I have a web application and i want to let all my application-users to access vsftpd server with the same login credentials. At any time, single source of truth for authentication should be my web application. (Replicating users or storing plain text passwords is not a solution)

There are go-to modules for LDAP, Postgres, MySQL for Linux PAM. Is there any standard solution for enabling web-auth users to login to linux systems?

  • Kerberos, OpenLDAP are pretty standard authentication implementations for on-prem solutions. Do they have any relevance in web applications?
  • Web frameworks like Django implement a custom hashing algorithms, going-around them or saving Database passwords on FTP servers for enabling DB based PAM authentication is security nightmare in my opinion.
  • Replicating all user's information in my new server is unwanted too, since i would like to enable those specific services only after user logged in for the first time. I have 10k users on my app and probably 500 users would be interested in using FTP service offered by me. It will be pointless if i create accounts and home-folders for all 10,000 users.

I am sure, this is common scenario for many IT admins in medium level businesses, i don't want to re-invent the wheel or implement a custom solution which is destined to break on upgrades or security-vulnerable. Please suggest a better PAM implementation for use cases like these.

  • Keeping the password in Django ties you to its password implementation. That being said, I guess you could use pam_exec to delegate authentication to arbitrary code. (Still, in my opinion, LDAP is the way to go. I'm sure Django has a module to authenticate against LDAP, and only creating homedirs on first login on the server is easy.) – Ulrich Schwarz Jul 28 at 15:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.