0

I have a very small vm installed, for testing purposes, running CentOS 1708, with vsftp configured. i used

https://www.rootusers.com/how-to-join-centos-linux-to-an-active-directory-domain/

to setup ad authentication for the OS part, but did not want ad users to be able to login via FTP client.

Primarily i need the ad authentication for administration purposes via ssh internally, not over the internet, and FTP logins purely via local users.

i noticed that if a user has not logged in on this vm via ssh, he/she cannot login via ftp port 21 using ad credentials, as it fails to create home directory.

which is fine i guess, but i am looking for a way to prevent ad auth via AD completely, only allowed via ssh or terminal

I do not want ad authentication via ftp as that then puts my ad users on the internet at risk of being "hacked" or locked out

any suggestions on how i can accomplish this?

1

The PAM modules involved in vsFTPd authentication are defined in /etc/pam.d/vsftpd. By default, it has a line:

auth   include    password-auth

which uses the system-wide default PAM configuration for password-based authentication that is specified in /etc/pam.d/password-auth. When AD authentication is configured, the relevant PAM modules are typically added to /etc/pam.d/password-auth.

If you don't want AD authentication to work at all with vsFTPd, edit /etc/pam.d/vsftpd file. Comment out the line

auth   include   password-auth

and after the commented-out line, write in the relevant lines from the password-auth file as it exists in a system with no AD authentication configured:

auth    required     pam_env.so
auth    required     pam_faildelay.so delay=2000000
auth    sufficient   pam_unix.so nullok try_first_pass
auth    requisite    pam_succeed_if.so uid >= 1000 quiet_success
auth    required     pam_deny.so

In this way, the AD authentication provider module will be completely prevented from participating in the vsFTPd authentication, so for vsFTPd the authentication process happens just as if the system did not have any AD integration at all.

  • that seem to have done the trick exactly. i tried multiple times to lock out an ad account by clicking the login button as fast as i could, and the account just does not lockout, like before telcoM's steps. i did however notice some tcp/88 connections to one of my AD boxes, and some random russian ip attempting tcp/445 to this ftp box, but my firewall does its job. then there is also still some ad related ports being blocked between this ftp and ad, but i can sort it out :) thank you for give a clear straight forward solution :) – Fishy Mar 13 '18 at 19:10
0

The SSSD AD provider allows to evaluate GPO policies for access control and to pam the Windows Logon rights onto Linux PAM services. I would recommend to explore this path. btw I would also suggest to not blacklist a service, but go the other way, to whitelist only the services you want to allow on the Linux hosts. The sssd-ad man page should have some examples of mapping the logon rights to PAM services.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.