trAvis - MANAGER

Edit File: mod_sftp_pam.html

<html>
<head>
<title>ProFTPD module mod_sftp_pam</title>
</head>

<hr>
<center>
<h2>ProFTPD module <code>mod_sftp_pam</code></h2>
</center>
<hr>

The <code>mod_sftp_pam</code> module provides support for the "SSH Keyboard-Interactive Authentication" RFC (<a href="http://www.faqs.org/rfcs/rfc4256.html">RFC4256</a>). How is <code>mod_sftp_pam</code> different from ProFTPD's existing
PAM support, in the form of <code>mod_auth_pam</code>? The difference is
that the <code>mod_auth_pam</code> module does not echo the prompt,
provided by the underlying PAM library/modules, back to the FTP client;
this <code>mod_sftp_pam</code> module will echo any prompt back to the
connecting SSH2 client. This makes using onetime-password PAM modules, for
example, work very easily for authenticating SSH2 logins.

This module is contained in the <code>mod_sftp_pam.c</code> file for
ProFTPD 1.3.x, and is not compiled by default. Installation
instructions are discussed <a href="#Installation">here</a>; a discussion
on <a href="#Usage">usage</a> is also available.

The most current version of <code>mod_sftp_pam</code> is distributed with the
ProFTPD source code.

<h2>Author</h2>

Please contact TJ Saunders &lt;tj at castaglia.org&gt; with any
questions, concerns, or suggestions regarding this module.

<h2>Directives</h2>
<ul>
 <li><a href="#SFTPPAMEngine">SFTPPAMEngine</a>
 <li><a href="#SFTPPAMOptions">SFTPPAMOptions</a>
 <li><a href="#SFTPPAMServiceName">SFTPPAMServiceName</a>
</ul>

<hr>
<h2><a name="SFTPPAMEngine">SFTPPAMEngine</a></h2>
Syntax: SFTPPAMEngine on|off 
Default: On 
Context: &quot;server config&quot;, &lt;VirtualHost&gt;, &lt;Global&gt; 
Module: mod_sftp_pam 
Compatibility: 1.3.2rc2 and later

The <code>SFTPPAMEngine</code> directive toggles the use of the PAM library
for supporting a keyboard-interactive authentication mechanism for SSH2 logins.
By default <code>mod_sftp_pam</code> is enabled.

<hr>
<h2><a name="SFTPPAMOptions">SFTPPAMOptions</a></h2>
Syntax: SFTPPAMOptions opt1 opt2 ... optN 
Default: None 
Context: &quot;server config&quot;, &lt;VirtualHost&gt;, &lt;Global&gt; 
Module: mod_sftp_pam 
Compatibility: 1.3.2rc2 and later

The <code>SFTPPAMOptions</code> directive is used to configure various
optional behaviors of <code>mod_sftp_pam</code>; it is directly analogous
to <code>mod_auth_pam</code>'s <code>AuthPAMOptions</code> directive.

The currently supported options are:
<ul>
 <li><code>NoTTY</code>
 </li>

<li><code>NoInfoMsgs</code>
 
 Disables the sending of information messages from PAM to the connecting
 SSH client. This option is usually used for compatibility with
 OpenSSH's behavior.
 </li>

<li><code>NoRadioMsgs</code>
 
 Disables the sending of Linux-specific information messages from PAM
 (usually from the <code>pam_winbind</code> PAM module) to the connecting
 SSH client. This option is usually used for compatibility with
 OpenSSH's behavior.
 </li>
</ul>

<hr>
<h2><a name="SFTPPAMServiceName">SFTPPAMServiceName</a></h2>
Syntax: SFTPPAMServiceName service 
Default: SFTPPAMServiceName sshd 
Context: &quot;server config&quot;, &lt;VirtualHost&gt;, &lt;Global&gt; 
Module: mod_sftp_pam 
Compatibility: 1.3.2rc2 and later

The <code>SFTPPAMConfig</code> directive is used to specify the name of the
service used when performing the PAM check; PAM configurations can vary
depending on the service. By default, the &quot;sshd&quot; service is used.

Here's an example of changing the service used:
<pre>
 &lt;IfModule mod_sftp_pam.c&gt;
 SFTPPAMEngine on
 SFTPPAMServiceName ftpd
 &lt;/IfModule&gt;
</pre>

The <code>SFTPPAMServiceName</code> directive is directly analogous to
<code>mod_auth_pam</code>'s <code>AuthPAMConfig</code> directive.

<hr>
<h2><a name="Installation">Installation</a></h2>
The <code>mod_sftp_pam</code> module is distributed with ProFTPD. Simply follow
the normal steps for using third-party modules in proftpd:
<pre>
 ./configure --with-modules=mod_sftp:mod_sftp_pam ...
 make
 make install
</pre>
Alternatively, <code>mod_sftp_pam</code> can be built as a DSO module:
<pre>
 ./configure --enable-dso --with-shared=mod_sftp_pam ...
</pre>
Then follow the usual steps:
<pre>
 make
 make install
</pre>

For those with an existing ProFTPD installation, you can use the
<code>prxs</code> tool to add <code>mod_sftp_pam</code>, as a DSO module, to
your existing server:
<pre>
 # prxs -c -i -d mod_sftp_pam.c
</pre>

<hr> 
<h2><a name="Usage">Usage</a></h2>
To use <code>mod_sftp_pam</code>, simply configure it to use the correct PAM
service name, e.g.:
<pre>
 &lt;IfModule mod_sftp_pam.c&gt;
 SFTPPAMEngine on
 SFTPPAMServiceName sftp
 &lt;/IfModule&gt;
</pre>
There is no requirement that <code>mod_sftp_pam</code> use the same PAM
service name as the <code>mod_auth_pam</code> module; this allows you to have
different PAM configurations for FTP versus SSH2 logins.

<hr>

Author: $Author: castaglia $ 
Last Updated: $Date: 2013-10-03 05:21:56 $

<hr>

<hr>

</body>
</html>