I'm trying to configure the VSFTPD with Winbind to restrict users authenticated by Active Directory, only to those that belong to specific group.
I'm using a generic conf file for the vsftpd, with few changes:
$ cat /etc/vsftpd/vsftpd.conf
anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
xferlog_std_format=YES
chroot_local_user=YES
allow_writeable_chroot=YES
local_root=/data/ftp
listen=YES
listen_ipv6=NO
pam_service_name=vsftpd
userlist_enable=YES
tcp_wrappers=YES
pasv_enable=Yes
pasv_max_port=51000
pasv_min_port=50000
port_enable=yes
local_max_rate=0
use_localtime=YES
session_support=YES
Winbind is configured and the server sussessful joined to the Domain:
$ wbinfo -u
administrator
guest
...
In the PAM config files, I had put those config files:
$ cat /etc/pam.d/vsftpd
... (Default settings) ...
# Calls the vsftpd-winbind PAM config file:
auth include vsftpd-winbind
account include vsftpd-winbind
session include vsftpd-winbind
$ /etc/pam.d/vsftpd-winbind
auth required pam_env.so debug
auth required pam_winbind.so require_membership_of=GROUPNAME debug debug_state
auth sufficient pam_winbind.so require_membership_of=GROUPNAME debug debug_state
auth required pam_deny.so debug
account sufficient pam_winbind.so require_membership_of=GROUPNAME debug debug_state
account required pam_deny.so
password required pam_cracklib.so retry=3
password sufficient pam_unix.so nullok use_authtok md5 shadow
password required pam_deny.so
session required pam_mkhomedir.so skel=/etc/skel/ umask=0022
session required pam_limits.so
session required pam_unix.so
When I'm test the vsftpd, the error below is returned in /var/log/secure:
Jun 15 16:48:01 localhost vsftpd[2615]: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=joao rhost=rj1.ticorporativa.alog.com.br user=joao
Jun 15 16:48:01 localhost vsftpd[2615]: pam_krb5[2615]: error reading keytab 'FILE:/etc/krb5.keytab'
Jun 15 16:48:01 localhost vsftpd[2615]: pam_krb5[2615]: TGT verified
Jun 15 16:48:01 localhost vsftpd[2615]: pam_krb5[2615]: authentication succeeds for 'joao' (joao@LAB-RJ2.VMWARE)
Jun 15 16:48:01 localhost vsftpd[2615]: pam_winbind(vsftpd:account): user 'joao' granted access
Jun 15 16:48:01 localhost vsftpd[2615]: pam_winbind(vsftpd:account): pam_parse: unknown option: require_membership_of=GROUPNAME
Inicially, I thought that it was a syntax error, but I've tried with several sintaxes in PAM config file:
require_membership_of=GROUPNAME debug debug_state
require_membership_of="GROUPNAME" debug debug_state
require_membership_of=DOMAIN\\GROUPNAME debug debug_state
require_membership_of="DOMAIN\\GROUPNAME" debug debug_state
require_membership_of=GROUP_SID debug debug_state
require_membership_of="GROUP_SID" debug debug_state
In these sintaxes with the "DOMAIN\", I relied in PAM_WINBIND manpage: https://www.samba.org/samba/docs/current/man-html/pam_winbind.8.html
If I remove the "require_membership_of" from the PAM config file, the FTP works, but obviously, the GROUP Membership filter is no apllied.
Has anyone ever had something similar and can help?