Tag Archives: PAM
PAM, Pluggable Authentication Modules, originated in Solaris and became common place in all Linux, BSDs, and AIX, HP-UX and macOS. MariaDB has had PAM support as an option since MariaDB 5.2.10 becoming stable in 10.0.11. So if this is all old and boring why reconsider it? The environment in which Linux operates with PAM has changed in the last 15 years.
MariaDB’s PAM plugin version 1 (as its become known) has a restriction, because the pam module loaded was loaded into the mariadbd executable, it was subject to the restricted permissions, normally just the user, that mariadbd runs.
…
We have lately been talking about some upcoming features that we feel are important to MariaDB users, because the corresponding ones that will be provided with MySQL will be incompatible with MariaDB and closed source.
We’re happy to announce the following:
- The next version of MariaDB, version 5.2.10 will include an open source PAM Authentication Plugin. MariaDB 5.2.10 is scheduled for release next week.
- A Windows Authentication Plugin is in development and QA currently and will be part of MariaDB 5.2.11, which is scheduled for release before Christmas.
- MariaDB 5.5 will include both of the above plugins and an open source thread pool implementation.
…
As you may know, since version 5.2.0 (released in April 2010) we support Pluggable Authentication. Using this feature one can implement an arbitrary user authentication and account management policy, completely replacing built-in MariaDB authentication with its username/password combination and mysql.user table.
Also, as you might have heard, Oracle has recently released a PAM authentication plugin for MySQL. Alas, this plugin will not run on MariaDB — although the MySQL implementation of pluggable authentication is based on ours, the API is incompatible. And, being closed source, this plugin cannot be fixed to run in MariaDB. And — I’m not making it up — this plugin does not support communication between the client and the server, so even with this plugin and all the power of PAM the only possible authentication method remains a simple username/password combination. …
Continue reading “Writing a MariaDB PAM Authentication Plugin”