proftpd and FreeBSDThis article describes how I got proftpd to work with FreeBSD 3-3 STABLE.
BackgroundI recently upgraded a box from 3.3-RELEASE to 3.3-STABLE. In the process, I encountered problems with proftpd. Specifically, anonymous login worked, but regular users could not log in. The error message was:
Dec 6 23:00:15 synergy proftpd: unable to resolve symbol: pam_sm_close_session Dec 6 23:00:16 synergy proftpd: PAM(dan): Authentication failure Dec 6 23:00:16 synergy proftpd: USER dan: incorrect password from yourbox.yourdomain.org [10.0.0.20] to 10.0.0.100:21
My first port of call was the proftpd homepage at http://www.proftpd.org/ and I checked the http://hamster.wibble.org/proftpd/ questions on PAM. I followed the suggestions (found there and in the FreeBSD mailing list archives) and remove the entry from /etc/pam.conf (third line shown below):
ftp auth required pam_unix.so try_first_pass ftp account required pam_unix.so try_first_pass #ftp session required pam_unix.so try_first_pass
But this didn’t allow the user to login. However, if I add the following option to /usr/local/etc/proftpd.conf:
the logins work but these errors remain:
Dec 7 00:04:07 synergy proftpd: PAM(dan): Authentication failure
SolutionAt the prompting of someone from the FreeBSD Questions mailing list, I went to archives at http://www.proftpd.org/proftpd-l-archive/ and starting searching. Eventually, I found http://www.proftpd.org/proftpd-l-archive/99-10/msg00632.html which mentioned proftpd-1.2.0pre9. I checked the ftp site at ftp://ftp.tos.net/pub/proftpd/ and found the file in question. I downloaded it, configured it, installed it, and it worked.
The installFirst I fetched the tarball:
/usr/ports/ftp/ fetch -P ftp://ftp.tos.net/pub/proftpd/proftpd-1.2.0pre9.tar.gz tar xvfz proftpd-1.2.0pre9.tar.gz cd proftpd-1.2.0pre9
In the README file, you’ll find a reference to --enable-force-setpassent. I eventually figured out that this refers to a command line parameter to ./configure. You should also read INSTALL.
I ran the configure script like this:
install_user=nobody install_group=wheel ./configure --enable-force-setpassent
This will run proftpd as user nobody in group wheel.
Note that the program will install to a different location than that of the port.
port /usr/local/libexec/proftpd this install /usr/local/sbin/proftpd
I had the port, so first I deinstalled the port:
The next step was:
make make install
Don’t forget to update your startup script to reflect the new location:
more /usr/local/etc/rc.d/proftpd.sh #!/bin/sh /bin/mkdir -p /var/run/proftpd if [ -x /usr/local/sbin/proftpd ]; then /usr/local/sbin/proftpd && echo -n ' proftpd' fi
With this new version, I removed:
from /usr/local/etc/proftpd.conf so proftpd would use PAM. Actually, the logins worked with or without PAM. So it’s your choice.