proftpd + ldap

0

1

Всем привет!
Поискал по форуму, нашёл подобную проблему, но там посоветовали nss и pam использовать, я же всё таки хочу решить проблему без использование ещё чего-либо, если это возможно.

Лог proftpd:

ProFTPD 1.3.3a (maint) (built Sun Nov 13 2011 23:08:14 UTC) standalone mode STARTUP
FTP session opened.
dispatching PRE_CMD command 'USER anton' to mod_core
dispatching PRE_CMD command 'USER anton' to mod_core
dispatching PRE_CMD command 'USER anton' to mod_delay
dispatching PRE_CMD command 'USER anton' to mod_auth
mod_ldap/2.8.22: not unbinding to an already unbound connection.
mod_ldap/2.8.22: not unbinding to an already unbound connection.
dispatching CMD command 'USER anton' to mod_auth
dispatching POST_CMD command 'USER anton' to mod_delay
dispatching LOG_CMD command 'USER anton' to mod_log
dispatching PRE_CMD command 'PASS (hidden)' to mod_core
dispatching PRE_CMD command 'PASS (hidden)' to mod_core
dispatching PRE_CMD command 'PASS (hidden)' to mod_delay
dispatching PRE_CMD command 'PASS (hidden)' to mod_auth
mod_ldap/2.8.22: not unbinding to an already unbound connection.
mod_ldap/2.8.22: not unbinding to an already unbound connection.
dispatching CMD command 'PASS (hidden)' to mod_auth
mod_ldap/2.8.22: generated filter ou=people,dc=example,dc=ru from template ou=people,dc=example,dc=ru and value anton
mod_ldap/2.8.22: generated filter (&(uid=anton)(objectClass=person)) from template (&(uid=%v)(objectClass=person)) and value anton
mod_ldap/2.8.22: WARNING: LDAP URL search scopes default to 'base' (not 'sub') and may not be what you want.
mod_ldap/2.8.22: attempting connection to ldap://localhost
mod_ldap/2.8.22: set protocol version to 3
mod_ldap/2.8.22: connected to ldap://localhost
mod_ldap/2.8.22: successfully bound as cn=admin,dc=example,dc=ru with password МОЙ_ПАРОЛЬ
mod_ldap/2.8.22: set dereferencing to 0
mod_ldap/2.8.22: set query timeout to 5s
mod_ldap/2.8.22: searched under base DN ou=people,dc=example,dc=ru using filter (&(uid=anton)(objectClass=person))
mod_ldap/2.8.22: no entries for filter (&(uid=anton)(objectClass=person)) under base DN ou=people,dc=example,dc=ru
USER anton: no such user found from %IP% [%IP%] to %IP%:21
dispatching POST_CMD_ERR command 'PASS (hidden)' to mod_delay
dispatching LOG_CMD_ERR command 'PASS (hidden)' to mod_log
dispatching LOG_CMD_ERR command 'PASS (hidden)' to mod_auth
mod_ldap/2.8.22: successfully unbound
mod_ldap/2.8.22: not unbinding to an already unbound connection.
FTP session closed.

Ищем вручную:
ldapsearch -x -b «ou=people,dc=example,dc=ru» "(&(uid=anton)(objectClass=person))"

Находим:

dn: cn=anton,ou=people,dc=example,dc=ru
objectClass: top
objectClass: person
objectClass: inetOrgPerson
cn: anton
uid: anton
sn: Anton Totsky

В очередной раз заранее спасибо за помощь :)
Если подобная проблема уже решалась ранее - пните в поиск по форуму, буду исктаь лучше и дольше!

Ссылка

←	Remserial и права к нему

работа с device-mapper

→

Блджад, ты логи то читать умеешь?

WARNING: LDAP URL search scopes default to 'base' (not 'sub') and may not be what you want.

man ldapsearch на предмет search scope base/one/sub (подсказка - у тебя должно быть sub или как минимум one).

~~no-dashi~~ ★★★★★
(22.05.12 20:45:05 MSK)

Охтыжблин. Посмотрел на ник, понял что с вопросом про логи угадал

~~no-dashi~~ ★★★★★
(22.05.12 20:46:25 MSK)

Ответ на: комментарий от no-dashi 22.05.12 20:46:25 MSK

удобный ник, все смиряются %)

я обратил внимание на этот варнинг, но почему-то думал, что sub нужно указывать в том случае, если будешь лазить по всему дереву, помимо указанного DN.

Спасибо, сейчас попробую!

no_Bra1n
(22.05.12 23:25:12 MSK) автор топика

Ссылка

Ответ на: комментарий от no-dashi 22.05.12 20:45:05 MSK

Поправил конфиг proftpd.conf

LDAPServer "ldap://localhost/??sub"
LDAPSearchScope sub
LDAPDNInfo "cn=admin,dc=example,dc=ru" МОЙ_ПАРОЛЬ
LDAPDoAuth on "ou=people,dc=example,dc=ru" "(&(uid=%v)(objectClass=person))"
LDAPDefaultGID 106
LDAPDefaultUID 65534
LDAPForceDefaultGID off
LDAPForceDefaultUID off
LDAPGenerateHomedirPrefix on

Добавил нужных атрибутов в ldap-запись:

dn: cn=anton,ou=people,dc=example,dc=ru
objectClass: top
objectClass: person
objectClass: inetOrgPerson
objectClass: posixAccount
cn: anton
uid: anton
sn: Anton Totsky
uidNumber: 100
gidNumber: 100
homeDirectory: /mnt/home
loginShell: /bin/bash

Логинится нормально, но виснет на ретривинге, не может прочитать директорию.

drwxrwxrwx 10 www-data root      4096 Май 18 17:08 home

Логи:

Preparing to chroot to directory '/mnt/home'
ROOT PRIVS at auth.c:1356
RELINQUISH PRIVS at auth.c:1358
Environment successfully chroot()ed
ROOT PRIVS at mod_auth.c:1223
SETUP PRIVS at mod_auth.c:1235
in dir_check_full(): path = '/', fullpath = '/mnt/home/'.
dispatching POST_CMD command 'PASS (hidden)' to mod_cap
mod_cap/1.0: capabilities '= cap_net_bind_service,cap_audit_write+ep'
dispatching POST_CMD command 'PASS (hidden)' to mod_readme
dispatching POST_CMD command 'PASS (hidden)' to mod_delay
dispatching POST_CMD command 'PASS (hidden)' to mod_log
dispatching POST_CMD command 'PASS (hidden)' to mod_ls
dispatching POST_CMD command 'PASS (hidden)' to mod_auth
RELINQUISH PRIVS at mod_auth.c:1596
dispatching POST_CMD command 'PASS (hidden)' to mod_xfer
dispatching POST_CMD command 'PASS (hidden)' to mod_core
dispatching LOG_CMD command 'PASS (hidden)' to mod_log
dispatching LOG_CMD command 'PASS (hidden)' to mod_auth
USER anton: Login successful.
dispatching PRE_CMD command 'SYST' to mod_core
dispatching PRE_CMD command 'SYST' to mod_core
dispatching CMD command 'SYST' to mod_core
dispatching LOG_CMD command 'SYST' to mod_log
dispatching PRE_CMD command 'PWD' to mod_core
dispatching PRE_CMD command 'PWD' to mod_core
dispatching CMD command 'PWD' to mod_core
in dir_check_full(): path = '/', fullpath = '/mnt/home/'.
dispatching LOG_CMD command 'PWD' to mod_log
dispatching PRE_CMD command 'TYPE I' to mod_core
dispatching PRE_CMD command 'TYPE I' to mod_core
dispatching CMD command 'TYPE I' to mod_xfer
dispatching LOG_CMD command 'TYPE I' to mod_log
dispatching PRE_CMD command 'PASV' to mod_core
dispatching PRE_CMD command 'PASV' to mod_core
dispatching CMD command 'PASV' to mod_core
in dir_check_full(): path = '/', fullpath = '/mnt/home/'.
Entering Passive Mode (10,48,45,206,194,209).
dispatching LOG_CMD command 'PASV' to mod_log
dispatching PRE_CMD command 'CWD /' to mod_core
dispatching PRE_CMD command 'CWD /' to mod_core
dispatching CMD command 'CWD /' to mod_core
in dir_check_full(): path = '/', fullpath = '/mnt/home/'.
dispatching POST_CMD command 'CWD /' to mod_readme
dispatching LOG_CMD command 'CWD /' to mod_log
dispatching PRE_CMD command 'LIST' to mod_core
dispatching PRE_CMD command 'LIST' to mod_core
dispatching CMD command 'LIST' to mod_ls
mod_ldap/2.8.22: successfully unbound
mod_ldap/2.8.22: not unbinding to an already unbound connection.
FTP session closed.
mod_ldap/2.8.22: successfully unbound
mod_ldap/2.8.22: not unbinding to an already unbound connection.
FTP session closed.

no_Bra1n
(23.05.12 00:28:28 MSK) автор топика