Re: [Proftpd-user] MySQL Authentication doesn't work on ProFTPD 1.3.8

> On proftpd.conf , changing this part "solved" the problem.
>
> AuthOrder mod_auth_pam.c* mod_auth_unix.c mod_sql.c -> AuthOrder 
> mod_sql.c mod_auth_unix.c

This works because the previous configuration of:

  AuthOrder mod_auth_pam.c* mod_auth_unix.c mod_sql.c

says: "Try each of these modules for authenticating the user.  But whatever mod_auth_pam.c says goes, be it 'success' or 'failure'."

The PAM API provides a "yes/no" answer for authentication; it doesn't provide all of the other user information (like UID/GID, home directory, etc) that ProFTPD needs.  This means that the mod_auth_pam.c module _by itself_ is not enough for ProFTPD to authenticate a user; other modules (like mod_auth_unix.c, mod_auth_file,c, mod_sql.c etc) are needed _as well_.

Since your users are defined in a SQL database, your PAM configuration probably does not know about that SQL database.  So mod_sql.c will say "yes, I found the user here" -- but mod_auth_pam.c will say "failed; I don't know about this user", and since mod_auth_pam.c is authoritative (that's what the "*" suffix in your configuration says), it's "failure" answer means authentication fails.

By removing "mod_auth_pam.c*" from your configuration (which is a good practice to do, by the way, when your user info is in SQL databases, or any other data store not known to PAM modules), you allow mod_sql.c's "yes, I found the user here" answer to be honored, and authentication thus succeeds.

Hope this helps,
TJ


_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html