☰

proftpd.conf

tag-icon • tag-icon ftp ldap proftpd
proftpd.conf

我正在尝试在 Active Directory 基础上进行 ProFTPD 到 LDAP 身份验证。我仍然无法弄清楚我的配置可能出了什么问题，因为执行 LDAP 查询ldapsearch似乎没问题

proftpd.conf

/etc/proftpd.conf

# This is the ProFTPD configuration file
ServerName                      "FTP and Ldap"
ServerType                      standalone
ServerAdmin                     [email protected]
AuthOrder                       mod_ldap.c
LoadModule                      mod_ldap.c
DefaultServer                   on
ShowSymlinks                    on
RootLogin                       off
UseIPv6                         off
AllowLogSymlinks                on
IdentLookups                    off
UseReverseDNS                   off
Umask                           077
User                            ftp
Group                           ftp
DefaultRoot                     /home/ftp/%u/
DefaultChDir                    ftp
RequireValidShell               off
UseFtpUsers                     off
SystemLog                       /var/log/proftpd/proftpd.log
TransferLog                     /var/log/proftpd/xferlog
DefaultTransferMode             binary

<IfModule mod_ldap.c>
        LDAPServer                      domaincontroller.domain.net
        LDAPAttr                        uid sAMAccountName
        LDAPDNInfo                      cn=linux.ldap,ou=users,ou=resources,dc=domain,dc=net password
        LDAPAuthBinds                   on
        LDAPDoAuth                      on "dc=domain,dc=net" (&(sAMAccountName=%v)(objectclass=User))
        LDAPQueryTimeout                15

        LDAPGenerateHomedir             on
        LDAPGenerateHomedirPrefix       /home/ftp

        #uid e guid of the local global user
        LDAPDefaultUID                  14
        LDAPDefaultGID                  50
        LDAPForceDefaultUID             on
        LDAPForceDefaultGID             on
</IfModule>

<Directory /*>
        AllowOverwrite                  on
</Directory>

proftpd -nd10 ->“搜索失败”

以调试级别 10 运行 proftpd 在使用我的用户 ( nicolas) 进行身份验证时得到了这些日志：

proftpd -nd10


dispatching CMD command 'PASS (hidden)' to mod_auth
mod_ldap/2.8.22: generated filter dc=domain,dc=net from template dc=domain,dc=net and value nicolas
mod_ldap/2.8.22: generated filter (&(sAMAccountName=nicolas)(objectclass=User)) from template (&(sAMAccountName=%v)(objectclass=User)) and value nicolas
mod_ldap/2.8.22: attempting connection to ldap://domaincontroller.domain.net/
mod_ldap/2.8.22: set protocol version to 3
mod_ldap/2.8.22: connected to ldap://domaincontroller.domain.net/
mod_ldap/2.8.22: successfully bound as cn=linux.ldap,ou=users,ou=resources,dc=domain,dc=net password
mod_ldap/2.8.22: set dereferencing to 0
mod_ldap/2.8.22: set query timeout to 15s
mod_ldap/2.8.22: pr_ldap_search(): LDAP search failed: Operations error

LDAP搜索工作

但ldapsearch另一方面，效果也很好：

[root@ftp2 ~]# ldapsearch -x -W -D "cn=linux.ldap,ou=users,ou=resources,dc=domain,dc=net" -h domaincontroller.domain.net -b "dc=domain,dc=net" -LLL "(SAMAccountName=nicolas)"
Enter LDAP Password: 

dn: CN=Nicolas XXXXXXX,OU=XXXXXXX,OU=XXXXXXX,OU=XXXXXXX,DC=XXXXXXX,DC=XXXXXXX
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Nicolas XXXXXXX
sn: XXXXXXX
description:XXXXXXX
givenName: XXXXXXX
distinguishedName:

有什么线索吗？

答案1

要实现此目的，URL 必须是RFC 2255兼容，并且使用 Proftpd 查询仅在按 OU 过滤时才有效。这些查询在 LDAP 根级别不起作用。

LDAPServer ldap://domaincontroller.domain.net:389/??sub

组织团结：

LDAPDoAuth on "OU=OFFICE,dc=domain,dc=net" (&(sAMAccountName=%v)(objectclass=User))

目录内的 Umask。限制只是为了安全

<Directory />
Umask 022 022
AllowOverwrite on
        <Limit MKD XMKD CDUP XCUP CWD XCWD RMD XRMD>
        DenyAll
        </Limit>
</Directory>

相关内容