Problème avec proftpd + LDAP

Support Debian
#1

Bonjour,

J’essaye désespérement de connecter mon serveur FTP à mon serveur LDAP… J’y suis pas très loin mais je n’arrive pas à réaliser l’authentification correctement…

J’ai tester toutes les possibilité du ldap.conf mais sans succès…

Si quelqu’un pouvait m’aider à trouver la solution ca serait merveilleux…

Voici ma config:

[code]debian:/etc/proftpd# cat ldap.conf

Proftpd sample configuration for LDAP authentication.

#AuthOrder mod_ldap.c LDAPDefaultAuthScheme clear LDAPAuthBinds on LDAPQueryTimeout 10 LDAPDoUIDLookups on "ou=people,dc=domaine,dc=eu" LDAPServer ldap://IP_SERVEUR:389 LDAPDNInfo "cn=admin,dc=domaine,dc=eu" "motdepasse" LDAPDoAuth on ou=people,dc=domaine,dc=eu "(&(uid=%u)(objectclass=posixAccount))" [/code] [code]debian:/etc/proftpd# cat modules.conf # # This file is used to manage DSO modules and features. #

This is the directory where DSO modules reside

ModulePath /usr/lib/proftpd

Allow only user root to load and unload modules, but allow everyone

to see which modules have been loaded

ModuleControlsACLs insmod,rmmod allow user root
ModuleControlsACLs lsmod allow user *

LoadModule mod_ctrls_admin.c
LoadModule mod_tls.c

Install proftpd-mod-mysql or proftpd-mod-pgsql to use this

#LoadModule mod_sql.c

Install proftpd-mod-ldap to use this

LoadModule mod_ldap.c

‘SQLBackend mysql’ or ‘SQLBackend postgres’ directives are required

to have SQL authorization working. You can also comment out the

unused module here, in alternative.

Install proftpd-mod-mysql to use this

#LoadModule mod_sql_mysql.c

Install proftpd-mod-pgsql to use this

#LoadModule mod_sql_postgres.c

LoadModule mod_radius.c
LoadModule mod_quotatab.c
LoadModule mod_quotatab_file.c

Install proftpd-mod-ldap to use this

#LoadModule mod_quotatab_ldap.c

Install proftpd-mod-pgsql or proftpd-mod-mysql to use this

#LoadModule mod_quotatab_sql.c
LoadModule mod_quotatab_radius.c
LoadModule mod_wrap.c
LoadModule mod_rewrite.c
LoadModule mod_load.c
LoadModule mod_ban.c
LoadModule mod_wrap2.c
LoadModule mod_wrap2_file.c

Install proftpd-mod-pgsql or proftpd-mod-mysql to use this

#LoadModule mod_wrap2_sql.c
LoadModule mod_dynmasq.c

keep this module the last one

LoadModule mod_ifsession.c[/code]

[code]debian:/etc/proftpd# cat proftpd.conf

/etc/proftpd/proftpd.conf – This is a basic ProFTPD configuration file.

To really apply changes reload proftpd after modifications.

Includes DSO modules

Include /etc/proftpd/modules.conf

Set off to disable IPv6 support which is annoying on IPv4 only boxes.

UseIPv6 off

If set on you can experience a longer connection delay in many cases.

IdentLookups off

ServerName "Debian"
ServerType standalone
DeferWelcome off

MultilineRFC2228 on
DefaultServer on
ShowSymlinks on

TimeoutNoTransfer 600
TimeoutStalled 600
TimeoutIdle 1200

DisplayLogin welcome.msg
DisplayChdir .message true
ListOptions “-l”

DenyFilter *.*/

Use this to jail all users in their homes

DefaultRoot ~

Users require a valid shell listed in /etc/shells to login.

Use this directive to release that constrain.

RequireValidShell off

Port 21 is the standard FTP port.

Port 21

In some cases you have to specify passive ports range to by-pass

firewall limitations. Ephemeral ports can be used for that, but

feel free to use a more narrow range.

PassivePorts 49152 65534

If your host was NATted, this option is useful in order to

allow passive tranfers to work. You have to use your public

address and opening the passive ports used on your firewall as well.

MasqueradeAddress 1.2.3.4

This is useful for masquerading address with dynamic IPs:

refresh any configured MasqueradeAddress directives every 8 hours

# DynMasqRefresh 28800

To prevent DoS attacks, set the maximum number of child processes

to 30. If you need to allow more than 30 concurrent connections

at once, simply increase this value. Note that this ONLY works

in standalone mode, in inetd mode you should use an inetd server

that allows you to limit maximum number of processes per service

(such as xinetd)

MaxInstances 30

Set the user and group that the server normally runs at.

User proftpd
Group nogroup

Umask 022 is a good standard umask to prevent new files and dirs

(second parm) from being group and world writable.

Umask 022 022

Normally, we want files to be overwriteable.

AllowOverwrite on

Uncomment this if you are using NIS or LDAP via NSS to retrieve passwords:

PersistentPasswd off

This is required to use both PAM-based authentication and local passwords

#AuthOrder mod_ldap.c mod_auth_pam.c* mod_auth_unix.c

Be warned: use of this directive impacts CPU average load!

Uncomment this if you like to see progress and transfer rate with ftpwho

in downloads. That is not needed for uploads rates.

UseSendFile off

TransferLog /var/log/proftpd/xferlog
SystemLog /var/log/proftpd/proftpd.log

QuotaEngine off Ratios off

Delay engine reduces impact of the so-called Timing Attack described in

http://security.lss.hr/index.php?page=details&ID=LSS-2004-10-02

It is on by default.

DelayEngine on ControlsEngine off ControlsMaxClients 2 ControlsLog /var/log/proftpd/controls.log ControlsInterval 5 ControlsSocket /var/run/proftpd/proftpd.sock AdminControlsEngine off

Alternative authentication frameworks

Include /etc/proftpd/ldap.conf
#Include /etc/proftpd/sql.conf[/code]
Le NSS arrive bien à trouver les user LDAP (ici Damien & Guillaume) Mais ya le * qui me gène…

debian:/etc/proftpd# getent passwd root:x:0:0:root:/root:/bin/bash ... openldap:x:104:106:OpenLDAP Server Account,,,:/var/lib/ldap:/bin/false proftpd:x:105:65534::/var/run/proftpd:/bin/false ftp:x:106:65534::/home/ftp:/bin/false guillaume:*:1000:1000:Guillaume FAMILLE:/home/guillaume: damien:*:1000:1000:Damien FAMILLE:/home/damien:
Si je fais un ldapsearch, je trouve bien mon user (mais proftpd y arrive pas (voir après))

debian:/etc/proftpd# ldapsearch -x -b "dc=domaine,dc=eu" -H ldap://88.191.35.131:389 -D "cn=admin,dc=domaine,dc=eu" -W -LLL "(&(uid=damien)(objectclass=posixAccount))" Enter LDAP Password: dn: cn=Damien,ou=people,dc=domaine,dc=eu objectClass: inetOrgPerson objectClass: top objectClass: posixAccount sn: FAMILLE cn: Damien FAMILLE gidNumber: 1000 homeDirectory: /home/damien uidNumber: 1000 givenName: damien uid: damien userPassword:: ZGFtaWVu
Voici la log debug de proftpd… Où on voit bien qu’il ne trouve pas la fiche mais pkoi… mystère…

[code]debian:/etc/proftpd# proftpd -nd12