Would it be worth installing a DS just for FTP server ? May be not,
do we have any other alternative. yes, if it's Windows 2003 R2 which comes with Identity mgmt for unix, So configuring that on Windows and configuring RFC2307 attributes in /etc/ldap.conf with other biddn parameters should be enough for Linux system to authenticate to AD using LDAP either using Kerberos as authentication or LDAP again as authentication. Or Installing MS-SFU on Windows and and enabling SFU attributes should be enough on Linux clients, i guess. Adding more tools is opening more gates ... Yep, but FDS unlike other Directory Servers is not so complicated. Atleast installing and configuring On Linux(ubuntu, Fedora, Suse, RHEL) is fairly easy. Regards Niranjan Prasad --- On Thu, 7/17/08, Prasad Emanuel <[EMAIL PROTECTED]> wrote: From: Prasad Emanuel <[EMAIL PROTECTED]> Subject: Re: [TwinCLinG] VSFTPD+Open LDAP To: [email protected] Date: Thursday, July 17, 2008, 7:51 PM Would it be worth installing a DS just for FTP server ? do we have any other alternative. Adding more tools is opening more gates ... Prasad --- On Wed, 7/16/08, Ashok <[EMAIL PROTECTED] com> wrote: From: Ashok <[EMAIL PROTECTED] com> Subject: Re: [TwinCLinG] VSFTPD+Open LDAP To: [EMAIL PROTECTED] .com Date: Wednesday, July 16, 2008, 5:44 AM hi i agree with prasad on the solution of vsftpd + pam+ openldap if you find openldap to be little difficult, you can try using Fedora Directory Server which is free to download and has a lot of features like multi master replicaiton, easy replication, policies etc. more on this http://directory. fedoraproject. org The issue with winbind is, If you use stale winbind, then it's cache is not good at all, as there are chances of cache getting corrupted and uid and gid's getting lost etc. so again to overcome this , u need to use rid backend , i don't think it's a good option at all. So vsftpd + pam + openldap/ directory server would be an ideal situation. Regards Niranjan --- On Wed, 7/16/08, Prasad Emanuel <[EMAIL PROTECTED] com> wrote: From: Prasad Emanuel <[EMAIL PROTECTED] com> Subject: Re: [TwinCLinG] VSFTPD+Open LDAP To: [EMAIL PROTECTED] .com Date: Wednesday, July 16, 2008, 3:48 PM I dont think winbind is a good idea... What I understand is FTP users requiers a userid , groupid and home-directory you have to look out for a way by which you can do a AD user login into the FTP server without modifying any options on the AD. the drawback with winbind or Kerberose is it requires a uid, gid and hd , and also it needs a user to be conigured as a Posix account on the AD. if windows is installed already then it is no use as windows AD should have been configured with a support to lower version. I think the best would be vsftpd user + pam + openldap client = AD if you could get this running or a solution similar to this , then there is nothing like it. -- not sure just a thought or else they could be some other way. Prasad --- On Tue, 7/15/08, Ashok <[EMAIL PROTECTED] com> wrote: From: Ashok <[EMAIL PROTECTED] com> Subject: Re: [TwinCLinG] VSFTPD+Open LDAP To: [EMAIL PROTECTED] .com Date: Tuesday, July 15, 2008, 6:56 AM I would not suggest winbind, as winbind's cache is not so consistent, again you have to use rid or ldap backend, to have a good scalable backend though i guess , we have tdb backend also, but the winbind procedure, is to join the RHEL system on which you want to run ftp server is pretty straight forward. Since i am not aware of which distribution you have, but if you are using fedora, rhel5, centos or some thing like that then run 1. authconfig-tui (text mode) 2. specify Winbind as your User and authentication 3. Specify REALM (which is DOMAIN in CAPS), AD server ip address and AD server's hostname, 4. Run command "net ads join -U administrator" sorry for small howto, but if you go through samba.org , you should find a good documentation on this, and also it is pretty straight forward. if you are using SUSE, then you have nice gui tools , not sure what's the name, but it's pretty straight forward. Regards Niranjan --- On Mon, 7/14/08, G.David Manohar <david_manohar@ yahoo.com> wrote: From: G.David Manohar <david_manohar@ yahoo.com> Subject: Re: [TwinCLinG] VSFTPD+Open LDAP To: [EMAIL PROTECTED] .com Date: Monday, July 14, 2008, 7:17 PM Hi Niranjan, I am working on similar lines... could you please update me w.r.t winbind also... As the AD users are already created, I would not be able to do any changes to those accounts... Regards, David --- In [EMAIL PROTECTED] .com, Ashok <[EMAIL PROTECTED] ..> wrote: > > Hi David, > > I want to know, if you want , How to configure Vsftpd to authenticate using AD users / Or OpenLDAP, > > Can you clarify more. > > Configuring vsftpd with OpenLDAP , is configuring the vsftpd system to authenticate to LDAP server, and nothing to do with vsftpd, as vsftp will call pam > and appropriate LDAP libararies will be called. > > So configure an LDAP Server, using OpenLDAP, You will find a lot of howto's on that in google. > > Here is a few > http://kbase. redhat.com/ faq/FAQ_91_ 11441.shtm > > So once system is configured to authenticate OpenLDAP, vsftpd can use PAM to get LDAP user. > > > If you want Vsftpd to authenticate using AD user. For that, vsftpd server should authenticate to AD using LDAP and kerberos (is one option) or you use Winbind as another option. Using LDAP and kerberos to Authenticate to Windows AD is better option. > > Regards > Niranjan > > --- On Fri, 7/11/08, G.David Manohar <david_manohar@ ...> wrote: > From: G.David Manohar <david_manohar@ ...> > Subject: [TwinCLinG] VSFTPD+Open LDAP > To: [EMAIL PROTECTED] .com > Date: Friday, July 11, 2008, 11:36 AM > > > > > > > > > > > > Hi, > > > > Can someone please help me configuring VSFTPD with OPEN-LDAP to access > > active directory. > > > > Thanks in advance... > > > > David > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > [Non-text portions of this message have been removed] > [Non-text portions of this message have been removed] [Non-text portions of this message have been removed] [Non-text portions of this message have been removed] [Non-text portions of this message have been removed] [Non-text portions of this message have been removed]
