Apache and mod_ntlm

[Petr Wunsch]

Hello there!

I have an Apache 2.0 webserver installed in HP-UX 11iv2 system and I need users accessing the website to authenticate against MS domain controller. I searched the web for possibilities and found references to mod_ntlm module which, unfortunately, is not included in the Apache installation. I was able to get sources from sourceforge website but I am not able to compile it.

Please give me some WORKING advice:
1) how to compile and use mod_ntlm in Apache
2) how to authenticate users on HP-UX / Apache website against MS primary domain controller

Looking forward to hear from you soon.

Best regards

Petr W.

Unsuccessfull compilation:
radegast:/tmp/ntlm/mod_ntlm2-0.1 # make install
apxs -c -o mod_ntlm.so -Wc,-shared mod_ntlm.c
/opt/hpws/apache/build/libtool --silent --mode=compile cc -prefer-pic +DD64 -D_HPUX_API_LEVEL=20040821 +Olit=const +O2 -D_USE_BIG_FDS -DWEBPROXY +z -DUSE_SSL -DCHROOT -D_USE_BIG_FDS -D_LARGEFILE_SOURCE -DFILE_OFFSET_SIZE=64 -DAUTH_LDAP_FRONTPAGE_HACK -I/home/cvspublic/crypto/hpcrypto/ia64_64/include -DSSL_EXPERIMENTAL_ENGINE -DHPUX11 -D_REENTRANT -D_XOPEN_SOURCE_EXTENDED -Ae +Z -I/include -I/opt/hpws/apache/include -I/opt/hpws/apache/include -I/opt/hpws/apache/include -I/opt/hpws/apache/ldap/include/ -shared -c -o mod_ntlm.lo mod_ntlm.c && touch mod_ntlm.slo
(Bundled) cc: warning 922: "+Olit=const" is unsupported in the bundled compiler, ignored.
(Bundled) cc: warning 922: "+O2" is unsupported in the bundled compiler, ignored.
(Bundled) cc: warning 922: "-Ae" is unsupported in the bundled compiler, ignored.
(Bundled) cc: warning 901: unknown option: `-hared': use +help for online documentation.
Warning 942: "ntlmssp.inc.c", line 136 # Types 'const char *' and 'unsigned
char *' are not assignment-compatible.
if (strncmp(msg->protocol, "NTLMSSP", 8))
^^^^^^^^^^^^^
Warning 942: "ntlmssp.inc.c", line 246 # Types 'unsigned char *' and 'char *'
are not assignment-compatible.
if (ntlm_extract_string(r, hostname, (char *) msg, msglen,
^^^
Warning 942: "ntlmssp.inc.c", line 257 # Types 'unsigned char *' and 'char *'
are not assignment-compatible.
if (ntlm_extract_string(r, domainname, (char *) msg,
^^^
Warning 942: "ntlmssp.inc.c", line 268 # Types 'unsigned char *' and 'char *'
are not assignment-compatible.
if (ntlm_extract_mem(r, lm, (char *) msg, msglen, msg->lm_off,
^^^
Warning 942: "ntlmssp.inc.c", line 279 # Types 'unsigned char *' and 'char *'
are not assignment-compatible.
if (ntlm_extract_mem(r, nt, (char *) msg, msglen, msg->nt_off,
^^^
Warning 942: "ntlmssp.inc.c", line 282 # Types 'unsigned char *' and 'char *'
are not assignment-compatible.
if (ntlm_extract_mem(r, nt, (char *) msg, msglen, msg->lm_off,
^^^
Warning 942: "ntlmssp.inc.c", line 296 # Types 'unsigned char *' and 'char *'
are not assignment-compatible.
if (ntlm_extract_unicode(r, username, (char *) msg, msglen,
^^^
Warning 942: "ntlmssp.inc.c", line 301 # Types 'unsigned char *' and 'char *'
are not assignment-compatible.
if (ntlm_extract_string(r, username, (char *) msg, msglen,
^^^
Warning 942: "ntlmssp.inc.c", line 322 # Types 'unsigned char *' and 'char *'
are not assignment-compatible.
if (ntlm_extract_unicode(r, hostname, (char *) msg, msglen,
^^^
Warning 942: "ntlmssp.inc.c", line 328 # Types 'unsigned char *' and 'char *'
are not assignment-compatible.
if (ntlm_extract_string(r, hostname, (char *) msg, msglen,
^^^
Warning 942: "ntlmssp.inc.c", line 343 # Types 'unsigned char *' and 'char *'
are not assignment-compatible.
if (ntlm_extract_unicode(r, domainname, (char *) msg, msglen,
^^^
Warning 942: "ntlmssp.inc.c", line 348 # Types 'unsigned char *' and 'char *'
are not assignment-compatible.
if (ntlm_extract_string(r, domainname, (char *) msg, msglen,
^^^
Warning 942: "ntlmssp.inc.c", line 379 # Types 'char *' and 'unsigned char *'
are not assignment-compatible.
strcpy(msg->protocol, "NTLMSSP");
^^^^^^^^^^^^^
Warning 942: "ntlmssp.inc.c", line 393 # Types 'char *' and 'unsigned char *'
are not assignment-compatible.
strcpy(msg->protocol, "NTLMSSP");
^^^^^^^^^^^^^
Warning 942: "ntlmssp.inc.c", line 399 # Types 'unsigned char *' and 'char *'
are not assignment-compatible.
ntlm_put_in_unicode((char *)msg->dom,domainname,
^^^^^^^^
Warning 942: "ntlmssp.inc.c", line 399 # Types 'unsigned char *' and 'char *'
are not assignment-compatible.
ntlm_put_in_unicode((char *)msg->dom,domainname,
^^^^^^^^^^
Warning 942: "ntlmssp.inc.c", line 410 # Types 'char *' and 'unsigned char *'
are not assignment-compatible.
strncpy(msg->dom,domainname,len);
^^^^^^^^
Warning 267: "smbval/smblib.inc.c", line 25 # Inconsistent linkage in
declarations of "int SMBlib_errno"; previously was extern now is declared
static.
static int SMBlib_errno;
^^^^^^^^^^^^
Warning 267: "smbval/smblib.inc.c", line 26 # Inconsistent linkage in
declarations of "int SMBlib_SMB_Error"; previously was extern now is
declared static.
static int SMBlib_SMB_Error;
^^^^^^^^^^^^^^^^
Warning 267: "smbval/smblib.inc.c", line 35 # Inconsistent linkage in
declarations of "SMB_State_Types SMBlib_State"; previously was extern now
is declared static.
static SMB_State_Types SMBlib_State;
^^^^^^^^^^^^
Warning 942: "mod_ntlm.c", line 206 # Types 'const char *' and 'unsigned char
*' are not assignment-compatible.
len = apr_base64_encode(encoded, string, len);
^^^^^^
Warning 942: "mod_ntlm.c", line 395 # Types 'unsigned char *' and 'char *' are
not assignment-compatible.
line = apr_pstrdup(r->pool, NTLM_AUTH_NAME);
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Warning 942: "mod_ntlm.c", line 399 # Types 'const char *' and 'unsigned char
*' are not assignment-compatible.
line);
^^^^
Warning 942: "mod_ntlm.c", line 401 # Types 'unsigned char *' and 'char *' are
not assignment-compatible.
line = apr_pstrcat(r->pool,
^^^^^^^^^^^^^^^^^^^^^^^^^^^
Warning 942: "mod_ntlm.c", line 406 # Types 'const char *' and 'unsigned char
*' are not assignment-compatible.
line);
^^^^
Warning 942: "mod_ntlm.c", line 491 # Types 'unsigned char *' and 'char *' are
not assignment-compatible.
ntlm_encode_msg2(ntlm_connection->nonce, &msg);
^^^^^^^^^^^^^^^^^^^^^^
Warning 942: "mod_ntlm.c", line 492 # Types 'unsigned char *' and 'char *' are
not assignment-compatible.
challenge = uuencode_binary(r->pool, (unsigned char *) &msg, si
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Warning 942: "mod_ntlm.c", line 495 # Types 'unsigned char *' and 'char *' are
not assignment-compatible.
l=ntlm_encode_msg2_win9x(ntlm_connection->nonce, &msg_win9x,
^^^^^^^^^^^^^^^^^^^^^^
Warning 942: "mod_ntlm.c", line 497 # Types 'unsigned char *' and 'char *' are
not assignment-compatible.
challenge = uuencode_binary(r->pool, (unsigned char *)&msg_win9
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Warning 942: "mod_ntlm.c", line 518 # Types 'const char *' and 'unsigned char
*' are not assignment-compatible.
if ((!strcmp(ntlm_connection->user, ntlmssp->user))
^^^^^^^^^^^^^
Warning 942: "mod_ntlm.c", line 519 # Types 'const char *' and 'unsigned char
*' are not assignment-compatible.
&& (!strcmp(ntlm_connection->domain, ntlmssp->domain))
^^^^^^^^^^^^^^^
Warning 942: "mod_ntlm.c", line 537 # Types 'const char *' and 'unsigned char
*' are not assignment-compatible.
ntlm_connection->user = apr_pstrdup(r->connection->pool, ntlmssp->user);
^^^^^^^^^^^^^
Warning 942: "mod_ntlm.c", line 539 # Types 'const char *' and 'unsigned char
*' are not assignment-compatible.
? apr_pstrdup(r->connection->pool, ntlmssp->domain)
^^^^^^^^^^^^^^^
Warning 942: "mod_ntlm.c", line 703 # Types 'const char *' and 'unsigned char
*' are not assignment-compatible.
if ((strcmp(ntlmssp->host,"")==0) && (strcmp(ntlmssp->domain,"")==
^^^^^^^^^^^^^
Warning 942: "mod_ntlm.c", line 703 # Types 'const char *' and 'unsigned char
*' are not assignment-compatible.
if ((strcmp(ntlmssp->host,"")==0) && (strcmp(ntlmssp->domain,"")==
^^^^^^^^^^^^^^^
Warning 863: "mod_ntlm.c", line 784 # Result of operator << is widened from
int to long.
if (!(reqs[x].method_mask & (1 << m)))
^^^^^^
/opt/hpws/apache/build/libtool --silent --mode=link cc +DD64 -Wl,-b -o mod_ntlm.la -rpath /opt/hpws/apache/modules -module -avoid-version mod_ntlm.lo
creating reloadable object files...
creating a temporary reloadable object file: .libs/mod_ntlm.la-1.o
using piecewise archive linking...
apxs -i -a -n 'ntlm' mod_ntlm.so
/opt/hpws/apache/build/instdso.sh SH_LIBTOOL='/opt/hpws/apache/build/libtool' mod_ntlm.so /opt/hpws/apache/modules
/opt/hpws/apache/build/libtool --mode=install cp mod_ntlm.so /opt/hpws/apache/modules/
cp mod_ntlm.so /opt/hpws/apache/modules/mod_ntlm.so
cp: cannot access mod_ntlm.so: No such file or directory
apxs:Error: Command failed with rc=65536
.
*** Error exit code 1

Stop.

[Mark Greene_1]

Did you use gcc or HP's C compiler? I would expect that this requires gcc.

Also, be aware that there are two, critical, unpatched security vulnarabilities in this mod:

http://packetstormsecurity.org/0304-exploits/mod_ntlm.txt


mark

[Petr Wunsch]

I am aware of the vulnerabilities but I know no other solution.

I tried to use both HP's C compiler and gcc - with the very same result.

[Arunvijai_4]

Hello,

You need to have ansi-c compiler for this. Otherwise, which GCC version you used ? I have tried with GCC 3.4 and succeeded with NTLM.

This link should be helpful to you,
http://plone.org/documentation/how-to/singlesignonwindowsdomains

-Arun

[Petr Wunsch]

All right - problem solved by using LDAP access. LDAP authentication using SSL is built into HP-UX distribution of Apache webserver and is well documented.

[Petr Wunsch]

Problem with compiling mod_ntlm not solved. Solution found using LDAP access.