Re: [cobalt-developers] RE: [cobalt-security] Significant OpenSSH Vulnerability ??

[Michael Stauber <devel@xxxxxxxxxxxxxx>]

Hi Matthew,

> You guys who are compiling Apache:
> Are you trying to get mod_auth_pam working?  If so, what have you done
> to do it?  My attempts fail, but I can't find the correct sources for
> it.

Steve Bassi and Chris Burtons use mod_auth_pam from this URL:

http://pam.sourceforge.net/mod_auth_pam/dist/mod_auth_pam.tar.gz

(See: http://camelbackup.com/raq3-apache-1.3.26.html)

I use the regular mod_auth_pam_external which I found in SUN/Cobalt's 
apache-1.3.20.srpm for the XTR.

While Steve and Chris use a manual procedure which seems to work fine on the 
RaQ3's I'm trying the RPM approach on the RaQ4, using the specfile for the 
Cobalt Apache-1.3.20 as a base.

This is how they (SUN) got the PAM working:

# Configure mod_auth_pam_external
cd ../mod_auth_pam_external-%{mod_auth_pam_external_version}
gcc -shared $RPM_BUILD_OPTS -I../apache_%{version}/src/include \
    -I ../apache_%{version}/src/os/unix -fPIC -DEAPI \
    mod_auth_pam_external.c -o mod_auth_pam_external.so -ldl -lpam
make -C authenticate

For an in-depth look at it download the SRPM and take a look at the included 
SPEC file:

ftp://ftp-eng.cobalt.com/pub/unsupported/raq4/srpms/apache-1.3.20-RaQ4_1C1experimental.src.rpm

If you don't know how to take an (S)RPM apart, then use the easy approach: 
chmod 644 *.rpm (if it was executable), start Midnight Commander, move the 
cursor over the (S)RPM and press return: Voila. The sources, patches and SPEC 
file are there and you can either examine them or copy 'em out to a place of 
your liking.

-- 

Mit freundlichen Grüßen / With best regards

Michael Stauber
mstauber@xxxxxxxxxxxxxx
Unix/Linux Support Engineer