1

I'm trying to setup vsftpd on a amazon ami 64 bit box, free tier micro.

Following these instructions, http://wiki.centos.org/HowTos/VirtualVsFtpd I have successfully been able to get my ftp up and running. As long as I manually create the users home directory, it works perfectly.

Need need help automatically setting up user home directories. for the ftp client

The next thing I wanted to do is setup a script to automatically setup the users home directory rather than manually having to do it. I found some documentation here, http://t3chnick.blogspot.com/2011/12/vsftp-mysql-virtual-with-auto-create.html I have spent hours trying to get this to work without any success.

Like nicks documentation I modified my /etc/pam.d/vsftpd file to include the following lines of code.

#%PAM-1.0
session       optional        pam_keyinit.so       force revoke

# Auth in MySQL   
auth requisite pam_mysql.so user=vsftpd-ro passwd=readonly host=localhost db=vsftpd table=accounts usercolumn=username passwdcolumn=pass crypt=0   
auth required pam_script.so onerr=success dir=/etc/pam-script**

Now my confusion

Because of my lack of knowledge, I'm not sure if I'm suppose to be creating the script file or if it's already included on the box and I just need to modify it. I'm assuming when Nick posted his example, he created the script on a 32bit box, but at the bottom of his article he talks about a 64bit script.

Anyhow when I try to navigate to $ cat /etc/pam-script/pam_script_auth I'm finding neither the script nor the pam-script dir exist. If I attempt to create it I get a permission denied error unless I use sudo vi /etc/pam-script/pam_script_auth

Now once again, I'm not sure manually creating the script is the correct way to go about this. I'm not sure if I should be downloading something, or if in a 64bit box if their is an existing script else where that needs to be modified. Anyhow after manually creating it and giving permissions to the script to read, write, execute, I end up with this.

$ cat /etc/pam-script/pam_script_auth

pam_script_auth

#!/bin/sh
if [ ! -d "/opt/ftp/$PAM_USER" ]; then
  /usr/bin/env mkdir /opt/ftp/$PAM_USER
  /usr/bin/env chown ftp:ftp /opt/ftp/$PAM_USER
fi

Now I'm able to still log into the box, but it appears to fail to authenticate against the db and I'm not seeing where the user file has been created. I'm guessing their is something wrong with the script. I also found the following ubuntu question where nick replied to a similar question.

https://askubuntu.com/questions/406486/vsftpd-hanging-when-using-pam-exec-or-pam-script/408346#408346?newreg=bd1b0e5dec104d1abe5e91800d3a7763

Thanks in advance.

EDIT

It was suggested by jayhendren to use pam_mkhomedir.so rather than a script.

Please correct me if I'm wrong, but my assumption is to configure my /etc/pam.d/vsftpd like so

#%PAM-1.0
session       optional        pam_keyinit.so       force revoke

# Auth in MySQL   
auth requisite pam_mysql.so user=vsftpd-ro passwd=readonly host=localhost db=vsftpd table=accounts usercolumn=username passwdcolumn=pass crypt=0   
session required pam_mkhomedir.so skel=/opt/ftp/ umask=0022 debug

account required pam_mysql.so user=vsftpd-ro passwd=readonly host=localhost db=vsftpd table=accounts usercolumn=username passwdcolumn=pass crypt=0

Could someone verify this configuration?

  • 1
    You should be able to use pam_mkhomedir to create home directories instead of writing a script to do it, unless I'm missing something about your question. – jayhendren Jan 29 '15 at 18:31
  • What are you asking about here? There's a lot of information in your post, and I'm not really sure what your question is. Do you need help setting up PAM? Or do you need help writing a script? Or is it something else? – jayhendren Jan 29 '15 at 18:32
  • I need help automatically creating the home directories for each user when they do not exist. Yes, I appologize, there is a lot of information and it's primary do to my lack of knowledge when it comes to linux. My goal is to query against the database for authentication and once authenticated create the user home directory if it doesn't exist. I do not want to manually have to set these directories up do to the fact they are tied to user accounts. – Code Junkie Jan 29 '15 at 19:04
  • @jayhendren nicks documentation appears to be a bit old, perhaps there are newer ways to handle this? I honestly do not know anything about pam, so if you don't mind, could you please assist me? Thanks. – Code Junkie Jan 29 '15 at 19:06
  • 1
    umask is a permissions mask. – jayhendren Jan 29 '15 at 21:01
1

Here are some thoughts:

1) You probably need to use the pam_script module or something similar to create the users homedir. The pam module pam_mkhomedir bases the home directory on what is seen in the passwd file (or ldap etc.) and assumes multiple uid/gid/homedir mappings. Your users are virtual in mysql and and not based on a passwd entry the system is aware of and can play nice in the vsftp world.

The pam_script module is most likely not included in your distribution and you might need to find an external package or compile the package from source.

2) The $PAM_USER is an environement variable that is passed to pam modules: With pam_script, how do I pass PAM_AUTHTOK and PAM_USER in all cases?

3) When you get to the script part check for selinux errors since /etc/pam-script/pam_script_auth might be getting spanked writing to a non-standard location for your distribution.

4) Send your output in /etc/pam-script/pam_script_auth to a log file so you can see if you are getting errors related to your commands.

$ cat /etc/pam-script/pam_script_auth
#!/bin/sh
echo "I got here" >> /tmp/script.out 2>&1
if [ ! -d "/opt/ftp/$PAM_USER" ]; then
  /usr/bin/env mkdir /opt/ftp/$PAM_USER >> /tmp/script.out 2>&1
  /usr/bin/env chown ftp:ftp /opt/ftp/$PAM_USER >> /tmp/script.out 2>&1
fi

Good luck,

Nick

  • Thanks Nick, your correct, pam_script wasn't included with my distro, so I did need to bring it in from an external source. I had everything setup to what I thought was correct, but it never appeared as if the script was firing. Thanks for showing me how to log the script, that probably would have helped me to find the real issue. Jayhendreds suggestion also turned out to have it's own serios of flaws too. In the long run I ended up giving up on vsftpd and moving onto pureftp. Much quicker to get up and running without all issues of pam. – Code Junkie Feb 3 '15 at 14:51
0

So this is your script:

#!/bin/sh
if [ ! -d "/opt/ftp/$PAM_USER" ]; then
 /usr/bin/env mkdir /opt/ftp/$PAM_USER
 /usr/bin/env chown ftp:ftp /opt/ftp/$PAM_USER
fi

Try your script with this:

#!/bin/sh
if [ ! -d "/opt/ftp/${PAM_USER}" ]; then
 /usr/bin/env mkdir /opt/ftp/${PAM_USER}
 /usr/bin/env chown ftp:ftp /opt/ftp/${PAM_USER}
fi

PAM_USER is a variable right? But I don't see where you create this variable.

I have a similar script, he check my hostname to take a file on a tftp server.

  • Thanks aragmond, but unfortunately no success. Where do I set he variable is an interesting question. I've been asking the same one and just come to the conclusion that it was being set behind the scenes by the library. I would have thought it would have been set some where's around here, but I've never seen a working example where that was the case session required pam_mkhomedir.so skel=/opt/ftp/ umask=0022 debug – Code Junkie Jan 30 '15 at 13:58
  • I don't know how it's worked but if you do an echo it's worked? echo $PAM_USER – Aragmond Jan 30 '15 at 14:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.