ikiwiki/ plugins/ contrib/ unixauth (third party plugin)

Plugin: unixauth
Author: schmonz
Included in ikiwiki: no
Enabled by default: no
Included in goodstuff: no
Currently enabled: yes

Available in a git repository branch.
Branch: unixauth
Author: schmonz

This plugin authenticates users against the Unix user database. It presents a similar UI to passwordauth, but simpler, as there's no need to be able to register or change one's password.

To authenticate, either checkpassword or pwauth must be installed and configured. `checkpassword` is strongly preferred. If your web server runs as an unprivileged user -- as it darn well should! -- then `checkpassword` needs to be setuid root. (Or your ikiwiki CGI wrapper, I guess, but don't do that.) Other checkpassword implementations are available, notably checkpassword-pam.

Config variables that affect the behavior of `unixauth`:

- `unixauth_type`: defaults to unset, can be "checkpassword" or "pwauth"
- `unixauth_command`: defaults to unset, should contain the full path and any arguments
- `unixauth_requiressl`: defaults to 1, can be 0
- `sslcookie`: needs to be 1 if `unixauth_requiressl` is 1 (perhaps this should be done automatically?)

Security: As with passwordauth, be wary of sending usernames and passwords in cleartext. Unlike passwordauth, sniffing `unixauth` credentials can get an attacker much further than mere wiki access. Therefore, this plugin defaults to not even displaying the login form fields unless we're running under SSL. Nobody should be able to do anything remotely dumb until the admin has done at least a little thinking. After that, dumb things are always possible.

`unixauth` needs the `HTTPS` environment variable, available in ikiwiki 2.67 or later (fixed in #502047), without which it fails closed.

The plugin has not been tested with newer versions of ikiwiki. schmonz hopes to have time to polish this plugin soon.