Mod_Authnz_External version 3.3.x

     Original Coder: Nathan Neulinger <nneul@umr.edu>
Previous Maintainer: Tyler Allison    <allison@nas.nasa.gov>
 Current Maintainer: Jan Wolter       http://www.unixpapa.com
    Apache 2.0 Port: Dave Woolaway    <dave@watersheep.org>
    		     Sven Koch        <haegar@sdinet.de>
    Apache 2.2 Port: Jan Wolter       http://www.unixpapa.com

Caution:
--------

Mod_Auth_External can be used to quickly construct secure, reliable
authentication systems.  It can also be mis-used to quickly open gaping
holes in your security.  Read the documentation, and use with extreme
caution.

Versions:
---------

Mod_authnz_external version 3.3.x is designed for use with Apache version
2.4.x.  It will not work with Apache 2.2 or 2.0.  For older versions of
Apache you will need older branches of mod_authnz_external:

     Apache 1.3   mod_auth_external-2.1.x
     Apache 2.0   mod_auth_external-2.2.x
     Apache 2.2   mod_authnz_external-3.1.x or mod_authnz_external-3.2.x
     Apache 2.4   mod_authnz_external-3.3.x

This module was developed from "mod_auth_external".  It has been restructured
to fit into the authn/authz structure introduce in Apache 2.1.  It can be used
in any application where mod_auth_external was previously used.  No changes
will be needed to the external authentication programs, but the exact Apache
configuration commands needed will be different.  It is possible to use the
old "mod_auth_external-2.2" with Apache-2.2, but mod_authnz_external is
preferable.  If you are upgrading from "mod_auth_external" to
"mod_authnz_external" then read the file "UPGRADE" for advice.

Introduction:
-------------

Mod_Authnz_External is an Apache module used for authentication.  The Apache
HTTP Daemon can be configured to require users to supply logins and passwords
before accessing pages in some directories.  Authentication is the process
of checking if the password given is correct for a user.  Apache has
standard modules for authenticating out of several different kinds of
databases.  Mod_Authnz_External is a flexible tool for creating authentication
systems based on other databases.

Mod_Authnz_External can be used in either of two somewhat divergent ways:

 External Authentication:

    When a user supplies a login and password, mod_authnz_external runs a
    program you write, passing it the login and password.  Your program
    does whatever checking and logging it needs to, and then returns a
    Accept/Reject flag to Apache.

    This is slower than doing the authentication internally because it
    has the overhead of launching an external program for each authentication.
    However, there are at least two situations where it is very useful:

      - Rapid prototyping.  The external authentication program can be
        a shell script or perl program.  It can be written without knowing
        much about building Apache modules.  Bugs in it will not endanger
        the overall integrity of the Apache server.  Later, as performance
	becomes more of an issue, you can write a custom Apache module to
	do the job more efficiently (perhaps using the HARDCODE option below).

      - Access restrictions.  There are situations where you do not want to
        make your user database readable to the user-id that Apache runs
        under.  In these cases the external authentication program can be
        an suid program that has access to databases Apache cannot access.
        For example, if you want to authentication out of a Unix shadow
        password database, and you aren't foolish enough to run Apache
        as root, a carefully written suid-root external authentication
        program can do the job for you.

    Pwauth, an external authentication program for securely authenticating
    out of a Unix shadow password database available from
    http://www.unixpapa.com/pwauth/ .

 Hardcoded Authentication:

    Some hooks have been inserted into mod_authnz_external to make it easy
    to replace the call to the external authentication program with a
    call to a hardcoded internal authentication routine that you write.

    This is sort of a half-way measure to just writing your own Apache
    module from scratch, allowing you to use some of the logic from
    mod_authnz_external.

    Example functions for authenticating out of a RADIUS server or Sybase
    database are included in this distribution.

Compatibility:
--------------

The current version of mod_authnz_external is designed for use with Apache 2.2.
It will not work with older versions of Apache.

Mod_authnz_external has been tested on a wide variety of Unix platforms.  In
theory versions after 3.2.0 should work on any non-Unix platforms supported
by Apache, but it has been tested only under Unix.

Mod_authnz_external is also compatible with authenticators using the
checkpassword interface.  See http://cr.yp.to/checkpwd.html for more
information.

Authn / Authz
-------------

Users of mod_authnz_external may find it helpful understand a bit more of
it's internal structure.  It is actually best thought of as two functionally
separate modules, mod_authn_external and mod_authz_external, which have
combined into a single module simply because they share a lot of code.
In any particular application, you may only be using one of these two
modules, or you may be using both.

The mod_authn_external part is an authentication provider for the
mod_auth_basic module.  Mod_auth_basic handles all the negotiations with
the browser, while all mod_authn_external does is check if a password
submitted by the user is correct (which it does by running an external
program to perform the check).

The mod_authz_external part does access control.  It has no relation
to mod_auth_basic.  It comes into play after authentication is complete,
when a "Require group" or "Require file-group" directive is given.  It
checks if the authenticated user is in the list of required groups (which
it does by running an external program to perform the check).

Digest Authentication
---------------------

The new authentication structure introduced in Apache 2.1 makes it much
easier for modules like this one to support digest authentication as an
alternative to basic authentication.  Mod_Authnz_External, however, does
not yet support digest authentication.

I hope to support this in the future, but it really isn't a very attractive
alternative and I don't expect many people will want to use it.  It will
not be possible to use the same external authentication programs that are
used for basic authentication - they would have to be rewritten.  It will
only work if the database being accessed by the external program either has
passwords in plaintext, or has them encrypted in a very specific way.  This
means it could not be used for unix password database authentication or with
most other password databases not specifically designed for this application.
And password databases specifically designed for this application might as
well be designed in a format where they could be accessed by mod_authn_file
or mod_authn_dbm.

Security Considerations:
------------------------

By default, mod_authnz_external passes the user's login and password to the
external authentication program by sending them through a pipe.  This is
very secure.

In older versions of mod_auth_external, the login and password were by
default passed in environment variables called USER and PASS.  This is
still an option, but we do NOT recommend using option.

On some versions of Unix (including SunOS and IRIX) any user logged onto
the server can see these values by doing a "ps -e" command.  This would
obviously be a problem if there are ever untrusted users on your server.
Other versions of Unix (including Linux) restrict "ps -e" so you can only
see your own processes, but this may still be a problem if untrusted people
can put CGI programs on your server, since those may run as the same user
as your authentication program does.  Some versions of Unix don't seem to
have a "ps -e" command at all, but even then it is best to be careful. 
Although the default "ps" command on Solaris won't display environment
variables, the backwards compatible "/usr/ucb/ps" command does.  Are you
sure there isn't and won't be an old-style ps command installed on your
system? 

Use of this module requires development of an external authentication program
or a hardcoded internal function.  These are typically very simple programs,
but there are more ways to screw up your security by doing them badly than
we could possibly list.  See the file AUTHENTICATORS for more information
on implementing authenticators.

Example Authentication Routines in this Distribution:
-----------------------------------------------------

 test/
    Several small dummy external authentication programs written in Perl
    (there is also a PHP version of one of them). These are meant only for
    testing of mod_authnz_external.  They accept any user whose password
    and login name are identical.  They write lots of debugging info to
    the error_log file.

    Author and Maintainer:  Jan Wolter http://unixpapa.com/
    Author of PHP Version:  Claus Andersen

Example Authentication Routines Formerly Included in this Distribution:
-----------------------------------------------------------------------
In the interest of cleaning up the distribution, several other examples
that were formerly distributed with this module are now only available
separately.

 pwauth
    A C program for authenticating out of unix shadow password files or
    PAM.

    Author and Maintainer:  Jan Wolter http://unixpapa.com/
    Available from: http://code.google.com/p/pwauth/

 MYSQL-auth
    A Perl program for authenticating out of a MySQL database.  This is
    written in Perl using the DBI interface, so it could be trivially adapted
    to work with any other SQL database server that has a DBI interface
    (that is to say all of them).

    Author and Maintainer:  Anders Nordby <anders@fix.no>
    Available From: http://anders.fix.no/software/#unix

 sybase-internal-auth
    An example of a hardcoded internal authentication function for use with
    mod_auth_external or mod_authnz_external. It's designed for doing
    authentication out of a sybase database, which these days would be better
    done using mod_authn_dbd.

    Author: <br@ota.fr.socgen.com>
    Available From: http://code.google.com/p/mod-auth-external/downloads

 mae-radius
    Another example or a hardcoded internal authentication function.
    This does radius authentication. It may not be fully open source.

    Available From: http://unixpapa.com/software/mae_radius.tar.gz

Checkpassword Authenticators
----------------------------

There are various "checkpassword" compatible authenticators available on the
net which can be used with mod_authnz_external.  These authenticators are most
commonly used with qmail pop servers but it is sometimes useful to be able
to use the same authentication system for some web pages.  I've listed some
of the ones that look useful for mod_authnz_external, but I've tested only
'checkpassword'.

   checkpassword
	http://cr.yp.to/checkpwd.html
	Dan J. Bernstein <djb@cr.yp.to>

	Authentication from a Unix shadow password file, similar to the
	the pwauth program.

   radcheckpassword
	http://www.tic.ch/e-image/andrew/software/radcheckpassword/
	Andrew Richards <andrew@tic.ch>

	Radius authentication.