Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-14838

PAM authentication requires mysql user to be in the shadow group

Details

    Description

      I need to add mysql user to the shadow group in order to get PAM authentication to work.

      I tried with 10.1.30 (that comes with the Debian release I installed).

      I also installed 10.2.11 from the MariaDB repository without luck. I still need to add mysql to the shadow group to get PAM authentication to work.

      Is there a safer way to proceed ?

      Many thanks.

      Marc

      Attachments

        Issue Links

          is part of

          Task - A task that needs to be done. MDEV-7032 new pam plugin with a suid wrapper

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Activity

            Ascending order - Click to sort in descending order
            elenst Elena Stepanova added a comment -

            Here is a note from PAM plugin documentation:

            Note: if you configure PAM to use pam_unix.so (as in the above example) and notice that MariaDB needs to run as a root user to be able to access /etc/shadow — try to upgrade your PAM installation. Newer versions of PAM do not require pam_unix.so to be run as root.

            It doesn't talk about MariaDB server / plugin versions, but about the version of PAM itself. Did you try to upgrade it?

            elenst Elena Stepanova added a comment - Here is a note from PAM plugin documentation : Note: if you configure PAM to use pam_unix.so (as in the above example) and notice that MariaDB needs to run as a root user to be able to access /etc/shadow — try to upgrade your PAM installation. Newer versions of PAM do not require pam_unix.so to be run as root. It doesn't talk about MariaDB server / plugin versions, but about the version of PAM itself. Did you try to upgrade it?
            ballatom Marc BALLAT added a comment - - edited

            Hi Elena,

            I downloaded the source code for PAM 1.3.0, did configure, make and make install but I still get :
            /lib/x86_64-linux-gnu/libpam.so.0 -> libpam.so.0.83.1
            I need to try harder

            ballatom Marc BALLAT added a comment - - edited Hi Elena, I downloaded the source code for PAM 1.3.0, did configure, make and make install but I still get : /lib/x86_64-linux-gnu/libpam.so.0 -> libpam.so.0.83.1 I need to try harder
            ballatom Marc BALLAT added a comment -

            I found a more detailed guide explaining how to compile PAM here.

            I am confused about the PAM version number as downloaded from www.linux-pam.org and the version of the library (libpam.so.0.83.1). Would you have more information on the version number of libpam that is considered recent enough to be able to use PAM without addind mysql to shadow ?

            Thanks in advance.

            Marc

            ballatom Marc BALLAT added a comment - I found a more detailed guide explaining how to compile PAM here . I am confused about the PAM version number as downloaded from www.linux-pam.org and the version of the library (libpam.so.0.83.1). Would you have more information on the version number of libpam that is considered recent enough to be able to use PAM without addind mysql to shadow ? Thanks in advance. Marc
            serg Sergei Golubchik added a comment -

            There are two issues here. In old PAM versions, one needed to be root to read the password from /etc/shadow.
            This was fixed when PAM introduced /sbin/unix_chkpwd wrapper, it's suid and pam_unix.so invokes it, instead of reading /etc/shadow directly.

            Still unix_chkpwd verifies that you're root or you're checking the password for yourself (that is for $UID), it does not allow arbitrary password checks (to prevent password brute forcing, presumably).

            And MariaDB is still subject to this limitation. MDEV-7032 could be one possible solution.

            serg Sergei Golubchik added a comment - There are two issues here. In old PAM versions, one needed to be root to read the password from /etc/shadow . This was fixed when PAM introduced /sbin/unix_chkpwd wrapper, it's suid and pam_unix.so invokes it, instead of reading /etc/shadow directly. Still unix_chkpwd verifies that you're root or you're checking the password for yourself (that is for $UID ), it does not allow arbitrary password checks (to prevent password brute forcing, presumably). And MariaDB is still subject to this limitation. MDEV-7032 could be one possible solution.
            elenst Elena Stepanova added a comment -

            According to the comment above, it should be tracked further in the scope of MDEV-7032.

            elenst Elena Stepanova added a comment - According to the comment above, it should be tracked further in the scope of MDEV-7032 .

            People

              Unassigned Unassigned
              ballatom Marc BALLAT
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.