I'm trying to authenticate vsftpd from LDAP logins which hosted remotely another server . vsftpd hosted on Ubuntu 14.04.2 LTS (GNU/Linux 3.13.0-48-generic x86_64) amazon aws . from the LDAP server i have these details . user          :    cn=demo,dc=ldap,dc=foobar,dc=comPassword :    testpasswdBase DN   :   dc=ldap,dc=foobar,dc=comUser Base :  ou=user,dc=ldap,dc=foobar,dc=comand a ca_serv.pem to authenticate which included in /etc/ssl/certs/ and added references to /etc/ldap/ldap.conf as TLS_CACERT /etc/ssl/certs/ca_serv.pemmy /etc/pam.d/vsftpd is like this . # Standard behaviour for ftpd(8).auth    required        pam_listfile.so item=user sense=deny file=/etc/ftpusers onerr=succeed# Note: vsftpd handles anonymous logins on its own. Do not enable pam_ftp.so.# Standard pam includes@include common-account@include common-session@include common-authauth    required      pam_shells.soauth    required        pam_ldap.soaccount required        pam_ldap.sosession sufficient      pam_ldap.sopassword        required        pam_ldap.sosession required        pam_ldap.sowhen i commented auth required  pam_shells.ssufficiento in here I no longer can ftp  localhost to users created locally./etc/ldap.conf file###DEBCONF####### Configuration of this file will be managed by debconf as long as the## first line of the file says '###DEBCONF###'#### You should use dpkg-reconfigure to configure this file via debconf#### @(#)$Id: ldap.conf,v 1.38 2006/05/15 08:13:31 lukeh Exp $## This is the configuration file for the LDAP nameservice# switch library and the LDAP PAM module.## PADL Software# http://www.padl.com## Your LDAP server. Must be resolvable without using LDAP.# Multiple hosts may be specified, each separated by a # space. How long nss_ldap takes to failover depends on# whether your LDAP client library supports configurable# network or connect timeouts (see bind_timelimit).#host 127.0.0.1# The distinguished name of the search base.#base dc=example,dc=netbase  dc=ldap,dc=foobar,dc=com# Another way to specify your LDAP server is to provide an# Unix Domain Sockets to connect to a local LDAP Server.#uri ldap://127.0.0.1/uri ldaps://ldap.foobar.com:636# Note: %2f encodes the '/' used as directory separator# The LDAP version to use (defaults to 3# if supported by client library)ldap_version 3# The distinguished name to bind to the server with.# Optional: default is to bind anonymously.#binddn cn=proxyuser,dc=padl,dc=com# The credentials to bind with. # Optional: default is no credential.#bindpw secret# The distinguished name to bind to the server with# if the effective user ID is root. Password is# stored in /etc/ldap.secret (mode 600)#rootbinddn cn=manager,dc=example,dc=netrootbindddn cn=foo,dc=ldap,dc=foobar,dc=com# The port.# Optional: default is 389.#port 389# The search scope.#scope sub#scope one#scope base# Search timelimit#timelimit 30# Bind/connect timelimit#bind_timelimit 30# Reconnect policy: hard (default) will retry connecting to# the software with exponential backoff, soft will fail# immediately.#bind_policy hard# Idle timelimit; client will close connections# (nss_ldap only) if the server has not been contacted# for the number of seconds specified below.#idle_timelimit 3600# Filter to AND with uid=%s#pam_filter objectclass=account# The user ID attribute (defaults to uid)#pam_login_attribute uid# Search the root DSE for the password policy (works# with Netscape Directory Server)#pam_lookup_policy yes# Check the 'host' attribute for access control# Default is no; if set to yes, and user has no# value for the host attribute, and pam_ldap is# configured for account management (authorization)# then the user will not be allowed to login.#pam_check_host_attr yes# Check the 'authorizedService' attribute for access# control# Default is no; if set to yes, and the user has no# value for the authorizedService attribute, and# pam_ldap is configured for account management# (authorization) then the user will not be allowed# to login.#pam_check_service_attr yes# Group to enforce membership of#pam_groupdn cn=PAM,ou=Groups,dc=padl,dc=com# Group member attribute#pam_member_attribute uniquemember# Specify a minium or maximum UID number allowed#pam_min_uid 0#pam_max_uid 0# Template login attribute, default template user# (can be overriden by value of former attribute# in user's entry)#pam_login_attribute userPrincipalName#pam_template_login_attribute uid#pam_template_login nobody# HEADS UP: the pam_crypt, pam_nds_passwd,# and pam_ad_passwd options are no# longer supported.## Do not hash the password at all; presume# the directory server will do it, if# necessary. This is the default.pam_password md5# Hash password locally; required for University of# Michigan LDAP server, and works with Netscape# Directory Server if you're using the UNIX-Crypt# hash mechanism and not using the NT Synchronization# service. #pam_password crypt# Remove old password first, then update in# cleartext. Necessary for use with Novell# Directory Services (NDS)#pam_password clear_remove_old#pam_password nds# RACF is an alias for the above. For use with# IBM RACF#pam_password racf# Update Active Directory password, by# creating Unicode password and updating# unicodePwd attribute.#pam_password ad# Use the OpenLDAP password change# extended operation to update the password.#pam_password exop# Redirect users to a URL or somesuch on password# changes.#pam_password_prohibit_message Please visit http://internal to change your password.# RFC2307bis naming contexts# Syntax:# nss_base_XXX        base?scope?filter# where scope is {base,one,sub}# and filter is a filter to be &'d with the# default filter.# You can omit the suffix eg:# nss_base_passwd    ou=People,# to append the default base DN but this# may incur a small performance impact.#nss_base_passwd    ou=People,dc=padl,dc=com?one#nss_base_shadow    ou=People,dc=padl,dc=com?one#nss_base_group        ou=Group,dc=padl,dc=com?one#nss_base_hosts        ou=Hosts,dc=padl,dc=com?one#nss_base_services    ou=Services,dc=padl,dc=com?one#nss_base_networks    ou=Networks,dc=padl,dc=com?one#nss_base_protocols    ou=Protocols,dc=padl,dc=com?one#nss_base_rpc        ou=Rpc,dc=padl,dc=com?one#nss_base_ethers    ou=Ethers,dc=padl,dc=com?one#nss_base_netmasks    ou=Networks,dc=padl,dc=com?ne#nss_base_bootparams    ou=Ethers,dc=padl,dc=com?one#nss_base_aliases    ou=Aliases,dc=padl,dc=com?one#nss_base_netgroup    ou=Netgroup,dc=padl,dc=com?one# attribute/objectclass mapping# Syntax:#nss_map_attribute    rfc2307attribute    mapped_attribute#nss_map_objectclass    rfc2307objectclass    mapped_objectclass# configure --enable-nds is no longer supported.# NDS mappings#nss_map_attribute uniqueMember member# Services for UNIX 3.5 mappings#nss_map_objectclass posixAccount User#nss_map_objectclass shadowAccount User#nss_map_attribute uid msSFU30Name#nss_map_attribute uniqueMember msSFU30PosixMember#nss_map_attribute userPassword msSFU30Password#nss_map_attribute homeDirectory msSFU30HomeDirectory#nss_map_attribute homeDirectory msSFUHomeDirectory#nss_map_objectclass posixGroup Group#pam_login_attribute msSFU30Name#pam_filter objectclass=User#pam_password ad# RFC 2307 (AD) mappings#nss_map_objectclass posixAccount user#nss_map_objectclass shadowAccount user#nss_map_attribute uid sAMAccountName#nss_map_attribute homeDirectory unixHomeDirectory#nss_map_attribute shadowLastChange pwdLastSet#nss_map_objectclass posixGroup group#nss_map_attribute uniqueMember member#pam_login_attribute sAMAccountName#pam_filter objectclass=User#pam_password ad# configure --enable-authpassword is no longer supported# AuthPassword mappings#nss_map_attribute userPassword authPassword# AIX SecureWay mappings#nss_map_objectclass posixAccount aixAccount#nss_base_passwd ou=aixaccount,?one#nss_map_attribute uid userName#nss_map_attribute gidNumber gid#nss_map_attribute uidNumber uid#nss_map_attribute userPassword passwordChar#nss_map_objectclass posixGroup aixAccessGroup#nss_base_group ou=aixgroup,?one#nss_map_attribute cn groupName#nss_map_attribute uniqueMember member#pam_login_attribute userName#pam_filter objectclass=aixAccount#pam_password clear# Netscape SDK LDAPS#ssl on# Netscape SDK SSL options#sslpath /etc/ssl/certs# OpenLDAP SSL mechanism# start_tls mechanism uses the normal LDAP port, LDAPS typically 636#ssl start_tls#ssl on# OpenLDAP SSL options# Require and verify server certificate (yes/no)# Default is to use libldap's default behavior, which can be configured in# /etc/openldap/ldap.conf using the TLS_REQCERT setting.  The default for# OpenLDAP 2.0 and earlier is no, for 2.1 and later is yes.#tls_checkpeer yes# CA certificates for server certificate verification# At least one of these are required if tls_checkpeer is yes#tls_cacertfile /etc/ssl/ca.cert#tls_cacertdir /etc/ssl/certs# Seed the PRNG if /dev/urandom is not provided#tls_randfile /var/run/egd-pool# SSL cipher suite# See man ciphers for syntax#tls_ciphers TLSv1# Client certificate and key# Use these, if your server requires client authentication.#tls_cert#tls_key# Disable SASL security layers. This is needed for AD.#sasl_secprops maxssf=0# Override the default Kerberos ticket cache location.#krb5_ccname FILE:/etc/.ldapcache# SASL mechanism for PAM authentication - use is experimental# at present and does not support password policy control#pam_sasl_mech DIGEST-MD5/etc/ldap/ldap.conf content## LDAP Defaults## See ldap.conf(5) for details# This file should be world readable but not world writable.BASE    BASE    dc=ldap,dc=foobar,dc=com#URI    ldap://ldap.example.com ldap://ldap-master.example.com:666URI ldaps://ldap.foobar.com ldaps://ldap.foobar.com:636#SIZELIMIT      12#TIMELIMIT      15#DEREF          never# TLS certificates (needed for GnuTLS)TLS_CACERT      /etc/ssl/certs/ca-certificates.crtTLS_CACERT      /etc/ssl/certs/ca_serv.pem    ## LDAP Defaults## See ldap.conf(5) for details# This file should be world readable but not world writable.BASE    BASE    dc=ldap,dc=foobar,dc=com#URI    ldap://ldap.example.com ldap://ldap-master.example.com:666URI     ldap://ldap_server_ip ldap://ldap_server_ip:666#SIZELIMIT      12#TIMELIMIT      15#DEREF          never# TLS certificates (needed for GnuTLS)TLS_CACERT      /etc/ssl/certs/ca-certificates.crtTLS_CACERT      /etc/ssl/certs/ca_serv.pemTLS_REQCERT allowTLS_REQCERT allowI also have /etc/ldap.secret file with password for rootbindddn cn=foo,dc=ldap,dc=foobar,dc=com which on the /etc/ldap.confcontent of /etc/vsftpd.conf# Example config file /etc/vsftpd.conf## The default compiled in settings are fairly paranoid. This sample file# loosens things up a bit, to make the ftp daemon more usable.# Please see vsftpd.conf.5 for all compiled in defaults.## READ THIS: This example file is NOT an exhaustive list of vsftpd options.# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's# capabilities.### Run standalone?  vsftpd can run either from an inetd or as a standalone# daemon started from an initscript.listen=NO## Run standalone with IPv6?# Like the listen parameter, except vsftpd will listen on an IPv6 socket# instead of an IPv4 one. This parameter and the listen parameter are mutually# exclusive.listen_ipv6=YES## Allow anonymous FTP? (Disabled by default)anonymous_enable=NO## Uncomment this to allow local users to log in.local_enable=YES## Uncomment this to enable any form of FTP write command.write_enable=YES## Default umask for local users is 077. You may wish to change this to 022,# if your users expect that (022 is used by most other ftpd's)#local_umask=022## Uncomment this to allow the anonymous FTP user to upload files. This only# has an effect if the above global write enable is activated. Also, you will# obviously need to create a directory writable by the FTP user.#anon_upload_enable=YES## Uncomment this if you want the anonymous FTP user to be able to create# new directories.#anon_mkdir_write_enable=YES## Activate directory messages - messages given to remote users when they# go into a certain directory.dirmessage_enable=YES## If enabled, vsftpd will display directory listings with the time# in  your  local  time  zone.  The default is to display GMT. The# times returned by the MDTM FTP command are also affected by this# option.use_localtime=YES## Activate logging of uploads/downloads.xferlog_enable=YES## Make sure PORT transfer connections originate from port 20 (ftp-data).connect_from_port_20=YES## If you want, you can arrange for uploaded anonymous files to be owned by# a different user. Note! Using root for uploaded files is not# recommended!#chown_uploads=YES#chown_username=whoever## You may override where the log file goes if you like. The default is shown# below.#xferlog_file=/var/log/vsftpd.log## If you want, you can have your log file in standard ftpd xferlog format.# Note that the default log file location is /var/log/xferlog in this case.#xferlog_std_format=YES## You may change the default value for timing out an idle session.#idle_session_timeout=600## You may change the default value for timing out a data connection.#data_connection_timeout=120## It is recommended that you define on your system a unique user which the# ftp server can use as a totally isolated and unprivileged user.#nopriv_user=ftpsecure## Enable this and the server will recognise asynchronous ABOR requests. Not# recommended for security (the code is non-trivial). Not enabling it,# however, may confuse older FTP clients.#async_abor_enable=YES## By default the server will pretend to allow ASCII mode but in fact ignore# the request. Turn on the below options to have the server actually do ASCII# mangling on files when in ASCII mode.# Beware that on some FTP servers, ASCII support allows a denial of service# attack (DoS) via the command SIZE /big/file in ASCII mode. vsftpd# predicted this attack and has always been safe, reporting the size of the# raw file.# ASCII mangling is a horrible feature of the protocol.#ascii_upload_enable=YES#ascii_download_enable=YES## You may fully customise the login banner string:#ftpd_banner=Welcome to blah FTP service.# You may specify a file of disallowed anonymous e-mail addresses. Apparently# useful for combatting certain DoS attacks.#deny_email_enable=YES# (default follows)#banned_email_file=/etc/vsftpd.banned_emails## You may restrict local users to their home directories.  See the FAQ for# the possible risks in this before using chroot_local_user or# chroot_list_enable below.#chroot_local_user=YES## You may specify an explicit list of local users to chroot() to their home# directory. If chroot_local_user is YES, then this list becomes a list of# users to NOT chroot().# (Warning! chroot'ing can be very dangerous. If using chroot, make sure that# the user does not have write access to the top level directory within the# chroot)#chroot_local_user=YES#chroot_list_enable=YES# (default follows)#chroot_list_file=/etc/vsftpd.chroot_list## You may activate the -R option to the builtin ls. This is disabled by# default to avoid remote users being able to cause excessive I/O on large# sites. However, some broken FTP clients such as ncftp and mirror assume# the presence of the -R option, so there is a strong case for enabling it.#ls_recurse_enable=YES## Customization## Some of vsftpd's settings don't fit the filesystem layout by# default.## This option should be the name of a directory which is empty.  Also, the# directory should not be writable by the ftp user. This directory is used# as a secure chroot() jail at times vsftpd does not require filesystem# access.secure_chroot_dir=/var/run/vsftpd/empty## This string is the name of the PAM service vsftpd will use.pam_service_name=vsftpd## This option specifies the location of the RSA certificate to use for SSL# encrypted connections.rsa_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem# This option specifies the location of the RSA key to use for SSL# encrypted connections.rsa_private_key_file=/etc/ssl/private/ssl-cert-snakeoil.key#allow_writeable_chroot=YES#pasv_enable=Yes#pasv_min_port=40000#pasv_max_port=40100when i run the ldapsearch ldapsearch -x -H ldaps://ldap.foobar.com:636 -b dc=ldap,dc=foobar,dc=com -D cn=foo,dc=ldap,dc=foobar,dc=com -w'testpasswd'result is ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) also ftp localhost says ftp: connect: Connection refused'
Authentication vsftpd account using remote LDAP user
ubuntu;pam;vsftpd;amazon ec2;openldap