I'm currently developing an application for shared hosting, using a complete MySQL backend for the machine. I've set up all my services, and they're quite operational, however I've a little problem with pure-ftpd.
As you may know, Pure-FTPd can work with MySQL thanks to
pure-ftpd-mysql. Here's what the basic configuration looks like :
MYSQLServer 127.0.0.1 MYSQLPort 3306 MYSQLSocket /var/run/mysqld/mysqld.sock MYSQLUser myftpdbuser MYSQLPassword myftpdbpassword MYSQLDatabase myftpdb MYSQLCrypt md5 # Here come the selection queries...
As you can see, I've chosen md5 as the encryption algorithm, but that's a problem. I'm using Symfony2, and I've set the encoder to sha512 for my users, and when I want to create an FTP account with the same password as one of my users, I have to copy the sha512 hash to the FTP account.
That's quite satisfying however, Pure-FTPd is configured for md5, therefore, it won't be able to check this password. I'd like to keep sha512 as much as possible, given that using md5 will require some modifications of my code for re-encryption.
Here's what the Pure-FTPd configuration sample says :
# Mandatory : how passwords are stored # Valid values are : "cleartext", "crypt", "sha1", "md5" and "password" # ("password" = MySQL password() function) # You can also use "any" to try "crypt", "sha1", "md5" *and* "password"
So here's my question : is there any chance I could set Pure-FTPd to work with sha512, using "crypt" for instance ? Perhaps I could use
crypt and configure it to use sha512 somewhere else, I don't know...
I've tried working with the queries but I couldn't find any trick. Here's the password query :
MYSQLGetPW SELECT password FROM ftp_accounts WHERE username='\L'
After a few searches, and with the answer I got, I deduced 3 solutions :
- Develop a Pure-FTPd authentication module design to perform the MySQL query, and handle the password encryption mechanism. This implies porting the PHP algorithm to C (or other language), which I did using the OpenSSL library. Initiate a
SHA512_CTXstructure and get your first digest. Iterate 500 times with the right parameters, and perform a base 64 encoding. You can also use the hexadecimal result, according to your Symfony settings.
crypt(3)to work with salted SHA512 hashes under PureFTPd. Tricky thing, when you start talking about 500 iterations.
- Develop a Symfony2 command which performs the authentication for you. Easy as hell, works like a charm. Create an executable script (let's say
/usr/bin/pureftpd-authwhich simply calls
/path/to/php /path/to/app/console your:ftp:auth:command.
chmodit, give it a proper interpreter (
#!/bin/bash, ...) and start
pureftpdon a shared socket to make them communicate. See http://download.pureftpd.org/pure-ftpd/doc/README.Authentication-Modules for more information.