Does the pam_pwdfile module support clear text passwords?

 
Thread Tools Search this Thread
Operating Systems Linux Red Hat Does the pam_pwdfile module support clear text passwords?
# 8  
Old 11-29-2013
In case anyone encountered this. I got creative with my puppet module and created a couple of functions to accomplish the creation/deletion of virtual user accounts within puppet


Here are my functions:
Code:
define ftpuser_init{
  exec { "remove_existing_users":
     command => "rm /etc/vsftpd/users/*;  rm /etc/vsftpd/chroot_list; rm /etc/vsftpd/passwd; rm /etc/vsftpd/user_list"
  }
  package { 'pam_pwdfile':
     provider => 'rpm',
     ensure => installed,
     source => "http://install.companyrepository.com/repo/RCE/SLES11-SP1-Pool/sle-11-x86_64/rpm/x86_64/pam_pwdfile-0.99-9026.1.x86_64.rpm"
  }

  file { ["/etc/vsftpd/"]:
    ensure => "directory",
  }

  file { "/etc/pam.d/vsftp_local_and_virtual":
    ensure => 'present',
    owner => 'root',
    group => 'root',
    mode => 0644,
    source => "puppet:///ftp/vsftpd_local_and_virtual"
  }

  exec { "password_file":
     require => exec["remove_existing_users"],
     command => "touch /etc/vsftpd/passwd"
  }
}


Code:
define ftpuser ( $username, $password, $homefolder){
  user { $username:
     ensure => 'present',
  }
  exec{ "htpasswd_$username":
    command => "htpasswd2 -b /etc/vsftpd/passwd ${username} ${password}",
  }
  exec{ "chroot_list_$username":
    require => exec["htpasswd_$username"],
    command => "echo ${username} >> /etc/vsftpd/chroot_list",
  }
  exec{ "user_list_$username":
    require => exec["chroot_list_$username"],
    command => "echo ${username} >> /etc/vsftpd/user_list",
  }
  exec { "profile_$username":
     require => exec["user_list_$username"],
     command => "touch /etc/vsftpd/users/${username}",
  }
  exec { "guest_username_$username":
    require => exec["profile_$username"],
    command => "echo guest_username=$username >> /etc/vsftpd/users/$username",
  }
  exec { "local_root_$username":
    require => exec["guest_username_$username"],
    command => "echo local_root=$homefolder >> /etc/vsftpd/users/$username",
  }
}


ftp_userinit is called before the users are initiated. This allows puppet to clear out the users that are there and start fresh. An example of how to call this would be something like this:

Code:
class ftp::users{
  #initiate the pam module, clear unused user accounts
  ftpuser_init{ 'init': }



######################################################
#   FTP USER ACCOUNTS ARE DEFINED HERE!              #
######################################################

  ftpuser{ 'someuser1':
    require => ftpuser_init['init'],
    homefolder => "/home/ftpuser/ftp.user1directory.com",
    username => "someuser1",
    password => "someusers1pass",
  }

  ftpuser{ 'someuser2':
    require => ftpuser_init['init'],
    homefolder => "/home/ftpuser/ftp.user2directory.com",
    username => "someuser2",
    password => "someusers2pass",
  }
}


I hope this is helpful for anyone else looking at a way to deploy new ftp users without relying solely on individual system security.

Last edited by colbyshores; 11-29-2013 at 06:19 PM.. Reason: Please use code tags, not icode tags for code blocks. Thanks.
# 9  
Old 11-29-2013
Nothing in this thread has explained why you actually need this, why you think hashed passwords cannot be shared or managed.
# 10  
Old 11-29-2013
I use puppet to deploy servers as well as LDAP. System Pam does not work well with this configuration eliminating the possibility of simply creating FTP users within puppet its self. I needed to create virtual users. The problem is that virtual user accounts relying on that pam module are hashed. This does not allow a user group's accounts to be rolled out to multiple machines.

I asked if clear text was an option because these accounts only have access to specific folders and certainly not the password file. After some work I created a few functions in puppet that exist entirely within puppet that operate each machine as if I where in front of it. The password files are able to be created, proper configuration and everything is working as it should now.

Im sure I am not the only person that has run in to password issues using LDAP in a Puppet configuration even if it is not related to FTP. That is why I posted a solution for virtual users.
# 11  
Old 12-02-2013
So, you have access to recompile the server, but not to alter /etc/passwd?
Login or Register to Ask a Question

Previous Thread | Next Thread

6 More Discussions You Might Find Interesting

1. UNIX for Advanced & Expert Users

When did UNIX start using encrypted passwords, and not displaying passwords when you type them in?

I've been using various versions of UNIX and Linux since 1993, and I've never run across one that showed your password as you type it in when you log in, or one that stored passwords in plain text rather than encrypted. I'm writing a script for work for a security audit, and two of the... (5 Replies)
Discussion started by: Anne Neville
5 Replies

2. AIX

Convert clear text into binary

Hi I need to display the binary text of an clearn text which is sent as input to the shell script (c shell); ex: I will pass "HELLO" as input, and i should get the binary format of the text Thanks in advance Mohan (1 Reply)
Discussion started by: mKarri
1 Replies

3. Linux

How to convert Linux Kernel built-in module into a loadable module

Hi all, I am working on USB data monitoring on Fedora Core 9. Kernel 2.6.25 has a built-in module (the one that isn't loadable, but compiles and links statically with the kernel during compilation) to snoop USB data. It is in <kernel_source_code>/drivers/usb/mon/. I need to know if I can... (0 Replies)
Discussion started by: anitemp
0 Replies

4. Shell Programming and Scripting

usage of module Text::Wrap;

hi, i want to use module Text::Wrap. this module provides the option $Text::Wrap::tabstop to change the tabstop from 8 blanks to any nummer. i want to set it to 30 blanks. but when i change the nummer of blanks nothing happens. Text::Wrap::tabstop = 30; $wtd = wrap("","\t",$1); or do i... (3 Replies)
Discussion started by: trek
3 Replies

5. Solaris

Apache on Solaris10 configured with loadable module support?

I have Apache 2 webserver as delivered with the Solaris 10 installation. How to verify if Apache is configured with loadable module support? Or if needs to be recompiled with loadable module support. (2 Replies)
Discussion started by: kavera
2 Replies

6. Programming

Module Support! How does it work?

ey everyone, I have been working on an application for a while, and would like others to be able to add modules for it. The problem is, I don't know how to implement them. I am using the dlopen() library set. I understand how to load modules into t he program and how to execute the code.... (5 Replies)
Discussion started by: farhan00
5 Replies
Login or Register to Ask a Question