I have a web application and i want to let all my application-users to access vsftpd server with the same login credentials. At any time, single source of truth for authentication should be my web application. (Replicating users or storing plain text passwords is not a solution)
There are go-to modules for LDAP, Postgres, MySQL for Linux PAM. Is there any standard solution for enabling web-auth users to login to linux systems?
- Kerberos, OpenLDAP are pretty standard authentication implementations for on-prem solutions. Do they have any relevance in web applications?
- Web frameworks like Django implement a custom hashing algorithms, going-around them or saving Database passwords on FTP servers for enabling DB based PAM authentication is security nightmare in my opinion.
- Replicating all user's information in my new server is unwanted too, since i would like to enable those specific services only after user logged in for the first time. I have 10k users on my app and probably 500 users would be interested in using FTP service offered by me. It will be pointless if i create accounts and home-folders for all 10,000 users.
I am sure, this is common scenario for many IT admins in medium level businesses, i don't want to re-invent the wheel or implement a custom solution which is destined to break on upgrades or security-vulnerable. Please suggest a better PAM implementation for use cases like these.