Novell迷

Here are the recommended steps to prevent LDAP anonymous binds via FTP to the OES2 server.

1. Install Novell FTP through the OES install and configuration within YAST.  
   
   
2. Go to the LDAP server object through iManager. Go to the Connections section of the General Tab. Under Restrictions change the bind restrictions to "Disallow anonymous simple bind" Apply the setting, go to the General Information tab and choose the refresh button to reload LDAP.
   
   
3. Go to the LDAP group object through iManager. Uncheck the "require TLS for Simple Binds with password"
   
   
4. Edit the /etc/ldap.conf. The below changes / settings are required:
   
   • host <ipaddr>  (recommend local ip address)
   • base <FDN of base> (example: "base o=novell")
   • ldap_version 3
   • bind_policy soft
   • binddn <FDN of user> (this is your proxy user that will authenticate. This is required for the disabled anonymous bind to work.)
   • bindpw <password of binddn user>
   • pam_lookup_policy yes
   • pam_password nds
   • change "ssl on" to "ssl no"
   • uncomment the nss_map_attribute uniqueMember member line
   • comment out the ssl start_tls comment Novell迷网站內容，版权所有
     
     
5. Edit the /etc/pure-ftpd/pure-ftpd.conf file.
   
   • Enable parameter CreateHomeDir to yes.
     
   • Set the AnonymousOnly to no if you want eDirectory users to authentitcate as the ftp user.
     
   • Set the NoAnonymous to yes if you don't want any anonymous ftp users.
     
   • If you wish to login to ftp as an anonymous ftp user, when it prompts for a user, type "anonymous". (This is different than LDAP anonymous authentication)
   
   
6. As anonymous LDAP binds are disabled, you will want to configure LUM to use a proxy user. Modify the nam.conf to do this. Make sure the proxy user has sufficient rights to the LUM objects in the tree.

• proxy-user-fdn=cn=lum-proxy,o=novell
• proxy-user-pwd=novell

Make sure to add a replica of the partition where the user objects are located as well as the server's ncp server object. This will help with LUM, FTP and LDAP related events. 本文转载自http://novell.me

LUM enable all users you wish to FTP into the box.

Run the following commands to get the services back up and running:
rcpure-ftpd stop
rcpure-ftpd start
nldap -u
nldap -l
rcnamcd stop
rcnamcd start 转载请注明出处！
本文地址 http://novell.me/SUSE/2009/0503/setup-ftp-on-oes2.html
(责任编辑：Novell迷)