Simpler Navigation for Servers and Operating Systems - Please Update Your Bookmarks
Completed: a much simpler Servers and Operating Systems section of the Community. We combined many of the older boards, so you won't have to click through so many levels to get at the information you need. Check the consolidated boards here as many sub-forums are now single boards.
If you have bookmarked forums or discussion boards in Servers and Operating Systems, we suggest you check and update them as needed.
Showing results for 
Search instead for 
Did you mean: 

Apache's "httpd -DSSL" start PAM'able ?

Ralph Grothe
Honored Contributor

Apache's "httpd -DSSL" start PAM'able ?


we have a silly configured webserver that is run as an MC/SG package.

The reason for the daft configuration derives from a trust split between customer (who is responsible for web content) and us (who provide the host, infrastructure and systemadministration).
That means we know the root password whereas they know the mantra for the SSL certificate.

This results in a virtually unfit MC/SG application because the package can't be started automatically, for httpd prompts the user to enter his mantra for the SSL certificate.

I suggested the customer to relinquish a mantra altogether when producing the certificate (similar to the empty -N "" option of ssh-keygen when users want to distribute their RSA public keys to ssh servers they wish to login without providing a password).
I told them that otherwise the webserver package couldn't be switched automatically to the failback node.

An empty mantra as well as storing the mantra somewhere on the webserver of course isn't an option for them.

I wonder if the Pluggable Authentication Modules (PAM) - maybe in conjunction with the Secure Remote Password (SRP) protocol - could be the solution to this catch22?

At home on my Linux box I got a little acquainted with the various configuration possibilities of the PAM, but haven't found out yet whether Apache together with openssl is PAM'able.

Is anyone of you conciously using PAM on HP-UX, maybe even with custom authentication schemes for applications that require special treatment in this respect?

How would PAM impact a "HP-trused system" (which we converted this box's passwd to)?

Can you provide me with links, FAQs, Howtos, WhitePapers etc. for PAM on HP-UX?
(seems to be standard on HP-UX meanwhile because I discovered an /etc/pam.conf without being aware of this so far)
Madness, thy name is system administration
Oleg Zieaev_1
Regular Advisor

Re: Apache's "httpd -DSSL" start PAM'able ?

I had similar problem with automated apache startup with startssl parameter. Solution provided by is to complile RSA certificate without password
# cp -p server.key server.key.orig
# openssl rsa -in server.key.orig -out server.key
and protect it on the OS level i.e. mode 400 owned by bin:bin.
Once this was done, automated startup works.

Hope this helps,
Professionals will prevail ...