[squid-users] Re: Help!setting up squid to authenticate through accounts passwords

pam_auth is not really intended for setups requiring authentication to
/etc/shadow, but where you do have a PAM module for connecting to the
user directory in question, but no Squid auth module. /etc/shadow is one
such case, but not a very interesting one from a functionality
perspective.

As the author of Squid pam_auth I can only agree that there are concerns
about running pam_auth setuserid root for authentication to /etc/shadow.
The brute-force attack issue is a real one, and there always is the risk
of buffer overflows in SUID applications even if the pam_auth code is
beleived to be reasonably secure in this respec (but there may well be
aspects I have overlooked).

--
Henrik Nordstrom
Squid Hacker
Lim Seng Chor wrote:
> i personally feel pam_auth is a dangerous program to run if you are
> running a multi-user system. unless you are running a dedicated-
> cache system, or else pam_auth might get yourself into trouble.
> this may allow users to do brute-force attack on password
> guessing or password sniffing on the port pam_auth listenning. and
> unknown setuid buffer overflow for pam_auth if exists. do this at
> your own risk. good luck!!