Re: [Proftpd-user] Authentication with mod_sftp via PAM + SSSD not work with error "(Login failed): No such user found" if -DTLS enable

Il giorno mer, 05/07/2023 alle 17.42 -0700, TJ Saunders ha scritto:
> Would you be able to provide the full ProFTPD config (including
> Include files), so that we can see what might be involved?

This is[1] the configuration file that i generated by including all
includes and used through this command:

sudo /usr/sbin/proftpd --nodaemon -c/etc/proftpd/proftpd-sftp.conf -d10 -DTLS

Or without TLS:

sudo /usr/sbin/proftpd --nodaemon -c/etc/proftpd/proftpd-sftp.conf -d10

Note: if I set "SFTPAuthMethods publickey" also AD users can connect,
but the 3 VRootAlias configured is not showing

Many thanks for your reply

Dario 

[1]
sudo cat /etc/proftpd/proftpd-sftp.conf
#Include /etc/proftpd/modules.conf
ModuleControlsACLs              insmod,rmmod allow user root
ModuleControlsACLs              lsmod allow user *
LoadModule mod_ctrls_admin.c
LoadModule mod_vroot.c
<IfDefine DYNAMIC_BAN_LISTS>
  LoadModule                    mod_ban.c
</IfDefine>
<IfDefine QOS>
  LoadModule                    mod_qos.c
</IfDefine>

ServerName			"ProFTPD server"
ServerIdent			on "S-FTP Server ready."
ServerAdmin			root@localhost
DefaultServer			on
DefaultRoot			~ !adm
AuthPAMConfig			proftpd
AuthOrder			mod_auth_pam.c* mod_auth_unix.c
UseReverseDNS			off
User				nobody
Group				nobody
MaxInstances			20
UseSendfile			off
LogFormat			default	"%h %l %u %t \"%r\" %s %b"
LogFormat			auth	"%v [%P] %h %t \"%r\" %s"
LogOptions			-Timestamp -Hostname +RoleBasedProcessLabels
ControlsEngine			on
ControlsACLs			all allow user root
ControlsSocketACL		allow user *
ControlsLog			/var/log/proftpd/controls.log
<IfModule mod_ctrls_admin.c>
  AdminControlsEngine		on
  AdminControlsACLs		all allow user root
</IfModule>
<IfModule mod_vroot.c>
  VRootEngine			on
</IfModule>

<IfDefine TLS>
# Include /etc/proftpd/mod_tls.conf
<IfModule mod_tls.c>
  TLSEngine			on
  TLSRequired			on
  TLSRSACertificateFile         /etc/pki/tls/certs/cert.crt
  TLSRSACertificateKeyFile      /etc/pki/tls/certs/cert.key
  TLSCertificateChainFile       /etc/pki/tls/certs/Go_Daddy_Secure_Certificate_Authority_-_G2.crt
  TLSCipherSuite		PROFILE=SYSTEM
  # Relax the requirement that the SSL session be re-used for data transfers
  TLSOptions			NoSessionReuseRequired
  TLSLog			/var/log/proftpd/tls.log
  <IfModule mod_tls_shmcache.c>
    TLSSessionCache		shm:/file=/run/proftpd/sesscache
  </IfModule>
</IfModule>

</IfDefine>

<IfModule mod_ban.c>
# Include /etc/proftpd/mod_ban.conf
<IfModule mod_ban.c>
  BanEngine			on
  BanLog			/var/log/proftpd/ban.log
  BanTable			/run/proftpd/ban.tab
  # If the same client reaches the MaxLoginAttempts limit 2 times
  # within 10 minutes, automatically add a ban for that client that
  # will expire after one hour.
  BanOnEvent			MaxLoginAttempts 2/00:10:00 01:00:00
  # Inform the user that it's not worth persisting
  BanMessage			"Host %a has been banned"
  # Allow the FTP admin to manually add/remove bans
  BanControlsACLs		all allow user ftpadm
</IfModule>

</IfModule>
<IfModule mod_qos.c>
# Include /etc/proftpd/mod_qos.conf
<IfModule mod_qos.c>
  # RFC791 TOS parameter compatibility
  QoSOptions			dataqos throughput ctrlqos lowdelay
  # For a DSCP environment (may require tweaking)
  #QoSOptions			dataqos CS2 ctrlqos AF41
</IfModule>

</IfModule>
<Global>
  # Umask 022 is a good standard umask to prevent new dirs and files
  # from being group and world writable
  Umask				022
  # Allow users to overwrite files and change permissions
  AllowOverwrite		yes
  <Limit ALL SITE_CHMOD>
    AllowAll
  </Limit>
</Global>

<IfDefine ANONYMOUS_FTP>
# Include /etc/proftpd/anonftp.conf
<Anonymous ~ftp>
  User			ftp
  Group			ftp
  AccessGrantMsg	"Anonymous login ok, restrictions apply."
  # We want clients to be able to login with "anonymous" as well as "ftp"
  UserAlias		anonymous ftp
  # Limit the maximum number of anonymous logins
  MaxClients		10 "Sorry, max %m users -- try again later"
  # Put the user into /pub right after login
  #DefaultChdir		/pub
  # We want 'welcome.msg' displayed at login, '.message' displayed in
  # each newly chdired directory and tell users to read README* files.
  DisplayLogin		/welcome.msg
  DisplayChdir		.message
  DisplayReadme		README*
  # Cosmetic option to make all files appear to be owned by user "ftp"
  DirFakeUser		on ftp
  DirFakeGroup		on ftp
  # Limit WRITE everywhere in the anonymous chroot
  <Limit WRITE SITE_CHMOD>
    DenyAll
  </Limit>
  # An upload directory that allows storing files but not retrieving
  # or creating directories.
  #
  # Directory specification is slightly different if mod_vroot is in
  # use: see http://sourceforge.net/p/proftp/mailman/message/31728570/
  #          https://bugzilla.redhat.com/show_bug.cgi?id=1045922
  <IfModule mod_vroot.c>
    <Directory /uploads/*>
      AllowOverwrite		no
      <Limit READ>
        DenyAll
      </Limit>
      <Limit STOR>
        AllowAll
      </Limit>
    </Directory>
  </IfModule>
  <IfModule !mod_vroot.c>
    <Directory uploads/*>
      AllowOverwrite		no
      <Limit READ>
        DenyAll
      </Limit>
      <Limit STOR>
        AllowAll
      </Limit>
    </Directory>
  </IfModule>
  # Don't write anonymous accesses to the system wtmp file (good idea!)
  WtmpLog			off
  # Logging for the anonymous transfers
  ExtendedLog			/var/log/proftpd/access.log WRITE,READ default
  ExtendedLog			/var/log/proftpd/auth.log AUTH auth
</Anonymous>
</IfDefine>

# Include /etc/proftpd/conf.d/*.conf
LoadModule mod_ifsession.c
<Global>
  <Limit LOGIN>
    # AllowUser ftptest
    AllowGroup ftpusers
    AllowGroup ftpgroup
    AllowGroup [email protected]
    DenyAll
  </Limit>
  <Limit ALL SITE_CHMOD>
    AllowAll
  </Limit>
    <IfModule mod_vroot.c>
        VRootEngine on
        DefaultRoot ~
	<IfGroup !ftpnovroot>
		VRootAlias /ftp/public   ~/public
		VRootAlias /ftp/users    ~/users
		VRootAlias /ftp/external ~/external
	</IfGroup>
    </IfModule>
</Global>
<IfModule mod_delay.c>
	DelayEngine off
</IfModule>
ExtendedLog                     /var/log/proftpd/access.log WRITE,READ default
ExtendedLog                     /var/log/proftpd/auth.log AUTH auth
ExtendedLog                     /var/log/proftpd/full.log ALL default
IdentLookups off
PassivePorts 60000 65000
LoadModule mod_sftp.c
LoadModule mod_sftp_pam.c
<VirtualHost 10.11.1.248>
	# http://www.proftpd.org/docs/contrib/mod_sftp.html
	SFTPEngine ON
	# TLSEngine off
	# TLSRequired off
	Port 22002
	SFTPHostKey /etc/proftpd/ssh_host_dsa_key
	SFTPHostKey /etc/proftpd/ssh_host_rsa_key
	SFTPAuthorizedUserKeys file:~/.sftp/authorized_keys
	SFTPLog /var/log/proftpd/sftp.log
	SFTPCompression delayed
	DefaultRoot ~
	SFTPAuthMethods password
	# SFTPAuthMethods publickey
	# SFTPAuthMethods publickey password
</VirtualHost>



_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html