1

I need a specific PAM configuration for my SFTP service, so I copied the sshd executable and renamed it sftpd.

Then I set up a specific configuration in /etc/pam.d/sftpd to authenticate the users against LDAP, while the regular users are authenticated as usual.

Everything is fine, but the problem is, the "new" sftpd daemon, configured and launched as a systemd service on RedHat EL 7.4, don't trace actions (opendir, chdir, and so on).

The configuration is the same as the regular sshd, in particular this line:

Subsystem       sftp    internal-sftp -l VERBOSE

But nothing comes in auth.log.

Is there some curious side effect I should be aware of, if the sshd daemon runs under a different name?

Thanks in advance for any help

0

Turns out this has nothing to do with the renaming thing. The problem comes from the pam_ldap configuration. I added debug at the end of one line in /etc/pam.d/sftpd file, as in :

#%PAM-1.0
auth       required     pam_ldap.so
auth       required     pam_sepermit.so
auth       include      postlogin

## Used with polkit to reauthorize users in remote sessions
-auth      optional     pam_reauthorize.so prepare

account    required     pam_ldap.so debug
account    required     pam_nologin.so
account    include      password-auth


password   sufficient   pam_ldap.so
password   include      password-auth
# pam_selinux.so close should be the first session rule

session    required     pam_selinux.so close
session    required     pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open env_params
session    required     pam_namespace.so
session    optional     pam_keyinit.so force revoke
session    include      password-auth
session    include      postlogin
# Used with polkit to reauthorize users in remote sessions
-session   optional     pam_reauthorize.so prepare

And logging reapears in /var/log/secure :

Jun 13 15:11:38 somehost sftpd[40543]: session opened for local user USER01 from [xxx.xxx.28.32] [postauth]
Jun 13 15:11:38 somehost sftpd[40543]: received client version 3 [postauth]
Jun 13 15:11:38 somehost sftpd[40543]: realpath "." [postauth]
Jun 13 15:11:42 somehost sftpd[40543]: realpath "/chroot" [postauth]
Jun 13 15:11:42 somehost sftpd[40543]: opendir "/chroot" [postauth]
Jun 13 15:11:42 somehost sftpd[40543]: closedir "/chroot" [postauth]
Jun 13 15:11:42 somehost sftpd[40543]: realpath "/chroot/somedir" [postauth]
Jun 13 15:11:42 somehost sftpd[40543]: opendir "/chroot/somedir" [postauth]
Jun 13 15:11:43 somehost sftpd[40543]: closedir "/chroot/somedir" [postauth]

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.