Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to configure a VsFTPd server to authenticate agains an LDAP server. It may be easy, but since it is the first time that I am using both LDAP and PAM, I have some difficulties. VsFTPd runs on an Ubuntu Server 11.04 and the LDAP is OpenLDAP on an 10.10 Ubuntu Server. I disabled AppArmor on the first one. VsFTPd cannot connect to the LDAP server, in my syslog I have:

vsftpd: pam_ldap: ldap_simple_bind Can't contact LDAP server

The LDAP server is OK since I can do an ldapsearch.

Here is my /etc/pam.d/vsftpd file:

auth required item=user sense=deny file=/etc/ftpusers onerr=succeed
@include common-account
@include common-session
@include common-auth
auth required
account required
session required
password required

And here is my /etc/ldap.conf file:

base dc=example,dc=com
uri ldapi:///
ldap_version 3
rootbinddn cn=admin,dc=example,dc=com
pam_password md5
nss_initgroups_ignoreusers a_bunch_of_system_users

Can anyone help me please ? Thank you.

EDIT: new version of the /etc/pam.d/vsftpd file:

auth    required item=user sense=deny file=/etc/ftpusers onerr=succeed

account required
account sufficient

session required
session required
session optimal

auth    required
auth    sufficient nullok_secure
auth    sufficient use_first_pass

auth    required
share|improve this question
up vote 2 down vote accepted

According to man ldap.conf:

URI <ldap[si]://[name[:port]] ...>

The URI scheme may be any of ldap, ldaps or ldapi, which refer to LDAP over TCP, LDAP over SSL (TLS) and LDAP over IPC (UNIX domain sockets), respectively.

So, change uri ldapi:/// to uri ldap:/// and try again.

share|improve this answer
No change. I forgot to add that the ldapsearchonly works by providing an explicit ldap server with the -h option. Do you have another idea? Do you need another configuration file? Thank you for your help. – Totor Oct 5 '11 at 9:21
Actually, I just removed one "/" in the URI and I have some progress. I don't have the "Can't contact LDAP server" anymore, and I don't have to user the "-h" option anymore for ldapsearch. It still does not work and I have to figure out where there is a problem. – Totor Oct 5 '11 at 9:31
Would be possible to post the slapd.conf and review the ACLs? I had a similar issue in the past and it was pain because I put the ACLs in the wrong place. – Rilindo Oct 5 '11 at 15:51
Actually, I don't have any slapd.conf. I assumed it was because I am running under Ubuntu. However I did a wireshark capture of the exchange between the FTP server and the LDAP server : In this capture, you can see between packets 9 and 15 that the binding is OK. But packet 18 is a useless search that returns no results and triggers the "INCORRECT LOGIN" for the FTP server. I don't know why this research is done. Also, excuse my ignorance, but what are you calling ACLs here ? Thank you for your help. – Totor Oct 5 '11 at 16:44
Also, I changed my /etc/pam.d/vsftpd file. See the question. – Totor Oct 5 '11 at 16:58

Ok, this part of the problem is solved. Here is the working /etc/pam.d/vsftpd file:

auth                    required      
account                 required      
password                required      

And you have to add this line to /etc/vsftpd.conf:


After this, there is still some work to properly chroot the LDAP users in the FTP server, but they can now login.

Thank you again Rilindo for your help. After all, ACLs were not the issue here.

share|improve this answer
I am not sure if the guest_enable is the actual fix. I have the following in my vsFTP config (I also have a LDAP server which I have my clients connect): . Here is my vsftpd pam config: . And my passwordauth: . Then again, I use a Red Hat type distro, which automate the lot of this stuff for you when you setup your client with LDAP authentication – Rilindo Oct 6 '11 at 2:53
Well, without the guest_enable, VsFTPd gave me a 500 error: OOPS, can not locate user entry. I'll study your configuration, thanks ! – Totor Oct 6 '11 at 7:21
Cool. FWIW, I looked it up that setting and as it turns out, guest_enable means that your login will use the default FTP user (which in this case is likely going to be "ftp"). This means that if you were logged in, either you failed ldap authentication and it defaulted to the ftp user on theserver or you never authenticated against ldap right from the start of the session. – Rilindo Oct 6 '11 at 13:37
Actually, it is right. guest_enable does allow you to connect to the FTP server, but you cannot do anything after, because you are not connected as the right user. The issue here was that the LDAP users were not posixAccount objects. – Totor Oct 12 '11 at 20:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.