Enabling md5 shadow password with authconfig

If you notice that /etc/shadow file password is using DES encryption, MD5 encryption can be enabled via:

authconfig --enablemd5 --enableshadow --update

If authconfig is not present edit, "/etc/pam.d/system-auth" and add "md5 shadow" to line starting with "password sufficient" so it looks like below:

password    sufficient md5 shadow nullok try_first_pass use_authtok

Setup secure ProFTPd

Ftp can be secured using ftps to connect. Below outlines a configuration to support such a setup using TLS/SSL.

I usually use the epel repository to install proftpd:

yum --enablerepo=epel install proftpd

Configure for tls/ssl connection:

<IfModule mod_tls.c>
TLSEngine                       on
TLSRequired                     off
TLSRSACertificateFile           /etc/pki/tls/proftpd/server.cert.pem
TLSRSACertificateKeyFile        /etc/pki/tls/proftpd/server.key.pem
TLSVerifyClient                 off
TLSRenegotiate                  required off
TLSLog                          /var/log/proftpd/tls.log

chroot and bindsocket to listen to single IP:

SocketBindTight                 on
DefaultRoot                     ~

Setup passive ftp ports:

PassivePorts 50000 51000

Create the certs:

mkdir -p /etc/pki/tls/proftpd
cd /etc/pki/tls/proftpd
openssl req -new -x509 -days 9999 -nodes -out server.cert.pem -keyout server.key.pem

Create /etc/pam.d/ftp so PAM can authenticate for proftpd:

auth    required     nullok
account required
session required

Add "/bin/false" to "/etc/shells" file and use it as the shell type when creating new users:

useradd -s /bin/false <ftp_user>

set_loginuid failed opening loginuid

If this file doesn't exist:

/proc/<pid of crond>/loginuid

It's because the kernel doesn't have AUDIT enabled. So you get a bunch of errors in "/var/log/secure" with "set_loginuid failed opening loginuid".

Recompile kernel with audit support:


If recompiling of kernel is not an option then:

Comment the below lines from all pam.d files.

session required

Find files via:

# grep -l /etc/pam.d/*

Syndicate content