Answers: <p>On a common linux instances the user are authenticated against <code>/etc/passwd</code>, because <strong>YOU SPECIFICALLY ASK</strong> for this behavior.</p>
  <p>For example, when I install vsftpd, I can see a new file created under <code>/etc/pam.d</code></p>
  <pre><code>cat /etc/pam.d/vsftpd
  
  # Standard behaviour for ftpd(8).
  auth    required        pam_listfile.so item=user sense=deny file=/etc/ftpusers onerr=succeed
  
  # Note: vsftpd handles anonymous logins on its own. Do not enable pam_ftp.so.
  
  # Standard pam includes
  @include common-account
  @include common-session
  @include common-auth
  auth    required        pam_shells.so
  </code></pre>
  <p>And in <code>common-auth</code> you would find something like</p>
  <p><code>auth    [success=1 default=ignore]      pam_unix.so nullok_secure</code></p>
  <p><code>man pam_unix:</code></p>
  <pre><code>DESCRIPTION
         This is the standard Unix authentication module. It uses standard calls from the system's libraries to retrieve and set account information as well as authentication. Usually this is obtained from the /etc/passwd and the
         /etc/shadow file as well if shadow is enabled.
  
  </code></pre>
  <p>You can authenticate unix logins against MySQL if you want to <a href="https://github.com/NigelCunningham/pam-MySQL" rel="nofollow noreferrer">https://github.com/NigelCunningham/pam-MySQL</a></p>
  <p>So either you can use some kind of a standard sftp solution with a custom pam module like AWS Cognito <a href="https://gist.github.com/ergo70/ca776d1f49c464c07930d94c6e8b01aa" rel="nofollow noreferrer">https://gist.github.com/ergo70/ca776d1f49c464c07930d94c6e8b01aa</a></p>
  <p>Or you can use a solution which includes another means of authentication. I don't say that it is the best solution, but you can try to install CrushFTP - there is a free limited version - just to see if this is the way you want to go.</p>
  
Answers: CC BY-SA 4.0
Answers: 2023-09-27T18:38:06.123Z
Answers: Another common use case for PAM is to offload authentication to an LDAP server in an enterprise environment, and there are probably PAM modules for using Okta or Google Cloud Identity.
Answers: Jesusaur
Answers: CC BY-SA 4.0
Answers: 2023-09-29T06:59:35.810Z
Answers: @Jesusaur - oh, I always forget about the enterprise environment. Yes, you can write your own module or do anything you want. But you have a good point. LDAP is common and I bet nowadays you can find a PAM module for many things.
Answers: petrchpetr
Answers: CC BY-SA 4.0
Answers: 2021-09-07T12:23:39.670Z
Answers: 2021-09-07T12:23:39.670Z
Answers: petrchpetr
Body: <p>I understand how to set up SFTP servers on Linux and create users and their passwords manually.</p>
  
  <p>So basically, the users get authenticated as normal Linux users get authenticated through <code>/etc/passwd</code>. Is there any way to introduce a third party for the user and credentials management?</p>
  
  <p>I am setting up the server on Google Kubernetes Engine. I see AWS provides <a href="https://aws.amazon.com/sftp/?whats-new-cards.sort-by=item.additionalFields.postDateTime&amp;whats-new-cards.sort-order=desc" rel="nofollow noreferrer">SFTP as a service</a> and I wanna achieve something similar on GCP.</p>
  
  <p>Here is what AWS is doing:
  <a href="https://i.sstatic.net/lYrkE.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/lYrkE.png" alt="enter image description here"></a></p>
  
  <p>AFAIK, everything (1,2 and 4) from the above image is in place except AWS IAM and Amazon Route S3 (point-3).</p>
  
  <p>I have given AWS reference just as an example. I am looking for a way to use a third party to manage my SFTP users and credentials instead of normally using <code>/etc/passwd</code>.</p>
  
  <p>There are tools available like okta, gsuite, Google Cloud Identity, etc. But I am not sure how to leverage them to manage users in an SFTP server.</p>
  
Comments: CC BY-SA 4.0
Comments: 2020-04-20T20:56:16.650Z
Comments: Try FreeIPA: HA, a lots of integrations, self-managment portal, …
Comments: Alexey Vazhnov
Tags: <amazon-web-services><kubernetes><linux><gcp>
Title: SFTP server with third party user management system?
UserDisplayName: Amit Yadav
ThreadText: # SFTP server with third party user management system?
  
  (Asked by: username_0 on 2020-02-21)
  
  I understand how to set up SFTP servers on Linux and create users and their passwords manually.
  
  So basically, the users get authenticated as normal Linux users get authenticated through `/etc/passwd`. Is there any way to introduce a third party for the user and credentials management?
  
  I am setting up the server on Google Kubernetes Engine. I see AWS provides [SFTP as a service](https://aws.amazon.com/sftp/?whats-new-cards.sort-by=item.additionalFields.postDateTime&whats-new-cards.sort-order=desc) and I wanna achieve something similar on GCP.
  
  Here is what AWS is doing:
  [![enter image description here](https://i.sstatic.net/lYrkE.png)](https://i.sstatic.net/lYrkE.png)
  
  AFAIK, everything (1,2 and 4) from the above image is in place except AWS IAM and Amazon Route S3 (point-3).
  
  I have given AWS reference just as an example. I am looking for a way to use a third party to manage my SFTP users and credentials instead of normally using `/etc/passwd`.
  
  There are tools available like okta, gsuite, Google Cloud Identity, etc. But I am not sure how to leverage them to manage users in an SFTP server.
  
  **Tags:** amazon-web-services, kubernetes, linux, gcp
  
  > **Comments:**
  > **username_1**: Try FreeIPA: HA, a lots of integrations, self-managment portal, …  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2021-09-07. Score: 1
  
  On a common linux instances the user are authenticated against `/etc/passwd`, because **YOU SPECIFICALLY ASK** for this behavior.
  
  For example, when I install vsftpd, I can see a new file created under `/etc/pam.d`
  
  ```
  cat /etc/pam.d/vsftpd
  
  # Standard behaviour for ftpd(8).
  auth    required        pam_listfile.so item=user sense=deny file=/etc/ftpusers onerr=succeed
  
  # Note: vsftpd handles anonymous logins on its own. Do not enable pam_ftp.so.
  
  # Standard pam includes
  @include common-account
  @include common-session
  @include common-auth
  auth    required        pam_shells.so
  
  ```
  
  And in `common-auth` you would find something like
  
  `auth [success=1 default=ignore] pam_unix.so nullok_secure`
  
  `man pam_unix:`
  
  ```
  DESCRIPTION
         This is the standard Unix authentication module. It uses standard calls from the system's libraries to retrieve and set account information as well as authentication. Usually this is obtained from the /etc/passwd and the
         /etc/shadow file as well if shadow is enabled.
  
  ```
  
  You can authenticate unix logins against MySQL if you want to <https://github.com/NigelCunningham/pam-MySQL>
  
  So either you can use some kind of a standard sftp solution with a custom pam module like AWS Cognito <https://gist.github.com/ergo70/ca776d1f49c464c07930d94c6e8b01aa>
  
  Or you can use a solution which includes another means of authentication. I don't say that it is the best solution, but you can try to install CrushFTP - there is a free limited version - just to see if this is the way you want to go.
  
  > **Comments:**
  > **username_3**: Another common use case for PAM is to offload authentication to an LDAP server in an enterprise environment, and there are probably PAM modules for using Okta or Google Cloud Identity.  
  > **username_2**: @username_3 - oh, I always forget about the enterprise environment. Yes, you can write your own module or do anything you want. But you have a good point. LDAP is common and I bet nowadays you can find a PAM module for many things.  
  
  ---
  
  