RE: directory based LDAP authentication?

You need to  extend the RFC2307 schema to create the posix group and
posix account for the user. With which you can expect the user access
rights to be checked on Linux file system only posix way, that is uid,
gid based access check. 

See if this helps:
http://www.novell.com/coolsolutions/appnote/14511.html 

Or do you want the access permissions to work on Linux similar to
Novell specific NCP access check?

-Madhavi
 

>>> "Arthur DiSegna" <[email protected]> 1/24/2006 1:05:10 am
>>>

When you type "Which means that it uses the UID & GID numbers
retrieved
via LDAP, for deciding access rights for users. These are set on the
FTP
server for the user." 

Does this mean I will have to have accounts on the FTP server to
coincide with UID & GID numbers retreived from LDAP? The Directory has
75,000 user objects.

Thanks

-----Original Message-----
From: Rajat Upadhyaya [mailto:[email protected]] 
Sent: Monday, January 23, 2006 12:40 AM
To: [email protected] 
Subject: Re: [pureftpd] directory based LDAP authentication?


>>> "Arthur DiSegna" <[email protected]> 1/21/2006 7:20 pm >>>

>>> Once logged in they're allowed to all directories on the ftp
server
unless I use local permissions to prevent 
>>>it. What I need is to have the user authenticate when logging in to
the FTP server as well as the FTP server >>>check their group
membership
when trying to access folders.
>>>Will pureftpd do this?

AFAIK, yes. Pure-FTPd not only authenticates a user, using the
directory
over LDAP, but also performs the authorization process using the same
backend. Which means that it uses the UID & GID numbers retrieved via
LDAP, for deciding access rights for users. These are set on the FTP
server for the user. Once these are set, the file system takes care of
checking the rights.

Form what you say in the mail, I presume you are using eDirectory. In
that case, I am not very sure that the authentication part will work
properly. From the code, I can tell that this is because Pure-FTPd
tries
to retrieve the user's hashed password via LDAP, but eDirectory does
not
permit this for security reasons. So the authentication will probably
fail. The authorization part will work properly, but will not succeed
owing to the failure of authentication. I suppose you will need to try
this out further.

Regards,
Rajat
 



---------------------------------------------------------------------
To post a new message, e-mail: [email protected] To unsubscribe,
e-mail:
[email protected] For additional commands, e-mail:
[email protected] 



---------------------------------------------------------------------
To post a new message, e-mail: [email protected] 
To unsubscribe, e-mail: [email protected] 
For additional commands, e-mail: [email protected] 


---------------------------------------------------------------------
To post a new message, e-mail: [email protected]
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]