Easiest way to authenticate users in Linux/Unix w/o root permissions

Question

Hi All,

I'm writing a cross-platform TCP/IP server and I need to authenticate users before servicing them. Requirements stipulate that I use "native" authentication of the platform and not create my own authentication mechanism.

For Linux/Unix OS family I use getpwnam to authenticate users and the most reliable way I know to make sure this works is to start my service as root. There're no other reasons for the service to run as root and I wonder what my options are? Can I call getpwnam while not being root w/o compromising security? Or, if there're alternatives to getpwnam, how portable are they and how "administrator-friendly" in a sense of "what configuration effort they require? The reason why independent authentication mechanism is off the table is exactly that it creates "too much a configuration effort".

Answer 1

Using getpwnam() does not require root privileges.

Trying to get information from the shadow password file, or AFAIK using PAM, does require root privileges, and that presents some problems. However, you might be able to start your process as root, initialize access to PAM, and then drop privileges. That is unconfirmed speculation, but is at least somewhat plausible.

Note that in most systems, getpwnam() does not return you an encrypted (or hashed) password. So, you need to consider carefully what you are planning to do to 'authenticate' the user.

Answer 2

Have you taken a look at PAM authentication?

Answer 3

Use SASL, for example Cyrus SASL. No root privileges required and all popular Linux distributions support it. I'm using it to authenticate users of intranet site served by Apache and written in Python. Among others Sendmail and Postfix use it for authentication.