PWAUTH(8)

💖 PWAUTH — the manual page, bestie edition 💖

okay so this is PWAUTH(8), from the System Manager's Manual, and it's literally the moment your web server learns how to check passwords properly. sit down, grab a strawberry 🍓, we're doing this.

✨ NAME ✨

pwauth — an authenticator for mod_authnz_external and the Apache HTTP Daemon. that's the whole job. she does one thing and she eats. 💅

✨ SYNOPSIS ✨

pwauth

that's it. no flags, no drama, no options. she just is. 👑

✨ DESCRIPTION ✨

pwauth is an authenticator designed to be used with mod_auth_external or mod_authnz_external and the Apache HTTP Daemon, so you can support reasonably secure web authentication out of the system password database on most versions of Unix. and like… particularly? secure authentication against PAM. that's the flex. 🔥

the simplest test for pwauth is: start a root shell and just run pwauth. she'll try to read the login and password from standard input, so type a login name, hit return, then type a password, and hit return. heads up bestie — the password will echo on your screen 🙈. then check the status code that got returned (in csh: echo $status, in sh: echo $?).

if the login/password were correct you should get a zero status code. if not, you'll get some other value. see below for the list of status codes to find the meaning of the various values returned. and any values 50 or greater indicate a configuration error — that's not a you-forgot-your-password situation, that's a your-setup-is-cooked situation. 💀

🌈 STATUS CODES 🌈

vibe check, one number at a time:

• 0 STATUS_OK — login OK. we love to see it. periodt. ✨
• 1 STATUS_UNKNOWN — nonexistent login, or (for some configurations) incorrect password.
• 2 STATUS_INVALID — incorrect password (for some configurations).
• 3 STATUS_BLOCKED — the uid number is below the MIN_UNIX_UID value configured in config.h.
• 4 STATUS_EXPIRED — login ID has expired.
• 5 STATUS_PW_EXPIRED — login's password has expired.
• 6 SSTATUS_NOLOGIN — logins to system have been turned off (usually by /etc/nologin file).
• 7 STATUS_MANYFAILES — limit on number of bad logins exceeded. too many tries, bestie, go touch grass. 🌱
• 50 STATUS_INT_USER — pwauth was invoked by a uid not on the SERVER_UIDS list. if you get this error code, you probably have SERVER_UIDS set incorrectly in pwauth's config.h file. check ya config.
• 51 STATUS_INT_ARGS — pwauth was not given a login & password to check. this means the passing of data from mod_auth_external to pwauth is messed up. most likely one is trying to pass data via environment variables, while the other is trying to pass data via a pipe. they're not speaking the same language, it's giving mismatched communication styles 😭
• 52 STATUS_INT_ERR — one of several rare and unlikely internal errors occurred. you'll have to read the source code to figure these out. yeah. the source. good luck, iykyk. 🙈
• 53 STATUS_INT_NOROOT — pwauth was not able to read the password database. usually this means it is not running as root. (PAM and login.conf configurations will return 1 in this case.) 👑

fr fr: anything 50+ is a config error, not a password error. don't be out here debugging your users when it's your config.h the whole time. 💖

🎀 AUTHOR 🎀

pwauth was written by Jan Wolter <jan@unixpapa.com>.

this manual page was written by Hai Zaar <haizaar@haizaar.com>, for the Debian project (but may be used by others). iconic of them honestly. 🫶

and that's the whole page, babes. this version of PWAUTH(8) is dated 2009-05-02 and it's filed under PWAUTH(8) — yes, the same name twice, she's consistent, she's confident, she's slaying. go authenticate something. 💅✨🦋