sshd verbose logging when renamed to sftpd

Question

I need a specific PAM configuration for my SFTP service, so I copied the sshd executable and renamed it sftpd.

Then I set up a specific configuration in /etc/pam.d/sftpd to authenticate the users against LDAP, while the regular users are authenticated as usual.

Everything is fine, but the problem is, the "new" sftpd daemon, configured and launched as a systemd service on RedHat EL 7.4, don't trace actions (opendir, chdir, and so on).

The configuration is the same as the regular sshd, in particular this line:

Subsystem       sftp    internal-sftp -l VERBOSE

But nothing comes in auth.log.

Is there some curious side effect I should be aware of, if the sshd daemon runs under a different name?

Thanks in advance for any help

Answer 1

Turns out this has nothing to do with the renaming thing. The problem comes from the pam_ldap configuration. I added debug at the end of one line in /etc/pam.d/sftpd file, as in :

#%PAM-1.0
auth       required     pam_ldap.so
auth       required     pam_sepermit.so
auth       include      postlogin

## Used with polkit to reauthorize users in remote sessions
-auth      optional     pam_reauthorize.so prepare

account    required     pam_ldap.so debug
account    required     pam_nologin.so
account    include      password-auth


password   sufficient   pam_ldap.so
password   include      password-auth
# pam_selinux.so close should be the first session rule

session    required     pam_selinux.so close
session    required     pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open env_params
session    required     pam_namespace.so
session    optional     pam_keyinit.so force revoke
session    include      password-auth
session    include      postlogin
# Used with polkit to reauthorize users in remote sessions
-session   optional     pam_reauthorize.so prepare

And logging reapears in /var/log/secure :

Jun 13 15:11:38 somehost sftpd[40543]: session opened for local user USER01 from [xxx.xxx.28.32] [postauth]
Jun 13 15:11:38 somehost sftpd[40543]: received client version 3 [postauth]
Jun 13 15:11:38 somehost sftpd[40543]: realpath "." [postauth]
Jun 13 15:11:42 somehost sftpd[40543]: realpath "/chroot" [postauth]
Jun 13 15:11:42 somehost sftpd[40543]: opendir "/chroot" [postauth]
Jun 13 15:11:42 somehost sftpd[40543]: closedir "/chroot" [postauth]
Jun 13 15:11:42 somehost sftpd[40543]: realpath "/chroot/somedir" [postauth]
Jun 13 15:11:42 somehost sftpd[40543]: opendir "/chroot/somedir" [postauth]
Jun 13 15:11:43 somehost sftpd[40543]: closedir "/chroot/somedir" [postauth]