4

I'm trying to get a ProFTPD to LDAP auth on a Active Directory base. I still couldn't figure out what could be wrong with my configuration since, executing a LDAP query with ldapsearch seems fine

proftpd.conf

/etc/proftpd.conf

# This is the ProFTPD configuration file
ServerName                      "FTP and Ldap"
ServerType                      standalone
ServerAdmin                     [email protected]
AuthOrder                       mod_ldap.c
LoadModule                      mod_ldap.c
DefaultServer                   on
ShowSymlinks                    on
RootLogin                       off
UseIPv6                         off
AllowLogSymlinks                on
IdentLookups                    off
UseReverseDNS                   off
Umask                           077
User                            ftp
Group                           ftp
DefaultRoot                     /home/ftp/%u/
DefaultChDir                    ftp
RequireValidShell               off
UseFtpUsers                     off
SystemLog                       /var/log/proftpd/proftpd.log
TransferLog                     /var/log/proftpd/xferlog
DefaultTransferMode             binary

<IfModule mod_ldap.c>
        LDAPServer                      domaincontroller.domain.net
        LDAPAttr                        uid sAMAccountName
        LDAPDNInfo                      cn=linux.ldap,ou=users,ou=resources,dc=domain,dc=net password
        LDAPAuthBinds                   on
        LDAPDoAuth                      on "dc=domain,dc=net" (&(sAMAccountName=%v)(objectclass=User))
        LDAPQueryTimeout                15

        LDAPGenerateHomedir             on
        LDAPGenerateHomedirPrefix       /home/ftp

        #uid e guid of the local global user
        LDAPDefaultUID                  14
        LDAPDefaultGID                  50
        LDAPForceDefaultUID             on
        LDAPForceDefaultGID             on
</IfModule>

<Directory /*>
        AllowOverwrite                  on
</Directory>

proftpd -nd10 -> "search failed"

Running proftpd with a debug level of 10 I got these logs while authenticating with my user (nicolas):

proftpd -nd10


dispatching CMD command 'PASS (hidden)' to mod_auth
mod_ldap/2.8.22: generated filter dc=domain,dc=net from template dc=domain,dc=net and value nicolas
mod_ldap/2.8.22: generated filter (&(sAMAccountName=nicolas)(objectclass=User)) from template (&(sAMAccountName=%v)(objectclass=User)) and value nicolas
mod_ldap/2.8.22: attempting connection to ldap://domaincontroller.domain.net/
mod_ldap/2.8.22: set protocol version to 3
mod_ldap/2.8.22: connected to ldap://domaincontroller.domain.net/
mod_ldap/2.8.22: successfully bound as cn=linux.ldap,ou=users,ou=resources,dc=domain,dc=net password
mod_ldap/2.8.22: set dereferencing to 0
mod_ldap/2.8.22: set query timeout to 15s
mod_ldap/2.8.22: pr_ldap_search(): LDAP search failed: Operations error

ldapsearch works

But ldapsearch on the other hand works just fine:

[root@ftp2 ~]# ldapsearch -x -W -D "cn=linux.ldap,ou=users,ou=resources,dc=domain,dc=net" -h domaincontroller.domain.net -b "dc=domain,dc=net" -LLL "(SAMAccountName=nicolas)"
Enter LDAP Password: 

dn: CN=Nicolas XXXXXXX,OU=XXXXXXX,OU=XXXXXXX,OU=XXXXXXX,DC=XXXXXXX,DC=XXXXXXX
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Nicolas XXXXXXX
sn: XXXXXXX
description:XXXXXXX
givenName: XXXXXXX
distinguishedName:

Any clues?

StackzOfZtuff
  • 297
  • 2
  • 9
  • outdated, but ...... you've been configure (sAMAccountName=%v) , but it should be (sAMAccountName=%u) . mistake in configuration variable :) – Znik Aug 29 '23 at 07:47

1 Answers1

2

To achieve this, the URL must be RFC 2255 compliant and, using Proftpd queries will only work when they are filtered by an OU. These queries will not work at LDAP root level.

LDAPServer ldap://domaincontroller.domain.net:389/??sub

Organizational Unity:

LDAPDoAuth on "OU=OFFICE,dc=domain,dc=net" (&(sAMAccountName=%v)(objectclass=User))

Umask inside the dir. The limits are just for safety

<Directory />
Umask 022 022
AllowOverwrite on
        <Limit MKD XMKD CDUP XCUP CWD XCWD RMD XRMD>
        DenyAll
        </Limit>
</Directory>
Community
  • 1