Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to configure a VsFTPd server to authenticate agains an LDAP server. It may be easy, but since it is the first time that I am using both LDAP and PAM, I have some difficulties. VsFTPd runs on an Ubuntu Server 11.04 and the LDAP is OpenLDAP on an 10.10 Ubuntu Server. I disabled AppArmor on the first one. VsFTPd cannot connect to the LDAP server, in my syslog I have:

vsftpd: pam_ldap: ldap_simple_bind Can't contact LDAP server

The LDAP server is OK since I can do an ldapsearch.

Here is my /etc/pam.d/vsftpd file:

auth required pam_listfile.so item=user sense=deny file=/etc/ftpusers onerr=succeed
@include common-account
@include common-session
@include common-auth
auth required pam_ldap.so
account required pam_ldap.so
session required pam_ldap.so
password required pam_ldap.so

And here is my /etc/ldap.conf file:

base dc=example,dc=com
uri ldapi:///ldap.example.com
ldap_version 3
rootbinddn cn=admin,dc=example,dc=com
pam_password md5
nss_initgroups_ignoreusers a_bunch_of_system_users

Can anyone help me please ? Thank you.

EDIT: new version of the /etc/pam.d/vsftpd file:

auth    required    pam_listfile.so item=user sense=deny file=/etc/ftpusers onerr=succeed

account required    pam_unix.so
account sufficient  pam_ldap.so

session required    pam_limits.so
session required    pam_unix.so
session optimal     pam_ldap.so

auth    required    pam_env.so
auth    sufficient  pam_unix.so nullok_secure
auth    sufficient  pam_ldap.so use_first_pass

auth    required    pam_shells.so
share|improve this question

2 Answers 2

up vote 2 down vote accepted

According to man ldap.conf:

URI <ldap[si]://[name[:port]] ...>

The URI scheme may be any of ldap, ldaps or ldapi, which refer to LDAP over TCP, LDAP over SSL (TLS) and LDAP over IPC (UNIX domain sockets), respectively.

So, change uri ldapi:///ldap.example.com to uri ldap:///ldap.example.com and try again.

share|improve this answer
    
No change. I forgot to add that the ldapsearchonly works by providing an explicit ldap server with the -h option. Do you have another idea? Do you need another configuration file? Thank you for your help. –  Totor Oct 5 '11 at 9:21
    
Actually, I just removed one "/" in the URI and I have some progress. I don't have the "Can't contact LDAP server" anymore, and I don't have to user the "-h" option anymore for ldapsearch. It still does not work and I have to figure out where there is a problem. –  Totor Oct 5 '11 at 9:31
    
Would be possible to post the slapd.conf and review the ACLs? I had a similar issue in the past and it was pain because I put the ACLs in the wrong place. –  Rilindo Oct 5 '11 at 15:51
    
Actually, I don't have any slapd.conf. I assumed it was because I am running under Ubuntu. However I did a wireshark capture of the exchange between the FTP server and the LDAP server : aneuropeanstudent.eu/ldap-ftp.wireshark In this capture, you can see between packets 9 and 15 that the binding is OK. But packet 18 is a useless search that returns no results and triggers the "INCORRECT LOGIN" for the FTP server. I don't know why this research is done. Also, excuse my ignorance, but what are you calling ACLs here ? Thank you for your help. –  Totor Oct 5 '11 at 16:44
    
Also, I changed my /etc/pam.d/vsftpd file. See the question. –  Totor Oct 5 '11 at 16:58

Ok, this part of the problem is solved. Here is the working /etc/pam.d/vsftpd file:

auth                    required                pam_ldap.so
account                 required                pam_ldap.so
password                required                pam_ldap.so

And you have to add this line to /etc/vsftpd.conf:

guest_enable=YES

After this, there is still some work to properly chroot the LDAP users in the FTP server, but they can now login.

Thank you again Rilindo for your help. After all, ACLs were not the issue here.

share|improve this answer
    
I am not sure if the guest_enable is the actual fix. I have the following in my vsFTP config (I also have a LDAP server which I have my clients connect): pastebin.com/8bBuSaFM . Here is my vsftpd pam config: pastebin.com/VugWRUMz . And my passwordauth: pastebin.com/g5jbwFBU . Then again, I use a Red Hat type distro, which automate the lot of this stuff for you when you setup your client with LDAP authentication –  Rilindo Oct 6 '11 at 2:53
    
Well, without the guest_enable, VsFTPd gave me a 500 error: OOPS, can not locate user entry. I'll study your configuration, thanks ! –  Totor Oct 6 '11 at 7:21
    
Cool. FWIW, I looked it up that setting and as it turns out, guest_enable means that your login will use the default FTP user (which in this case is likely going to be "ftp"). This means that if you were logged in, either you failed ldap authentication and it defaulted to the ftp user on theserver or you never authenticated against ldap right from the start of the session. –  Rilindo Oct 6 '11 at 13:37
1  
Actually, it is right. guest_enable does allow you to connect to the FTP server, but you cannot do anything after, because you are not connected as the right user. The issue here was that the LDAP users were not posixAccount objects. –  Totor Oct 12 '11 at 20:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.