maddy

Fork https://github.com/foxcpp/maddy

git clone git://git.lin.moe/go/maddy.git

 1# Using PAM authentication
 2
 3maddy supports user authentication using PAM infrastructure via `auth.pam`
 4module.
 5
 6In order to use it, however, either maddy itself should be compiled
 7with libpam support or a helper executable should be built and
 8installed into an appropriate directory.
 9
10It is recommended to use builtin libpam support if you are using
11PAM as an intermediate for authentication provider not directly
12supported by maddy.
13
14If PAM authentication requires privileged access on the host system
15(e.g. pam_unix.so aka /etc/shadow) then it is recommended to use
16a privileged helper executable since maddy process itself won't
17have access to it.
18
19## Built-in PAM support
20
21Binary artifacts provided for releases do not come with
22libpam support. You should build maddy from source.
23
24See [here](../building-from-source) for detailed instructions.
25
26You should have libpam development files installed (`libpam-dev`
27package on Ubuntu/Debian).
28
29Then add `--tags 'libpam'` to the build command:
30```
31./build.sh --tags 'libpam'
32```
33
34Then you should be able to replace `local_authdb` implementation
35in default configuration with `auth.pam`:
36```
37auth.pam local_authdb {
38    use_helper no
39}
40```
41
42## Helper executable
43
44TL;DR
45```
46git clone https://github.com/foxcpp/maddy
47cd maddy/cmd/maddy-pam-helper
48gcc pam.c main.c -lpam -o maddy-pam-helper
49```
50
51Copy the resulting executable into /usr/lib/maddy/ and make
52it setuid-root so it can read /etc/shadow (if that's necessary):
53```
54chown root:maddy /usr/lib/maddy/maddy-pam-helper
55chmod u+xs,g+x,o-x /usr/lib/maddy/maddy-pam-helper
56```
57
58Then you should be able to replace `local_authdb` implementation
59in default configuration with `auth.pam`:
60```
61auth.pam local_authdb {
62    use_helper yes
63}
64```
65
66## Account names
67
68Since PAM does not use emails for authentication you should configure
69maddy to either strip domain part when checking credentials or do not
70use email when authenticating.
71
72See [Multiple domains configuration](/multiple-domains) for how to configure
73authentication.
74
75## PAM service
76
77You should create a PAM configuration file for maddy to use.
78Place it into /etc/pam.d/maddy.
79Here is the minimal example using pam_unix (shadow database).
80```
81#%PAM-1.0
82auth	required	pam_unix.so
83account	required	pam_unix.so
84```
85
86Here is the configuration example you could use on Ubuntu
87to use the authentication config system itself uses:
88```
89#%PAM-1.0
90
91@include common-auth
92@include common-account
93@include common-session
94```