Download websites that use mod_auth_pam

About mod_auth_pam

Server modules are the part of a stack that a website is not meant to advertise. mod_auth_pam is an Apache module that hands authentication over to the operating system, so a request for a protected page is checked against the same identity infrastructure that governs shell accounts, which in practice means Unix users, a directory service or a Kerberos realm rather than a table of web passwords.

The reason for using it is administrative rather than technical. An organisation with a single source of truth for identity does not want a second one living inside a web application, so the module exists to avoid maintaining a parallel password store. Such a pattern belongs to intranets, internal tools, administrative panels and university systems far more than to commercial sites, which means a detection often says that the domain is not really a public product at all.

Age matters here. The module dates from 1998, is written in C, is released under GPL v2, and has been effectively frozen for a long time. An authentication component that sits in the request path and no longer receives attention is a security relevant fact on its own, quite apart from whether it was ever misconfigured on a particular host.

Detection is inferential and the caveat is large. A server reveals its module list only when configured to be talkative, through verbose server tokens, an exposed status handler, or a default error page nobody replaced, and every hardening guide of recent years tells administrators to switch that off. As of October 2026 we record mod_auth_pam on 1,260 hosts, so the visible population is biased towards machines left verbose rather than towards any particular kind of organisation. Our version data is correspondingly thin, 2 distinct strings in total, clustered on 1.1.1, which is what software that stopped moving tends to look like.

For an attack surface inventory that bias is not fatal. A researcher mapping legacy Apache deployments, a vendor selling migration away from an unmaintained authentication path, and a security team checking whether anything in its own estate still binds web access to system accounts all want the same object, which is the full set of hosts where the module is visible together with the rest of the stack behind each one. Filed under Web server extensions in our catalogue, the entry is one of the few fingerprints that describes how a site decides who you are. A lookup on a single hostname cannot show a pattern that exists only in aggregate.