From owner-freebsd-security@FreeBSD.ORG Wed Dec 10 11:30:15 2003 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id C74A416A5E7 for ; Wed, 10 Dec 2003 11:30:15 -0800 (PST) Received: from storm.FreeBSD.org.uk (storm.FreeBSD.org.uk [194.242.157.42]) by mx1.FreeBSD.org (Postfix) with ESMTP id AD01043D1D for ; Wed, 10 Dec 2003 11:30:11 -0800 (PST) (envelope-from mark@grondar.org) Received: from storm.FreeBSD.org.uk (Ugrondar@localhost [127.0.0.1]) hBAJUAnp042682; Wed, 10 Dec 2003 19:30:10 GMT (envelope-from mark@grondar.org) Received: (from Ugrondar@localhost)hBAJU9te042681; Wed, 10 Dec 2003 19:30:09 GMT (envelope-from mark@grondar.org) X-Authentication-Warning: storm.FreeBSD.org.uk: Ugrondar set sender to mark@grondar.org using -f Received: from grondar.org (localhost [127.0.0.1])hBAJPADw003666; Wed, 10 Dec 2003 19:25:11 GMT (envelope-from mark@grondar.org) Message-Id: <200312101925.hBAJPADw003666@grimreaper.grondar.org> To: Brett Glass From: Mark Murray In-Reply-To: Your message of "Wed, 10 Dec 2003 12:05:39 MST." <6.0.0.22.2.20031210115335.04c2fc50@localhost> Date: Wed, 10 Dec 2003 19:25:10 +0000 Sender: mark@grondar.org X-Spam-Status: No, hits=-0.5 required=5.0 tests=EMAIL_ATTRIBUTION,IN_REP_TO,NO_EXPERIENCE, QUOTED_EMAIL_TEXT,REPLY_WITH_QUOTES version=2.55 X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp) cc: security@freebsd.org Subject: Re: s/key authentication for Apache on FreeBSD? X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Dec 2003 19:30:15 -0000 Brett Glass writes: > After considering the readily available alternatives, I'd like to > try using s/key one-time passwords with "basic" authentication (which > works on most browsers). But how do I lash Apache and s/key together > under FreeBSD, and get Apache to require s/key passwords from all > IP addresses outside the owner's home network? (Apache doesn't have > a mod_auth_skey module, so I'd probably have to cobble this together > with mod_perl -- or via PAM, with which I have virtually no experience.) > All suggestions as to the most efficient way to construct a solution > will be most welcome. PAM is the most sensible. Once set up, it hands over a whole lot of policy to one set of config files, and this makes sysadmins jons much easier. Learning PAM is well worth your while. M -- Mark Murray iumop ap!sdn w,I idlaH