On 11/03/2013 02:12 AM, Fred van Zwieten wrote: > Hi there, > > I have a question. We have a vsftpd service running which > authenticates it's virtual users against an application level openldap > database. No IPA involved here. It works using pam_ldap. The virtual > users are mapped to a local user thru the "guest_user=<user>" > directive in vsftpd.conf. As the vsftpd service is running on a IPA > client (RHEL6), I was kind of hoping this "local user" would in fact > be a IPA user. Nope. He must currently live in /etc/passwd. This is, I > suspect, because we have a different pam file for vsftpd to be able to > communicate with the application openldap, making it impossible to > also use IPA. > > I there a way to have the vsftpd check (and use) with IPA for it's > local users and the application level openldap service for it's > virtual users? > > This is the pam file vsftpd came with originally: > > #%PAM-1.0 > session optional pam_keyinit.so force revoke > auth requiredpam_listfile.so item=user sense=deny > file=/etc/vsftpd/ftpusers onerr=succeed > auth requiredpam_shells.so > auth includepassword-auth > account includepassword-auth > session required pam_loginuid.so > session includepassword-auth > > > And this is the pam file we now use: > > #%PAM-1.0 > authrequired/lib64/security/pam_ldap.so > accountrequired/lib64/security/pam_ldap.so > session required /lib64/security/pam_ldap.so > password required /lib64/security/pam_ldap.so > > Thanks for any answer. > > Cheers, > > Fred > > > > _______________________________________________ > Freeipa-users mailing list > Freeipa-users@redhat.com > https://www.redhat.com/mailman/listinfo/freeipa-users If you configure SSSD with 2 domains one IPA another LDAP and then tell vsftpd to use pam_sss in pam stack instead of the pam_ldap you will be able to authenticate users coming from both sources. Effectively you need to take your pam_ldap configuration translate it into sssd.conf settings for the second domain (do not touch the one that you already have, just add another one) and then switch the pam config for vsftpd. This should result in what you are looking for.
-- Thank you, Dmitri Pal Sr. Engineering Manager for IdM portfolio Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/
_______________________________________________ Freeipa-users mailing list Freeipa-users@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-users