DrBacchus' Journal

mod_auth_mysql? Anyone?

I've spent the last half hour trying to find mod_auth_mysql, and I'm getting very irate.

There appear to be two main mod_auth_mysqls out there. One was written by Zeev Suraski, and abandonded in October of 1998. The other was written by Vivek Khera, and abandonded some time in summer 2001.

From each of these, there are several forks, resulting, I assume, from folks that like the code, but needed it maintained going forward. I don't think I'll list all of these.

And, to further muddy the waters, MANY sites contain a partial mirror of Zeev's site, including mod_auth_mysql version 2.20, which released in 1998, and contains at least one well publicized security problem.

The most promising versions out there appear to be the version on sourceforge (http://modauthmysql.sourceforge.net/) and the version maintained by Debian (http://ftp.debian.org/debian/pool/main/liba/libapache-mod-auth-mysql/, with additional information at http://packages.debian.org/cgi-bin/search_packages2.pl?keywords=libapache-mod-auth-mysql&searchon=names&version=all&release=all)

For those upgrading from earlier versions, note that that Debian version derives from Zeev's code, while the SourceForge project derives from Vivek's code. It would be nice if each *CLEARLY* stated this in the documentation, or even in the primary project description, to ease the upgrade path. And perhaps even pointed off to the other project somewhere in the docs.

All of the folks keeping up a page with Zeev's stuff are not doing anybody any favors. And modules.apache.org ... well, there's a topic for another day. We really need to do something about modules.apache.org. Soon.

Oh, and I should mention that if you are using Apache 2.0, you should take advantage of the new authentication framework, and use mod_authn_dbi, which you can get at http://open.cyanworlds.com/mod_authn_dbi/

Posted by rbowen at May 26, 2003 08:55 AM | TrackBack