On 11/03/2013 02:12 AM, Fred van Zwieten wrote:
> Hi there,
> I have a question. We have a vsftpd service running which
> authenticates it's virtual users against an application level openldap
> database. No IPA involved here. It works using pam_ldap. The virtual
> users are mapped to a local user thru the "guest_user=<user>"
> directive in vsftpd.conf. As the vsftpd service is running on a IPA
> client (RHEL6), I was kind of hoping this "local user" would in fact
> be a IPA user. Nope. He must currently live in /etc/passwd. This is, I
> suspect, because we have a different pam file for vsftpd to be able to
> communicate with the application openldap, making it impossible to
> also use IPA.
> I there a way to have the vsftpd check (and use) with IPA for it's
> local users and the application level openldap service for it's
> virtual users?
> This is the pam file vsftpd came with originally:
> session optional pam_keyinit.so force revoke
> auth requiredpam_listfile.so item=user sense=deny
> file=/etc/vsftpd/ftpusers onerr=succeed
> auth requiredpam_shells.so
> auth includepassword-auth
> account includepassword-auth
> session required pam_loginuid.so
> session includepassword-auth
> And this is the pam file we now use:
> session required /lib64/security/pam_ldap.so
> password required /lib64/security/pam_ldap.so
> Thanks for any answer.
> Freeipa-users mailing list
If you configure SSSD with 2 domains one IPA another LDAP and then tell
vsftpd to use pam_sss in pam stack instead of the pam_ldap you will be
able to authenticate users coming from both sources.
Effectively you need to take your pam_ldap configuration translate it
into sssd.conf settings for the second domain (do not touch the one that
you already have, just add another one) and then switch the pam config
for vsftpd. This should result in what you are looking for.
Sr. Engineering Manager for IdM portfolio
Red Hat Inc.
Looking to carve out IT costs?
Freeipa-users mailing list