SpliteMaster | Bonjour
Tout d'abord je recherche quelqu'un qui pourrait m'expliquer sommairement le fonctionnement de l'authentification via PAM.
Ensuite j'aimerai pouvoir installer le paquet pam-devel sur mon poste, mais je n'arrive pas à le trouver. De plus j'ai l'impression que PAM fonctionne avec PERL... faut-il installé PERL sous ma debian, quoique je pense qu'il soit déjà installé par défaut.
Tout ceci étant dans le but de faire fonctionner une authentification cliente sous OpenVPN.
Je vous fournit ci-dessous le script qui permet de gérer cette authentification :
Merci de votre aide
Code :
- #!/usr/bin/perl -t
- # OpenVPN PAM AUTHENTICATON
- # This script can be used to add PAM-based authentication
- # to OpenVPN 2.0. The OpenVPN client must provide
- # a username/password, using the --auth-user-pass directive.
- # The OpenVPN server should specify --auth-user-pass-verify
- # with this script as the argument and the 'via-file' method
- # specified. The server can also optionally specify
- # --client-cert-not-required and/or --username-as-common-name.
- # SCRIPT OPERATION
- # Return success or failure status based on whether or not a
- # given username/password authenticates using PAM.
- # Caller should write username/password as two lines in a file
- # which is passed to this script as a command line argument.
- # CAVEATS
- # * Requires Authen::PAM module, which may also
- # require the pam-devel package.
- # * May need to be run as root in order to
- # access username/password file.
- # NOTES
- # * This script is provided mostly as a demonstration of the
- # --auth-user-pass-verify script capability in OpenVPN.
- # For real world usage, see the auth-pam module in the plugin
- # folder.
- use Authen::PAM;
- use POSIX;
- # This "conversation function" will pass
- # $password to PAM when it asks for it.
- sub my_conv_func {
- my @res;
- while ( @_ ) {
- my $code = shift;
- my $msg = shift;
- my $ans = "";
- $ans = $password if $msg =~ /[Pp]assword/;
- push @res, (PAM_SUCCESS(),$ans);
- }
- push @res, PAM_SUCCESS();
- return @res;
- }
- # Identify service type to PAM
- $service = "login";
- # Get username/password from file
- if ($ARG = shift @ARGV) {
- if (!open (UPFILE, "<$ARG" )) {
- print "Could not open username/password file: $ARG\n";
- exit 1;
- }
- } else {
- print "No username/password file specified on command line\n";
- exit 1;
- }
- $username = <UPFILE>;
- $password = <UPFILE>;
- if (!$username || !$password) {
- print "Username/password not found in file: $ARG\n";
- exit 1;
- }
- chomp $username;
- chomp $password;
- close (UPFILE);
- # Initialize PAM object
- if (!ref($pamh = new Authen::PAM($service, $username, \&my_conv_func))) {
- print "Authen::PAM init failed\n";
- exit 1;
- }
- # Authenticate with PAM
- $res = $pamh->pam_authenticate;
- # Return success or failure
- if ($res == PAM_SUCCESS()) {
- exit 0;
- } else {
- print "Auth '$username' failed, PAM said: ", $pamh->pam_strerror($res), "\n";
- exit 1;
- }
|
|
