maddy

 1## maddy-pam-helper
 2
 3External setuid binary for interaction with shadow passwords database or other
 4privileged objects necessary to run PAM authentication.
 5
 6### Building
 7
 8It is really easy to build it using any GCC:
 9```
10gcc pam.c main.c -lpam -o maddy-pam-helper
11```
12
13Yes, it is not a Go binary.
14
15
16### Installation
17
18maddy-pam-helper is kinda dangerous binary and should not be allowed to be
19executed by everybody but maddy's user. At the same moment it needs to have
20access to read-protected files. For this reason installation should be done
21very carefully to make sure to not introduce any security "holes".
22
23#### First method
24
25```shell
26chown maddy: /usr/bin/maddy-pam-helper
27chmod u+x,g-x,o-x /usr/bin/maddy-pam-helper
28```
29
30Also maddy-pam-helper needs access to /etc/shadow, one of the ways to provide
31it is to set file capability CAP_DAC_READ_SEARCH:
32```
33setcap cap_dac_read_search+ep /usr/bin/maddy-pam-helper
34```
35
36#### Second method
37
38Another, less restrictive is to make it setuid-root (assuming you have both maddy user and group):
39```
40chown root:maddy /usr/bin/maddy-pam-helper
41chmod u+xs,g+x,o-x /usr/bin/maddy-pam-helper
42```
43
44#### Third method
45
46The best way actually is to create `shadow` group and grant access to
47/etc/shadow to it and then make maddy-pam-helper setgid-shadow:
48```
49groupadd shadow
50chown :shadow /etc/shadow
51chmod g+r /etc/shadow
52chown maddy:shadow /usr/bin/maddy-pam-helper
53chmod u+x,g+xs /usr/bin/maddy-pam-helper
54```
55
56Pick what works best for you.
57
58### PAM service
59
60maddy-pam-helper uses custom service instead of pretending to be su or sudo.
61Because of this you should configure PAM to accept it.
62
63Minimal example using local passwd/shadow database for authentication can be
64found in [maddy.conf][maddy.conf] file.
65It should be put into /etc/pam.d/maddy.