Apache2 mod_userdir and mod_authnz_external, how to limit access to own home

Question

Apache2 setup with mod_userdir and mod_authnz_external and pwauth, so that each user can access their home and can be authenticated by their local UNIX credentials.

Now I need some kind of authorization so that each user can, after being authenticated, only access their own home directory, but not those of other users.

The caveat: in my setup, a user is not necessarily the owner of their home directory, so mod_authz_owner won't work here.

Another problem: %{REMOTE_USER} variable set by Apache is not usable inside <If > directives (or other directives that might help here), because the authentication is done late during request processing.

How can I achieve my goal with Apache2? Is there e.g. the possibility to extract the user home directory name from %{REQUEST_URI} and pass it to a Require user ... directive? I have not been able to find out how to do this, so any help would be appreciated.

Answer 1

You'd need to write your own authenticator script. You should be able to do it pretty easily without writing much code.

Apache passes the URI being requested to the authenticator script via an environment variable, so you'd need to call pwauth from your script to validate the username/password combination, and then compare the given username to the URI to make sure the username whose password you just validated is in the URI being requested.

Here's the documentation, which was very helpful when I wrote an authenticator for myself. https://github.com/phokz/mod-auth-external/blob/master/mod_authnz_external/AUTHENTICATORS

Working authenticator implementation in PHP:

#!/usr/bin/php <?php // Get the user name $user = trim(fgets(STDIN)); // Get the password $pass = trim(fgets(STDIN)); // Call pwauth to validate user and password combination $handle = popen('/usr/sbin/pwauth', 'w'); fwrite($handle, $user."\n".$pass."\n"); if (pclose($handle) === 0) { // Password is valid for user // Check if the URI belongs to the user $uri = getenv('URI'); if (preg_match('#^/~'.$user.'/#', $uri) || preg_match('#^/~'.$user.'$#', $uri)) { exit(0); // User matches requested URI } else exit(1); // User does not match requested URI } exit(1); // Password is not valid for user