pamUbuntuubuntu-12.04
Is there a way to run pam-auth-update (or some equivalent command), non-interactively on Ubuntu 12.04. I'm trying to automate this process for a number of machines, and the curses interface is making it tedious (and prone to errors).
I'm interested particularly in the case where everything available needs to be activated, but more flexibility in selecting options would be great as well.
I was looking for the answer to this myself, and eventually wound up having to solve it myself. Since I'd found this question earlier in my searches, I figured I'd provide what worked for me :)
Download the pam_auth source from http://svn.php.net/viewvc/pecl/pam/trunk/ (or for convenience I have zipped the latest files, current as of revision 324283, here)
Change into the directory you've downloaded/unzipped/etc the files into, and run the following commands:
Add extension=pam.so to your php.ini
Restart Apache; use phpinfo() to ensure the PAM module is running.
When verifying via phpinfo(), there should be a section like so:
I successfully installed pam_auth on CentOS 5.6/Apache 2.2.3/PHP 5.3.10 using the above instructions; hopefully it will work just as well on CentOS 6. Good luck!
It seemed that all that needed to be done was run pppd with the login parameter. That can be set in /etc/ppp/options. even though it said that it is only supposed to be used with PAP.
I suppose it works because we're not trying to authenticate with PAP and CHAP, authentication goes through the chap_secret files after which it is passed to PAM.
When PAM takes control, we can set it to always pass authentication and use the authorization as for what is needed.
Here is how my PAM file (on the server /etc/pam.d/ppp) looks like:
auth sufficient pam_permit.so
account sufficient pam_permit.so
For now, i haven't set anything concrete for the account. What i plan is to run a module which writes the information into database.
Looking at the /var/log/syslog:
Jul 24 11:32:02 virtual3 pptpd[6100]: GRE: Bad checksum from pppd.
Jul 24 11:32:02 virtual3 pppd[6101]: rcvd [LCP ConfAck id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0xbfa95b1b> <pcomp> <accomp>]
Jul 24 11:32:02 virtual3 pppd[6101]: sent [LCP EchoReq id=0x0 magic=0xbfa95b1b]
Jul 24 11:32:02 virtual3 pppd[6101]: sent [CHAP Challenge id=0x72 <bd6de330bce960fd3c015f4c05271084>, name = "virtual_3"]
Jul 24 11:32:02 virtual3 pppd[6101]: rcvd [LCP EchoReq id=0x0 magic=0x26f8d72a]
Jul 24 11:32:02 virtual3 pppd[6101]: sent [LCP EchoRep id=0x0 magic=0xbfa95b1b]
Jul 24 11:32:02 virtual3 pppd[6101]: rcvd [LCP EchoRep id=0x0 magic=0x26f8d72a]
Jul 24 11:32:02 virtual3 pppd[6101]: rcvd [CHAP Response id=0x72 <37493f89d9ab654ebd597c25a4a6b0c000000000000000007452936c00f1efa80034f8a65f1f33a7c5b0cf8b4ca6b3f600>, name = "virtual_2"]
Jul 24 11:32:02 virtual3 pppd[6101]: sent [CHAP Success id=0x72 "S=8BA14BF6728FFEF9BAC466B0B7ACD5B6273E8B38 M=Access granted"]
Jul 24 11:32:02 virtual3 pppd[6101]: Initializing PAM (2) for user virtual_2
Jul 24 11:32:02 virtual3 pppd[6101]: ---> PAM INIT Result = 0
Jul 24 11:32:02 virtual3 pppd[6101]: Attempting PAM account checks
Jul 24 11:32:02 virtual3 pppd[6101]: PAM Account OK for virtual_2
Jul 24 11:32:02 virtual3 pppd[6101]: PAM Session opened for user virtual_2
Jul 24 11:32:02 virtual3 pppd[6101]: user virtual_2 logged in on tty pts/3 intf ppp0
Jul 24 11:32:02 virtual3 pppd[6101]: MPPE 128-bit stateless compression enabled
Jul 24 11:32:02 virtual3 pppd[6101]: Cannot determine ethernet address for proxy ARP
Jul 24 11:32:02 virtual3 pppd[6101]: local IP address 10.8.10.1
Jul 24 11:32:02 virtual3 pppd[6101]: remote IP address 10.8.10.2
Jul 24 11:32:02 virtual3 pppd[6101]: pptpd-logwtmp.so ip-up ppp0 virtual_2 192.168.11.100
it can bee seen that the authentication went through CHAP and is then passed to PAM.
Best Answer
You can change the environment variable
$DEBIAN_FRONTENDto achieve this:But be careful, you need to work with debconf to do useful stuff and this can be quite difficult. See for example this bug on launchpad (especially comment #3).