[Proftpd-user] PAM authentication failing with FreeIPA

Hi,

 

I'm trying to set up user authentication for a virtual host and PAM
authentication fails every time. The virtual host, gust, has a different DNS
and certificate than the actual server, downdraft. The server in question is
running on Rocky 8.5 and the ProFTPD version is Version 1.3.6e.  Our
organization uses a FreeIPA server for authentication. We can ssh into the
server without any trouble. The trace log for auth.pam shows:

 

2022-06-14 15:47:55,027 [1576939] <auth.pam:17>: initializing PAM handle

2022-06-14 15:47:55,027 [1576939] <auth.pam:9>: setting PAM_RUSER to
'bcarroll'

2022-06-14 15:47:55,027 [1576939] <auth.pam:9>: setting PAM_RHOST to
ip<my_ip>.ok.ok.cox.net'

2022-06-14 15:47:55,027 [1576939] <auth.pam:9>: setting PAM_TTY to
'/dev/ftpd1576939'

2022-06-14 15:47:55,030 [1576939] <auth.pam:1>: authentication error (7) for
user 'bcarroll': Authentication failure

2022-06-14 15:47:55,030 [1576939] <auth.pam:17>: freeing PAM handle

 

And the audit log shows this:

 

type=USER_AUTH msg=audit(1655239675.029:4401496): pid=1576939 uid=0
auid=1000 ses=106 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
msg='op=PAM:authentication grantors=? acct="bcarroll"
exe="/usr/sbin/proftpd" hostname=<my_ip>.ok.ok.cox.net addr=<my_ip>
terminal=/dev/ftpd1576939 res=failed'UID="root" AUID="<my_admin_user>"

 

Notice the grantors is missing.

 

The log shows:

 

2022-06-14 16:07:48,810 downdraft.caps.int proftpd[1577649] gust.capsint
(ip<my_IP>.ok.ok.cox.net[<my_IP>]): retrieved UID 1228 for user 'bcarroll'

2022-06-14 16:07:48,815 downdraft.caps.int proftpd[1577649] gust.capsint
(ip<my_IP>.ok.ok.cox.net[<my_IP>]): retrieved group IDs: 500, 490, 508,
1196000000

2022-06-14 16:07:48,815 downdraft.caps.int proftpd[1577649] gust.capsint
(ip<my_IP>.ok.ok.cox.net[<my_IP>]): retrieved group names: admin, www,
admins

2022-06-14 16:07:48,815 downdraft.caps.int proftpd[1577649] gust.capsint
(ip<my_IP>.ok.ok.cox.net[<my_IP>]): ROOT PRIVS at mod_auth_pam.c:348

2022-06-14 16:07:48,819 downdraft.caps.int proftpd[1577649] gust.capsint
(ip<my_IP>.ok.ok.cox.net[<my_IP>]): RELINQUISH PRIVS at mod_auth_pam.c:582

2022-06-14 16:07:48,819 downdraft.caps.int proftpd[1577649] gust.capsint
(ip<my_IP>.ok.ok.cox.net[<my_IP>]): ROOT PRIVS at mod_auth_unix.c:497

2022-06-14 16:07:48,819 downdraft.caps.int proftpd[1577649] gust.capsint
(ip<my_IP>.ok.ok.cox.net[<my_IP>]): mod_auth_unix: getspnam(3) for user
'bcarroll' error: Success

2022-06-14 16:07:48,819 downdraft.caps.int proftpd[1577649] gust.capsint
(ip<my_IP>.ok.ok.cox.net[<my_IP>]): RELINQUISH PRIVS at mod_auth_unix.c:589

2022-06-14 16:07:48,819 downdraft.caps.int proftpd[1577649] gust.capsint
(ip<my_IP>.ok.ok.cox.net[<my_IP>]): USER bcarroll (Login failed): No such
user found

 

So it appears to be getting the UID and GID's from the server just fine. 

 

The proftpd.conf is:

 

ServerName              "<our organization>"

ServerIdent             off

ServerType              standalone

DefaultServer           on

 

SyslogFacility          LOCAL2

SyslogLevel             debug

 

TraceLog /var/log/proftpd/trace.log

Trace auth.pam:20

 

Port                            21

 

Umask                           022

MaxInstances                    30

User                            nobody

Group                           nobody

 

IdentLookups            off

 

TimeoutIdle             1800

TimeoutLogin            300

TimeoutNoTransfer       300

TimeoutSession          0

TimeoutStalled          3600

 

<Directory />

  AllowOverwrite                off

</Directory>

 

<Limit SITE_CHMOD>

  DenyAll

</Limit>

 

<Limit LOGIN>

  DenyAll

</Limit>

 

<Global>

    AllowOverwrite          off

    IdentLookups            off

    MaxClients              20

</Global>

 

# gust

<VirtualHost 172.29.29.31>

TLSEngine on

TLSRSACertificateFile /etc/letsencrypt/live/<virtual_url>/fullchain.pem

TLSRSACertificateKeyFile /etc/letsencrypt/live/<virtual_url>/privkey.pem

TLSProtocol TLSv1.2

# require encrytion for control and data channels

TLSRequired on

TLSLog /var/log/proftpd/tls.log

 

RequireValidShell off

AuthPAM on

    <Directory /var/www/html/reu>

        AllowOverwrite on

 

        <Limit LOGIN>

            AllowUser amarmo

            AllowUser dladue

            AllowUser bcarroll

            DenyAll

        </Limit>

 

        <Limit ALL>

            AllowAll

        </Limit>

    </Directory>

</VirtualHost>

 

(Rest of the file not relevant)

 

I also tried many different configurations for the /etc/pam.d/proftpd file.
However, now I'm back to the original:

 

#%PAM-1.0

session    optional     pam_keyinit.so force revoke

auth       required     pam_listfile.so item=user sense=deny
file=/etc/ftpusers onerr=succeed

auth       required     pam_shells.so

auth       include      password-auth

account    include      password-auth

session    required     pam_loginuid.so

session    include      password-auth

 

The FreeIPA policy is set to allow any service. 

 

So I'm not sure how to debug from here. Any help is appreciated.

 

Thank you,

Bryan Carroll

_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html