15 Mar
2007
15 Mar
'07
1:55 p.m.
Hi,
I'm currently butting my head on a configuration where
I have a RHEL4 (x86_64) server with OpenLDAP and proftpd,
user data are residing in the OpenLDAP, and I wish to
get proftpd to also use that LDAP directory.
2 variants:
- recompile proftpd with LDAP support built-in.
This is definitely not wanted for maintainability
reasons, I need to use plain RPMs from RedHat.
I did install proftpd-ldap, but for some reason
proftpd won't recognize the presence of that
module.
- get proftpd to use PAM, specifically pam_ldap
I went with the 2nd variant, but didn't get it working
so far. According to the fine manuals, I've created the
file /etc/pam.d/ftp with contents like:
auth sufficient /lib64/security/pam_ldap.so
account sufficient /lib64/security/pam_ldap.so
session sufficient /lib64/security/pam_ldap.so
(I did try with some other variants).
proftpd.conf is adapted:
AuthPAM on
AuthPAMConfig ftp
AuthOrder mod_auth_pam.c* mod_auth_unix.c
The files /etc/ldap.conf resp. /etc/openldap/ldap.conf
are adapted for use with the local LDAP, and simple
ldapsearch -x uid=xyz
does provide the correct answer.
nsswitch was of course adapted.
I can login via ssh with an user present only in the
LDAP tree, but no dice with proftpd.
All I find in the log file is "no such user" despite
activating "debug" logging. The ldap log doesn't show
activity at the moment of trying to access proftpd.
Any ideas what I missed?
I'll welcome precise RTFM instructions, google or
proftpd.org are what got me this far.
Greetings & TIA, Eric
15 Mar
15 Mar
7:27 p.m.
Eric Dondelinger wrote:
I'm currently butting my head on a configuration
where
I have a RHEL4 (x86_64) server with OpenLDAP and proftpd,
user data are residing in the OpenLDAP, and I wish to
get proftpd to also use that LDAP directory.
I can not directly help you as I stopped using proftpd a long time ago.
But have you already considered using vsftpd? It does not have as many
features as proftpd, but it is much simpler (to configure) and has a
much better security record. The daemon uses a multiple daemon
architecture with the least priviledge principle just like postfix and
apop3d.
Perhaps you have more luck with vsftpd as it is the default FTP server
in most distros nowadays (incl. RHEL & SLES) and the PAM integration
must be officially supported by RHEL (phone support?).
I do not want to start a flame war about proftpd vs vsftpd as vsftpd
lacks some features (but which may not be needed anyways).
http://vsftpd.beasts.org/
Greetings, Patrick
16 Mar
16 Mar
6:59 a.m.
Hi Patrick,
thank you for your answer!
On Thu, Mar 15, 2007 at 08:27:08PM +0100, Patrick Kaell wrote:
Eric Dondelinger wrote:
Actually, that's the next possibility I had in mind,
switching the ftpd altogether. Since what's to be
found on RHEL4 is proftpd and vsftpd, your favorite
is precisely what I was about to try.
I was a bit reluctant about that because most people
here are experienced with proftpd and we want to
keep more or less with the same packages, but...
Greetings,
Eric Dondelinger
I'm currently butting my head on a
configuration where
I have a RHEL4 (x86_64) server with OpenLDAP and proftpd,
user data are residing in the OpenLDAP, and I wish to
get proftpd to also use that LDAP directory.
I can not directly help you as I stopped using proftpd a long time ago.
But have you already considered using vsftpd? It does not have as many
features as proftpd, but it is much simpler (to configure) and has a
much better security record. The daemon uses a multiple daemon
architecture with the least priviledge principle just like postfix and
apop3d.
Perhaps you have more luck with vsftpd as it is the default FTP server
in most distros nowadays (incl. RHEL & SLES) and the PAM integration
must be officially supported by RHEL (phone support?).
I do not want to start a flame war about proftpd vs vsftpd as vsftpd
lacks some features (but which may not be needed anyways).
http://vsftpd.beasts.org/
6273
days inactive
6274
days old
2 comments
2 participants
participants (2)
-
Eric Dondelinger -
Patrick Kaell