PAM blocking?

[ArcticLampyrid]

When I started to use PAM auth, it always got stuck.

webdav-server-rs/pam/src/pamclient.rs

Line 144 in 50318a6

match rx.await {

Workaround:
replace the following code

webdav-server-rs/pam/src/pamclient.rs

Line 261 in 50318a6

let _ = resp_chan.send(resp.result);

with

std::thread::spawn(move || {
    let _ = resp_chan.await(resp.result);
});

I'm still wondering why it works.

[ArcticLampyrid]

I seem to understand what happened.

The problem is caused by

webdav-server-rs/pam/src/pamclient.rs

Line 160 in 50318a6

let mut serversock = UnixStream::from_std(serversock)?;

According to the document:

Notes

The caller is responsible for ensuring that the stream is in non-blocking mode. Otherwise all I/O operations on the stream will block the thread, which will cause unexpected behavior. Non-blocking mode can be set using set_nonblocking.

So we must call set_nonblocking first.

@    fn start(serversock: StdUnixStream) -> io::Result<mpsc::Sender<PamRequest1>> {
+        serversock.set_nonblocking(true)?; // so we can use it in tokio.
@        let mut serversock = UnixStream::from_std(serversock)?;

[brookst]

I'm guessing I'm seeing this issue with webdav_server 0.3. I see these messages in the log output:

webdav-server[1721149]: Listening on http://0.0.0.0:4918
webdav-server[1721149]: Listening on http://[::]:4918
webdav-server[1721154]: pam_warn(other:auth): function=[pam_sm_authenticate] flags=0 service=[other] terminal=[<unknown>] user=[myuser] ruser=[<unknown>] rhost=[myremoteip]
webdav-server[1721154]: pam_warn(other:auth): function=[pam_sm_authenticate] flags=0 service=[other] terminal=[<unknown>] user=[myuser] ruser=[<unknown>] rhost=[myremoteip]

Then the request just times out. Subsequent connections also time out, but don't print anything else. However, access to locations with auth = "false" continue to work (though they seem to be in a different PID).

Is PAM working in any configuration then?

[ArcticLampyrid]

@brookst
Try adding the code as above mentioned to call set_nonblocking.

See also ArcticLampyrid@b3c426c

[brookst]

@ArcticLampyrid Yeah, I managed to get it working with that change. Thanks.

It was a real pain to build on NixOS, but I did get there in the end. I had to vendor some of the PAM C files and make a /usr/include/tirprc to make the build script aware that I have libtirpc. I made a flake file to link up the cflags and ldflags to the nix-store versions of rpcsvc-proto, tirpc and pam. I have no idea if this is the right way to do it and I don't know how to pull my flake version into my system configuration yet.

One issue I got really stuck on was the [pam] service config variable. I had it set to 'other' for some reason. I never got that to work, so I'm probably not understanding what that's supposed to mean. I used pamtester to verify that throws an authentication error before even asking for a password. Instead, using the service name 'login' does work. That succeeded on my build, but does hang on the NixPkgs version. The ArcticLampyrid@b3c426c seems to be needed then.

[brookst]

Ah, so the missing piece for PAM is setting security.pam.services.webdav = {}; in the system configuration.nix, which generates a /etc/pam.d/webdav file and allows PAM authentication with the service name webdav (or replace all for other names). The 'other' service (/etc/pam.d/other) is set to deny all with an empty warning.