Apache's "httpd -DSSL" start PAM'able ?

[Ralph Grothe]

Hello,

we have a silly configured webserver that is run as an MC/SG package.

The reason for the daft configuration derives from a trust split between customer (who is responsible for web content) and us (who provide the host, infrastructure and systemadministration).
That means we know the root password whereas they know the mantra for the SSL certificate.

This results in a virtually unfit MC/SG application because the package can't be started automatically, for httpd prompts the user to enter his mantra for the SSL certificate.

I suggested the customer to relinquish a mantra altogether when producing the certificate (similar to the empty -N "" option of ssh-keygen when users want to distribute their RSA public keys to ssh servers they wish to login without providing a password).
I told them that otherwise the webserver package couldn't be switched automatically to the failback node.

An empty mantra as well as storing the mantra somewhere on the webserver of course isn't an option for them.

I wonder if the Pluggable Authentication Modules (PAM) - maybe in conjunction with the Secure Remote Password (SRP) protocol - could be the solution to this catch22?

At home on my Linux box I got a little acquainted with the various configuration possibilities of the PAM, but haven't found out yet whether Apache together with openssl is PAM'able.

Is anyone of you conciously using PAM on HP-UX, maybe even with custom authentication schemes for applications that require special treatment in this respect?

How would PAM impact a "HP-trused system" (which we converted this box's passwd to)?

Can you provide me with links, FAQs, Howtos, WhitePapers etc. for PAM on HP-UX?
(seems to be standard on HP-UX meanwhile because I discovered an /etc/pam.conf without being aware of this so far)

[Oleg Zieaev_1]

Hello.
I had similar problem with automated apache startup with startssl parameter. Solution provided by Apache.org is to complile RSA certificate without password
# cp -p server.key server.key.orig
# openssl rsa -in server.key.orig -out server.key
and protect it on the OS level i.e. mode 400 owned by bin:bin.
Once this was done, automated startup works.

Hope this helps,
0leg