4 ms·

Ironically, these already exist for OpenSSH and have been developed for Linux and UNIX for decades. It's funny how people keep reinventing things. You can use t

Ironically, these already exist for OpenSSH and have been developed for Linux and UNIX for decades. It's funny how people keep reinventing things. You can use them in your /etc/ssh/sshd_config with "UsePam yes", but, to your point!, generally the built-in auth is a better option for a smaller surface area, unless you specifically know you need PAM. They are literally called Pluggable Authentication Modules (PAM) and it's a core part of any Linux distribution. (I'm not aware of any modern UNIX or Linux that do not offer PAM, but perhaps some embedded distros.) They can be configured for many types of server software, not just OpenSSH. (For example, mail servers like Dovecot and Postfix support PAM, database servers like Postgresql and MySQL, etc.) https://tldp.org/HOWTO/User-Authentication-HOWTO/x115.html https://tldp.org/HOWTO/User-Authentication-HOWTO/x115.html

francislavoie 5y ago
> It's funny how people keep reinventing things. That's not exactly fair. The entire point of this exercise is to move away from C code, by implementing it in a memory safe language (Go). Since PAM uses shared-libraries to operate, that's fundamentally incompatible here since Go is statically compiled (unless you use some CGO like in https://github.com/msteinert/pam https://github.com/msteinert/pam) so implementing auth via Caddy's module system is the way to go for this project.
- candiddevmike 5y ago
  Memory safety won't save you from logic bugs, which is extremely prevalent in authentication exploits.
  - francislavoie 5y ago
    No arguments there, but it's still much safer to start with a memory-safe language as a base.
  - viraptor 5y ago
    While it's true, most languages we move to today as memory-safe system languages do help with logic bugs. Full struct initialising, actually typed and checked enums, pattern matching, ADTs, etc. make logic bugs less likely.
- deleted 5y ago
  [deleted]
- gunapologist99 5y ago
  > That's not exactly fair. The entire point of this exercise is to move away from C code, by implementing it in a memory safe language (Go). Ok, I'll go along with that, but being memory safe is no panacea either. > Go is statically compiled As soon as you use os or net, you're almost certainly dynamically compiled unless you take deliberate steps not to be. (You can check your final binary with ldd to see if it's dynamic or not.) Here's a few things you should do to be sure you're compiling statically: CGO_ENABLED=0 go build -tags osusergo,netgo Also, you can't use the race detector or explicitly C libraries like SQLite. And, be careful -- if you use CGO and try to compile statically, then you might end up including glibc.
GordonS 5y ago
I'm aware of PAM, though I always assumed there was a relatively high barrier to entry, and C would be required?
mholt 5y ago
What is involved in using PAM on Windows and Mac?
- bogantech 5y ago
  Nothing on a mac since MacOS already uses PAM
gnufx 5y ago
How do you do GSSAPI with PAM? (Does OpenBSD support PAM now?)
- IcePic 5y ago
  OpenBSD does not use PAM. Closest would be BSDauth.
viraptor 5y ago
PAM has limitations that start getting in the way of more interesting setups. It's also a very specific, integrated environment that's not trivial to extend beyond standard credential checks. I've written PAM modules and I'm happy we're reinventing it in different ways.

francislavoie 5y ago

> It's funny how people keep reinventing things. That's not exactly fair. The entire point of this exercise is to move away from C code, by implementing it in a memory safe language (Go). Since PAM uses shared-libraries to operate, that's fundamentally incompatible here since Go is statically compiled (unless you use some CGO like in https://github.com/msteinert/pam https://github.com/msteinert/pam) so implementing auth via Caddy's module system is the way to go for this project.

candiddevmike 5y ago
Memory safety won't save you from logic bugs, which is extremely prevalent in authentication exploits.
- francislavoie 5y ago
  No arguments there, but it's still much safer to start with a memory-safe language as a base.
- viraptor 5y ago
  While it's true, most languages we move to today as memory-safe system languages do help with logic bugs. Full struct initialising, actually typed and checked enums, pattern matching, ADTs, etc. make logic bugs less likely.
deleted 5y ago
[deleted]
gunapologist99 5y ago
> That's not exactly fair. The entire point of this exercise is to move away from C code, by implementing it in a memory safe language (Go). Ok, I'll go along with that, but being memory safe is no panacea either. > Go is statically compiled As soon as you use os or net, you're almost certainly dynamically compiled unless you take deliberate steps not to be. (You can check your final binary with ldd to see if it's dynamic or not.) Here's a few things you should do to be sure you're compiling statically: CGO_ENABLED=0 go build -tags osusergo,netgo Also, you can't use the race detector or explicitly C libraries like SQLite. And, be careful -- if you use CGO and try to compile statically, then you might end up including glibc.

GordonS 5y ago

I'm aware of PAM, though I always assumed there was a relatively high barrier to entry, and C would be required?

mholt 5y ago

What is involved in using PAM on Windows and Mac?

bogantech 5y ago
Nothing on a mac since MacOS already uses PAM

gnufx 5y ago

How do you do GSSAPI with PAM? (Does OpenBSD support PAM now?)

IcePic 5y ago
OpenBSD does not use PAM. Closest would be BSDauth.

viraptor 5y ago

PAM has limitations that start getting in the way of more interesting setups. It's also a very specific, integrated environment that's not trivial to extend beyond standard credential checks. I've written PAM modules and I'm happy we're reinventing it in different ways.