0

EDIT:

Ok I actually missed out a log in Syslog, I was hopign it would appear in auth.log or vsftpd.log, but a crucial message was in Syslog: Failed looking up IP address for RADIUS server [2001 (errcode=9)

No matter in what format I type the IPv6 address (tried with [] brackets, without them, and using alias in /etc/hosts) in the pam_radius_auth.conf, it won't take it. Seems like the pam module is not compatible with IPv6? :(

I have two servers, one server running vsFTPd and second server running Freeradius. Both of them are IPv6only.

I am trying to use vsFTPd with pam_radius_auth module to authenticate via my radius server, but for some reason I am unable to make it work. Freeradius server should be configured properly, I can authenticate via terminal like this:

radtest -6 user pass 2001:xxxx:xxxx:xxxx:xxxx::129 0 radiussecret

Also my other webserver can authenticate via my radius server.

For some reason, it seems liek vsFTPd is not using the right pam module, I don't have any debug message that he attempts to connect to my radius server, or if I remove it from /etc/pam_radius_auth.conf completely, that it cannot find a server to connect to.

Here are my configs:

/etc/vsftpd.conf

listen=NO
listen_ipv6=YES
anonymous_enable=NO
local_enable=YES
write_enable=YES
pam_service_name=ftp

/etc/pam.d/vsftpd

auth       sufficient  pam_radius_auth.so
account    sufficient  pam_radius_auth.so

/etc/pam_radius_auth.conf

radiusserver radiussecret 10

And in /etc/hosts I mapped the radiusserver to its ip address:

2001:xxxx:xxxx:xxxx::129 radiusserver.auth radiusserver

Now when on the FTP server I try to connect with the credentials user:pass, I get the following error:

ftp localhost
Connected to localhost.
220 (vsFTPd 3.0.2)
Name (localhost:student): user
331 Please specify the password.
Password:
530 Login incorrect.
Login failed.

In /var/log/auth.log:

 ubuntu vsftpd: pam_unix(ftp:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=user rhost=::1  user=user

and /var/log/vsftpd.log

CONNECT: Client "::1"
[user] FAIL LOGIN: Client "::1"

What is going on? Why is vsFTPd not even trying to connect to my radius server? :( Thank you

0

In /etc/vsftpd.conf you have:

pam_service_name=ftp

I think that tells PAM to look for configuration for this service in /etc/pam.d/ftp, rather than /etc/pam.d/vsftpd.

If /etc/pam.d/ftp does not exist, /etc/pam.d/other will get used instead.

  • I was trying various variations of pam_service_name=ftp pam_service_name=vsftp pam_service_name=vsftpd but none really seems to fix my problem. Eventually I left it at ftp, according to askubuntu.com/questions/413677/vsftpd-530-login-incorrect Because when I use "vsftpd", there is nothing showing up in /var/log/auth.log – Tomáš Ptáček Dec 15 '17 at 20:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.