up vote 1 down vote favorite
share [g+] share [fb]

Possible Duplicate:
VsFTPd - LDAP - PAM

I am trying to configure a VsFTPd server to authenticate agains an LDAP server. It may be easy, but since it is the first time that I am using both LDAP and PAM, I have some difficulties. VsFTPd runs on an Ubuntu Server 11.04 and the LDAP is OpenLDAP on an 10.10 Ubuntu Server. VsFTPd cannot connect to the LDAP server, in my syslog I have:

vsftpd: pam_ldap: ldap_simple_bind Can't contact LDAP server

The LDAP server is OK since I can do an ldapsearch.

Here is my /etc/pam.d/vsftpd file:

auth required pam_listfile.so item=user sense=deny file=/etc/ftpusers onerr=succeed
@include common-account
@include common-session
@include common-auth
auth required pam_ldap.so
account required pam_ldap.so
session required pam_ldap.so
password required pam_ldap.so

And here is my /etc/ldap.conf file:

base dc=example,dc=com
uri ldapi:///ldap.example.com
ldap_version 3
rootbinddn cn=admin,dc=example,dc=com
pam_password md5
nss_initgroups_ignoreusers a_bunch_of_system_users

Can anyone help me please ? Thank you.

EDIT: precision about Ubuntu Server. Typo on pam_listfile.so

link|improve this question
I think you'll have better luck on Server Fault, I've voted to migrate it there. Is your vsftpd confined with a tool such as AppArmor, SELinux, TOMOYO, or SMACK? Using mandatory access control tools can prevent applications from getting access to all the resources they need to function correctly. – sarnold Oct 4 '11 at 22:15
I disabled AppArmor, but no changes. How do I move this question to ServerFault ? And I forgot to tell that my FTP server is on Ubuntu Server 11.04 and the LDAP on 10.10. Thank you for your help. – Totor Oct 5 '11 at 7:59
pam_lisfile.so? Is that a typo in your content here, or a typo in your /etc/pam.d/vsftpd? – sarnold Oct 5 '11 at 8:03
No, it is a typo here. This line was generated automatically when I installed VsFTPd. – Totor Oct 5 '11 at 8:05
feedback

migrated from stackoverflow.com Oct 5 '11 at 13:39

This question came from our site for professional and enthusiast programmers.

closed as exact duplicate by sysadmin1138♦ Oct 9 '11 at 19:53

This question covers exactly the same ground as earlier questions on this topic; its answers may be merged with another identical question. See the FAQ for guidance on how to improve it.

1 Answer

up vote 0 down vote accepted

It looks like URI is incorrect - it has an extra slash. That is probably why you are getting that message, as it couldn't find the ldap server at all.

It should be:

base dc=example,dc=com
uri ldapi://ldap.example.com
ldap_version 3
rootbinddn cn=admin,dc=example,dc=com
pam_password md5
nss_initgroups_ignoreusers a_bunch_of_system_users

However, since you are apparently connecting locally, you should probably simply things for now with:

base dc=example,dc=com
uri ldapi://127.0.0.1
ldap_version 3
rootbinddn cn=admin,dc=example,dc=com
pam_password md5
nss_initgroups_ignoreusers a_bunch_of_system_users
link|improve this answer
Thank you, it was the problem. This question was moved from StackOverflow and I had already re-created here before. serverfault.com/questions/318622/vsftpd-ldap-pam I still can't get the users to connect to the FTP using LDAP and I don't know where my problem is. The only log I have is VsFTPd's "LOGIN FAILED" which is not very helpful... – Totor Oct 5 '11 at 15:21
feedback

Not the answer you're looking for? Browse other questions tagged or ask your own question.