public inbox for [email protected]
help / color / mirror / Atom feedpam-linux, /etc/shadow : HOW-TO
5+ messages / 4 participants
[nested] [flat]
* pam-linux, /etc/shadow : HOW-TO
@ 2003-05-20 19:13 ahoward <[email protected]>
0 siblings, 2 replies; 5+ messages in thread
From: ahoward @ 2003-05-20 19:13 UTC (permalink / raw)
To: [email protected]
note: i'm no sysad, nor do i even pretend to understand pam, the linux kernel,
or postgresql, but this setup is a safe, working, postgresql/linux/pam setup.
0) configure postgresql for pam, for example
[root@omega tmp]# grep pam /usr/local/pgsql/data/pg_hba.conf
host all all 137.75.0.0 255.255.0.0 pam
1) create a /etc/pam.d/postgresql entry, here's how i did mine
[root@omega tmp]# cp /etc/pam.d/passwd /etc/pam.d/postgresql
i don't know if it's the best setup, but it works! mine looks like this
[root@omega tmp]# cat /etc/pam.d/postgresql
#%PAM-1.0
auth required /lib/security/pam_stack.so service=system-auth
account required /lib/security/pam_stack.so service=system-auth
password required /lib/security/pam_stack.so service=system-auth
2) create a shadow group which will be used for user's needing read-access to
/etc/shadow, and add postgres (or whatever user the postmaster runs as) to
this entry. i used vi to add this entry to /etc/group
[root@omega tmp]# grep shadow /etc/group
shadow:*:4002:root,postgres
root probably does not *need* to be added.
note the '*' v.s. an 'x' in the password field. if you place an 'x' there
you will also have to set up /etc/gshadow - i did not want to do this. if
you don't set up /etc/gshadow pam will NOT work if an 'x' is in the password
field - at least with my linux system.
3) make /etc/shadow group shadow
[root@omega tmp]# chgrp shadow /etc/shadow
4) chmod 0440 /etc/shadow
essentially, pam will not work with postgres since the daemon needs at some
point, no matter how many library calls deep, to open and read /etc/shadow
(assuming this is how your system is using pam). you must have some solution
which allows postgres, but not everyone, to read /etc/shadow. others probably
exist.
-a
--
====================================
| Ara Howard
| NOAA Forecast Systems Laboratory
| Information and Technology Services
| Data Systems Group
| R/FST 325 Broadway
| Boulder, CO 80305-3328
| Email: [email protected]
| Phone: 303-497-7238
| Fax: 303-497-7259
====================================
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: [GENERAL] pam-linux, /etc/shadow : HOW-TO
@ 2003-05-21 06:36 Shridhar Daithankar <[email protected]>
parent: ahoward <[email protected]>
1 sibling, 1 reply; 5+ messages in thread
From: Shridhar Daithankar @ 2003-05-21 06:36 UTC (permalink / raw)
To: [email protected]; ahoward <[email protected]>; +Cc: [email protected]
Hi,
could you please make a smal writeup on this so that it canbe posted on
techdocs. A small HOWTO.. That would help a lot of people.
Shridhar
On 20 May 2003 at 19:13, ahoward wrote:
>
> note: i'm no sysad, nor do i even pretend to understand pam, the linux kernel,
> or postgresql, but this setup is a safe, working, postgresql/linux/pam setup.
>
> 0) configure postgresql for pam, for example
>
> [root@omega tmp]# grep pam /usr/local/pgsql/data/pg_hba.conf
> host all all 137.75.0.0 255.255.0.0 pam
>
> 1) create a /etc/pam.d/postgresql entry, here's how i did mine
>
> [root@omega tmp]# cp /etc/pam.d/passwd /etc/pam.d/postgresql
>
> i don't know if it's the best setup, but it works! mine looks like this
>
> [root@omega tmp]# cat /etc/pam.d/postgresql
> #%PAM-1.0
> auth required /lib/security/pam_stack.so service=system-auth
> account required /lib/security/pam_stack.so service=system-auth
> password required /lib/security/pam_stack.so service=system-auth
>
> 2) create a shadow group which will be used for user's needing read-access to
> /etc/shadow, and add postgres (or whatever user the postmaster runs as) to
> this entry. i used vi to add this entry to /etc/group
>
> [root@omega tmp]# grep shadow /etc/group
> shadow:*:4002:root,postgres
>
> root probably does not *need* to be added.
>
> note the '*' v.s. an 'x' in the password field. if you place an 'x' there
> you will also have to set up /etc/gshadow - i did not want to do this. if
> you don't set up /etc/gshadow pam will NOT work if an 'x' is in the password
> field - at least with my linux system.
>
> 3) make /etc/shadow group shadow
>
> [root@omega tmp]# chgrp shadow /etc/shadow
>
> 4) chmod 0440 /etc/shadow
>
>
> essentially, pam will not work with postgres since the daemon needs at some
> point, no matter how many library calls deep, to open and read /etc/shadow
> (assuming this is how your system is using pam). you must have some solution
> which allows postgres, but not everyone, to read /etc/shadow. others probably
> exist.
>
> -a
>
> --
> ====================================
> | Ara Howard
> | NOAA Forecast Systems Laboratory
> | Information and Technology Services
> | Data Systems Group
> | R/FST 325 Broadway
> | Boulder, CO 80305-3328
> | Email: [email protected]
> | Phone: 303-497-7238
> | Fax: 303-497-7259
> ====================================
>
> ---------------------------(end of broadcast)---------------------------
> TIP 4: Don't 'kill -9' the postmaster
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: [GENERAL] pam-linux, /etc/shadow : HOW-TO
@ 2003-05-21 16:22 ahoward <[email protected]>
parent: Shridhar Daithankar <[email protected]>
0 siblings, 1 reply; 5+ messages in thread
From: ahoward @ 2003-05-21 16:22 UTC (permalink / raw)
To: Shridhar Daithankar <[email protected]>; +Cc: [email protected]; [email protected]
On Wed, 21 May 2003, Shridhar Daithankar wrote:
> Hi,
>
> could you please make a smal writeup on this so that it canbe posted on
> techdocs. A small HOWTO.. That would help a lot of people.
>
> Shridhar
sure. html?
-a
>
> On 20 May 2003 at 19:13, ahoward wrote:
>
> >
> > note: i'm no sysad, nor do i even pretend to understand pam, the linux kernel,
> > or postgresql, but this setup is a safe, working, postgresql/linux/pam setup.
> >
> > 0) configure postgresql for pam, for example
> >
> > [root@omega tmp]# grep pam /usr/local/pgsql/data/pg_hba.conf
> > host all all 137.75.0.0 255.255.0.0 pam
> >
> > 1) create a /etc/pam.d/postgresql entry, here's how i did mine
> >
> > [root@omega tmp]# cp /etc/pam.d/passwd /etc/pam.d/postgresql
> >
> > i don't know if it's the best setup, but it works! mine looks like this
> >
> > [root@omega tmp]# cat /etc/pam.d/postgresql
> > #%PAM-1.0
> > auth required /lib/security/pam_stack.so service=system-auth
> > account required /lib/security/pam_stack.so service=system-auth
> > password required /lib/security/pam_stack.so service=system-auth
> >
> > 2) create a shadow group which will be used for user's needing read-access to
> > /etc/shadow, and add postgres (or whatever user the postmaster runs as) to
> > this entry. i used vi to add this entry to /etc/group
> >
> > [root@omega tmp]# grep shadow /etc/group
> > shadow:*:4002:root,postgres
> >
> > root probably does not *need* to be added.
> >
> > note the '*' v.s. an 'x' in the password field. if you place an 'x' there
> > you will also have to set up /etc/gshadow - i did not want to do this. if
> > you don't set up /etc/gshadow pam will NOT work if an 'x' is in the password
> > field - at least with my linux system.
> >
> > 3) make /etc/shadow group shadow
> >
> > [root@omega tmp]# chgrp shadow /etc/shadow
> >
> > 4) chmod 0440 /etc/shadow
> >
> >
> > essentially, pam will not work with postgres since the daemon needs at some
> > point, no matter how many library calls deep, to open and read /etc/shadow
> > (assuming this is how your system is using pam). you must have some solution
> > which allows postgres, but not everyone, to read /etc/shadow. others probably
> > exist.
> >
> > -a
> >
> > --
> > ====================================
> > | Ara Howard
> > | NOAA Forecast Systems Laboratory
> > | Information and Technology Services
> > | Data Systems Group
> > | R/FST 325 Broadway
> > | Boulder, CO 80305-3328
> > | Email: [email protected]
> > | Phone: 303-497-7238
> > | Fax: 303-497-7259
> > ====================================
> >
> > ---------------------------(end of broadcast)---------------------------
> > TIP 4: Don't 'kill -9' the postmaster
>
>
>
--
====================================
| Ara Howard
| NOAA Forecast Systems Laboratory
| Information and Technology Services
| Data Systems Group
| R/FST 325 Broadway
| Boulder, CO 80305-3328
| Email: [email protected]
| Phone: 303-497-7238
| Fax: 303-497-7259
====================================
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: [GENERAL] pam-linux, /etc/shadow : HOW-TO
@ 2003-05-22 01:18 Justin Clift <[email protected]>
parent: ahoward <[email protected]>
0 siblings, 0 replies; 5+ messages in thread
From: Justin Clift @ 2003-05-22 01:18 UTC (permalink / raw)
To: ahoward <[email protected]>; +Cc: Shridhar Daithankar <[email protected]>; [email protected]; [email protected]
ahoward wrote:
> On Wed, 21 May 2003, Shridhar Daithankar wrote:
>
>
>>Hi,
>>
>>could you please make a smal writeup on this so that it canbe posted on
>>techdocs. A small HOWTO.. That would help a lot of people.
>>
>> Shridhar
>
>
> sure. html?
Um, whatever works for you. :)
If you want to do it the easy way, and also assist in the testing of a Content Management System that I'm hoping is good enough to redo the Techdocs site with,
then putting it here would be cool:
http://techdocs.postgresql.org/v2/Guides/
Regards and best wishes,
Justin Clift
> -a
--
"My grandfather once told me that there are two kinds of people: those
who work and those who take the credit. He told me to try to be in the
first group; there was less competition there."
- Indira Gandhi
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: [GENERAL] pam-linux, /etc/shadow : HOW-TO
@ 2003-08-16 23:55 Bruce Momjian <[email protected]>
parent: ahoward <[email protected]>
1 sibling, 0 replies; 5+ messages in thread
From: Bruce Momjian @ 2003-08-16 23:55 UTC (permalink / raw)
To: ahoward <[email protected]>; +Cc: pgsql-docs
Would someone merge this into our CVS docs and submit a patch?
---------------------------------------------------------------------------
ahoward wrote:
>
> note: i'm no sysad, nor do i even pretend to understand pam, the linux kernel,
> or postgresql, but this setup is a safe, working, postgresql/linux/pam setup.
>
> 0) configure postgresql for pam, for example
>
> [root@omega tmp]# grep pam /usr/local/pgsql/data/pg_hba.conf
> host all all 137.75.0.0 255.255.0.0 pam
>
> 1) create a /etc/pam.d/postgresql entry, here's how i did mine
>
> [root@omega tmp]# cp /etc/pam.d/passwd /etc/pam.d/postgresql
>
> i don't know if it's the best setup, but it works! mine looks like this
>
> [root@omega tmp]# cat /etc/pam.d/postgresql
> #%PAM-1.0
> auth required /lib/security/pam_stack.so service=system-auth
> account required /lib/security/pam_stack.so service=system-auth
> password required /lib/security/pam_stack.so service=system-auth
>
> 2) create a shadow group which will be used for user's needing read-access to
> /etc/shadow, and add postgres (or whatever user the postmaster runs as) to
> this entry. i used vi to add this entry to /etc/group
>
> [root@omega tmp]# grep shadow /etc/group
> shadow:*:4002:root,postgres
>
> root probably does not *need* to be added.
>
> note the '*' v.s. an 'x' in the password field. if you place an 'x' there
> you will also have to set up /etc/gshadow - i did not want to do this. if
> you don't set up /etc/gshadow pam will NOT work if an 'x' is in the password
> field - at least with my linux system.
>
> 3) make /etc/shadow group shadow
>
> [root@omega tmp]# chgrp shadow /etc/shadow
>
> 4) chmod 0440 /etc/shadow
>
>
> essentially, pam will not work with postgres since the daemon needs at some
> point, no matter how many library calls deep, to open and read /etc/shadow
> (assuming this is how your system is using pam). you must have some solution
> which allows postgres, but not everyone, to read /etc/shadow. others probably
> exist.
>
> -a
>
> --
> ====================================
> | Ara Howard
> | NOAA Forecast Systems Laboratory
> | Information and Technology Services
> | Data Systems Group
> | R/FST 325 Broadway
> | Boulder, CO 80305-3328
> | Email: [email protected]
> | Phone: 303-497-7238
> | Fax: 303-497-7259
> ====================================
>
> ---------------------------(end of broadcast)---------------------------
> TIP 4: Don't 'kill -9' the postmaster
>
--
Bruce Momjian | http://candle.pha.pa.us
[email protected] | (610) 359-1001
+ If your life is a hard drive, | 13 Roberts Road
+ Christ can be your backup. | Newtown Square, Pennsylvania 19073
^ permalink raw reply [nested|flat] 5+ messages in thread
end of thread, other threads:[~2003-08-16 23:55 UTC | newest]
Thread overview: 5+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2003-05-20 19:13 pam-linux, /etc/shadow : HOW-TO ahoward <[email protected]>
2003-05-21 06:36 ` Shridhar Daithankar <[email protected]>
2003-05-21 16:22 ` ahoward <[email protected]>
2003-05-22 01:18 ` Justin Clift <[email protected]>
2003-08-16 23:55 ` Bruce Momjian <[email protected]>
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox