste utiliser la fonction md5() ?

Reply

Marsh Posté le 10-01-2007 à 22:44:48    

sur une debian
avec les packages testing
 

Code :
  1. /etc/pam.d/smtp
  3. auth       required     pam_nologin.so
  4. auth       required     pam_mysql.so user=postfix passwd=xxx host=localhost db=postfix table=mailbox usercolumn=username passwdcolumn=password crypt=1 md5=1
  5. #auth       required     pam_unix.so
  6. auth       required     pam_env.so # [1]
  7. account       sufficient   pam_mysql.so user=postfix passwd=xxxx host=localhost db=postfix table=mailbox usercolumn=username passwdcolumn=password crypt=1 md5=1
  8. account    required     pam_unix.so


 
 

Code :
  1. /etc/init.d/saslauthd
  2. #! /bin/sh
  3. ### BEGIN INIT INFO
  4. # Provides:          saslauthd
  5. # Required-Start:    $local_fs $remote_fs
  6. # Required-Stop:     $local_fs $remote_fs
  7. # Default-Start:     2 3 4 5
  8. # Default-Stop:      S 0 1 6
  9. # Short-Description: saslauthd startup script
  10. # Description:       This script starts the saslauthd daemon. It is
  11. #                    configured using the file /etc/default/saslauthd.
  12. ### END INIT INFO
  14. # Author: Fabian Fagerholm <fabbe@debian.org>
  15. #
  16. # Based on previous work by Dima Barsky.
  18. # Do NOT "set -e"
  20. # PATH should only include /usr/* if it runs after the mountnfs.sh script
  21. PATH=/usr/sbin:/usr/bin:/sbin:/bin
  22. DESC="SASL Authentication Daemon"
  23. NAME=saslauthd
  24. DAEMON=/usr/sbin/$NAME
  25. DAEMON_ARGS=""
  26. SCRIPTNAME=/etc/init.d/$NAME
  27. FALLBACK_RUN_DIR=/var/run/$NAME
  28. EXIT_ERROR_CODE=1
  30. # Exit if the daemon is not installed
  31. test -x "$DAEMON" || exit 0
  33. # Read configuration variable file if it is present
  34. [ -r /etc/default/$NAME ] && . /etc/default/$NAME
  36. # Load the VERBOSE setting and other rcS variables
  37. [ -f /etc/default/rcS ] && . /etc/default/rcS
  39. # Define LSB log_* functions.
  40. # Depend on lsb-base (>= 3.0-6) to ensure that this file is present.
  41. . /lib/lsb/init-functions
  43. # Determine run directory and pid file location by looking for an -m option.
  44. RUN_DIR=`echo "$OPTIONS" | xargs -n 1 echo | sed -n '/^-m$/{n;p}'`
  45. if [ -z "$RUN_DIR" ]; then
  46.       # No run directory defined in defaults file, use fallback
  47.       RUN_DIR=$FALLBACK_RUN_DIR
  48. fi
  49. PIDFILE=$RUN_DIR/saslauthd.pid
  51. # If the daemon is not enabled, give the user a warning and then exit,
  52. # unless we are stopping the daemon
  53. if [ "$START" != "yes" -a "$1" != "stop" ]; then
  54.       log_warning_msg "To enable $NAME, edit /etc/default/$NAME and set START=yes"
  55.       exit 0
  56. fi
  58. # If no mechanisms are defined, log this and exit
  59. if [ -z "$MECHANISMS" ]; then
  60.       log_failure_msg "No mechanisms defined in /etc/default/$NAME," \
  61.                   "not starting $NAME"
  62.       exit $EXIT_ERROR_CODE
  63. fi
  65. # If there are mechanism options defined, prepare them for use with the -O flag
  66. if [ -n "$MECH_OPTIONS" ]; then
  67.       MECH_OPTIONS="-O $MECH_OPTIONS"
  68. fi
  70. # If there is a threads option defined, prepare it for use with the -n flag
  71. if [ -n "$THREADS" ]; then
  72.       THREAD_OPTIONS="-n $THREADS"
  73. fi
  75. # Construct argument string
  76. DAEMON_ARGS="$DAEMON_ARGS -a $MECHANISMS $MECH_OPTIONS $OPTIONS $THREAD_OPTIONS"
  78. #
  79. # Function that creates a directory with the specified
  80. # ownership and permissions
  81. #
  82. createdir()
  83. {
  84. # $1 = user
  85. # $2 = group
  86. # $3 = permissions (octal)
  87. # $4 = path to directory
  88.       # In the future, use -P/-Z to have SE Linux enhancement.
  89.       install -d --group="$2" --mode="$3" --owner="$1" "$4"
  90. }
  92. #
  93. # Function that starts the daemon/service
  94. #
  95. do_start()
  96. {
  97.       # Return
  98.       #   0 if daemon has been started
  99.       #   1 if daemon was already running
  100.       #   2 if daemon could not be started
  102.       if dpkg-statoverride --list $RUN_DIR > /dev/null; then
  103.             dir=`dpkg-statoverride --list $RUN_DIR`
  104.       fi
  105.       test -z "$dir" || createdir $dir
  107.       start-stop-daemon --start --quiet --pidfile $PIDFILE --name $NAME \
  108.             --exec $DAEMON --test > /dev/null \
  109.             || return 1
  110.       start-stop-daemon --start --quiet --pidfile $PIDFILE --name $NAME \
  111.             --exec $DAEMON -- $DAEMON_ARGS \
  112.             || return 2
  113.       # Add code here, if necessary, that waits for the process to be ready
  114.       # to handle requests from services started subsequently which depend
  115.       # on this one.  As a last resort, sleep for some time.
  116. }
  118. #
  119. # Function that stops the daemon/service
  120. #
  121. do_stop()
  122. {
  123.       # Return
  124.       #   0 if daemon has been stopped
  125.       #   1 if daemon was already stopped
  126.       #   2 if daemon could not be stopped
  127.       #   other if a failure occurred
  128.       start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 \
  129.             --pidfile $PIDFILE --name $NAME
  130.       RETVAL="$?"
  131.       [ "$RETVAL" = 2 ] && return 2
  132.       # Wait for children to finish too if this is a daemon that forks
  133.       # and if the daemon is only ever run from this initscript.
  134.       # If the above conditions are not satisfied then add some other code
  135.       # that waits for the process to drop all resources that could be
  136.       # needed by services started subsequently.  A last resort is to
  137.       # sleep for some time.
  138.       start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 \
  139.             --exec $DAEMON
  140.       [ "$?" = 2 ] && return 2
  141.       # Many daemons don't delete their pidfiles when they exit.
  142.       rm -f $PIDFILE
  143.       return "$RETVAL"
  144. }
  146. #
  147. # Function that sends a SIGHUP to the daemon/service
  148. #
  149. do_reload() {
  150.       #
  151.       # If the daemon can reload its configuration without
  152.       # restarting (for example, when it is sent a SIGHUP),
  153.       # then implement that here.
  154.       #
  155.       start-stop-daemon --stop --signal 1 --quiet --pidfile $PIDFILE \
  156.             --name $NAME
  157.       return 0
  158. }
  160. case "$1" in
  161.   start)
  162.       [ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME"
  163.       do_start
  164.       case "$?" in
  165.             0) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
  166.             1) [ "$VERBOSE" != no ] && log_progress_msg "(already running)" && \
  167.                                        log_end_msg 0 ;;
  168.             2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
  169.       esac
  170.       ;;
  171.   stop)
  172.       [ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"
  173.       do_stop
  174.       case "$?" in
  175.             0) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
  176.             1) [ "$VERBOSE" != no ] && log_progress_msg "(not running)" && \
  177.                                        log_end_msg 0 ;;
  178.             2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
  179.       esac
  180.       ;;
  181.   #reload|force-reload)
  182.       #
  183.       # If do_reload() is not implemented then leave this commented out
  184.       # and leave 'force-reload' as an alias for 'restart'.
  185.       #
  186.       #log_daemon_msg "Reloading $DESC" "$NAME"
  187.       #do_reload
  188.       #log_end_msg $?
  189.       #;;
  190.   restart|force-reload)
  191.       #
  192.       # If the "reload" option is implemented then remove the
  193.       # 'force-reload' alias
  194.       #
  195.       log_daemon_msg "Restarting $DESC" "$NAME"
  196.       do_stop
  197.       case "$?" in
  198.         0|1)
  199.             do_start
  200.             case "$?" in
  201.                   0) log_end_msg 0 ;;
  202.                   1) log_end_msg 1 ;; # Old process is still running
  203.                   *) log_end_msg 1 ;; # Failed to start
  204.             esac
  205.             ;;
  206.         *)
  207.             # Failed to stop
  208.             log_end_msg 1
  209.             ;;
  210.       esac
  211.       ;;
  212.   *)
  213.       echo "Usage: $SCRIPTNAME {start|stop|restart|force-reload}" >&2
  214.       exit 3
  215.       ;;
  216. esac
  218. :


 
 
 

Code :
  1. /etc/default/saslauthd
  3. #
  4. # Settings for saslauthd daemon
  5. #
  7. # Should saslauthd run automatically on startup? (default: no)
  8. START=yes
  10. # Which authentication mechanisms should saslauthd use? (default: pam)
  11. #
  12. # Available options in this Debian package:
  13. # getpwent  -- use the getpwent() library function
  14. # kerberos5 -- use Kerberos 5
  15. # pam       -- use PAM
  16. # rimap     -- use a remote IMAP server
  17. # shadow    -- use the local shadow password file
  18. # sasldb    -- use the local sasldb database file
  19. # ldap      -- use LDAP (configuration is in /etc/saslauthd.conf)
  20. #
  21. # Only one option may be used at a time. See the saslauthd man page
  22. # for more information.
  23. #
  24. # Example: MECHANISMS="pam"
  25. MECHANISMS="pam"
  27. # Additional options for this mechanism. (default: none)
  28. # See the saslauthd man page for information about mech-specific options.
  29. MECH_OPTIONS=""
  31. # How many saslauthd processes should we run? (default: 5)
  32. # A value of 0 will fork a new process for each connection.
  33. THREADS=5
  35. # Other options (default: -c)
  36. # See the saslauthd man page for information about these options.
  37. #
  38. # Example for postfix users: "-c -m /var/spool/postfix/var/run/saslauthd"
  39. # Note: See /usr/share/doc/sasl2-bin/README.Debian
  40. OPTIONS="-c -r -m /var/spool/postfix/var/run/saslauthd"


saslauthd
---------
 
Using saslauthd with Postfix:
 
 If you run a chrooted server such as Postfix and wish to use saslauthd, you
 must place the saslauthd socket ("mux" ) inside the Postfix chroot. You must
 also set correct overrides for the run directory inside the chroot, using
 dpkg-statoverride. Finally, you must add the postfix user to the sasl group.
 These steps ensure that the Debian subsystems know how you want things to be
 laid out.
 
 To place the saslauthd socket inside the Postfix chroot, edit
 /etc/default/saslauthd and set OPTIONS like this (you may omit -c):
  OPTIONS="-c -m /var/spool/postfix/var/run/saslauthd"
 
 To set the run directory using dpkg-statoverride, run this command as root:
  dpkg-statoverride --add root sasl 710 /var/spool/postfix/var/run/saslauthd
 
 Finally, to add the postfix user to the sasl group:
  adduser postfix sasl
 
 The init script will automatically create the run directory with the
 permissions you have set using dpkg-statoverride. Please note that you must
 also configure Postfix correctly. There are many options related to SASL. See
 the Postfix documentation for how to do this.
 
 -- Fabian Fagerholm <fabbe@debian.org>, Tue, 14 Nov 2006 14:21:50 +0200
 

Reply

Marsh Posté le 10-01-2007 à 22:46:09    

AVec les packages testing ? ceux de stable ca ne marchait pas ?
 
Merci en tout cas pour ces infos :)  :hello:  :jap:

Message cité 1 fois
Message édité par clockover le 10-01-2007 à 22:47:35
Reply

Marsh Posté le 10-01-2007 à 22:46:59    

clockover a écrit :

AVec les packages testing ? ceux de stable ca ne marchait pas ?


 
j'ai pas essayé  
mais a priori oui
 
 

Reply

Marsh Posté le 10-01-2007 à 22:48:10    

oki :) :hello:

Reply

Sujets relatifs:

Leave a Replay

Make sure you enter the(*)required information where indicate.HTML code is not allowed