Currently I'm building an authentication system using Linux PAM for a python daemon process. It will need to authenticate remote users from a variety of front-ends against the local user list. (Amongst other options but those I do not have trouble with) It will be used as a centralised management and configuration system.
However because it is slightly insane from a security point of view to run the daemon as root I have been looking at alternatives.
The options I came across were:
- Creating a group with read access to the
/etc/shadow
file and adding the daemon user to the group. (Additional downside, will need write access too if it needs to update user credentials. Which may come back to the initial root issue.) - Invoking a shell from the daemon and use
su
to temporarily switch to root/given user before authenticating. (One example included doingsu [username]
which would mean you are authenticated if the call succeeds.) - Creating a separate process that does only authentication under root and is communicated with through UNIX domain sockets. (This currently has my preference as the other two feel more like hacky workarounds.)
I have the nagging feeling I am missing an obvious solution but I have no idea what that would be. If this is not the case which one would be preferable from a security standpoint. What I found had was split between the various options without much insight into the trade-offs or how it compares to the other options. Because of the nature of the applications it will manage security is the highest priority in regards to any solutions.