{"id":19029838,"url":"https://github.com/proftpd/mod_ldap","last_synced_at":"2025-10-15T09:57:27.034Z","repository":{"id":145926281,"uuid":"1707714","full_name":"proftpd/mod_ldap","owner":"proftpd","description":"ProFTPD module for LDAP authentication","archived":false,"fork":false,"pushed_at":"2013-06-23T18:17:07.000Z","size":972,"stargazers_count":8,"open_issues_count":4,"forks_count":9,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-03-30T01:12:12.543Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"http://horde.net/~jwm/software/mod_ldap/","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/proftpd.png","metadata":{"files":{"readme":"README","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2011-05-05T18:23:36.000Z","updated_at":"2023-08-03T16:10:44.000Z","dependencies_parsed_at":"2023-03-23T07:40:53.410Z","dependency_job_id":null,"html_url":"https://github.com/proftpd/mod_ldap","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/proftpd%2Fmod_ldap","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/proftpd%2Fmod_ldap/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/proftpd%2Fmod_ldap/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/proftpd%2Fmod_ldap/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/proftpd","download_url":"https://codeload.github.com/proftpd/mod_ldap/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":249341821,"owners_count":21254193,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-08T21:15:31.211Z","updated_at":"2025-10-15T09:57:22.000Z","avatar_url":"https://github.com/proftpd.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"mod_ldap v2.9.3\n===============\n\nmod_ldap is a ProFTPD module that performs user authentication and\nname/UID/quota lookups against an LDAP directory.\n\n**Please note:** Read the Changes section below for mod_ldap v2.9 changes;\nsome significant changes have been made. Do *NOT* upgrade to mod_ldap v2.9\nor later before reading the Changes section.\n\nSections:\n1. Author\n2. How do I set up mod_ldap?\n3. Changes\n4. Thanks\n\n\n=========\n1. Author\n=========\n\nJohn Morrissey, \u003cjwm@horde.net\u003e, http://horde.net/~jwm/software/mod_ldap/.\nFeedback is much appreciated. If you're using mod_ldap successfully, are\nhaving problems getting mod_ldap up and running at your site, or have some\ncode improvements or ideas for development, please let me know!\n\n\n============================\n2. How do I set up mod_ldap?\n============================\n\n* tar xvzf proftpd-version.tar.gz\n* If you wish to use a newer version of mod_ldap that is not yet included\n  with a release version of ProFTPD, download the file mod_ldap.c and say:\n\n    cp -f mod_ldap.c proftpd-version/contrib\n\n* cd proftpd-version\n* ./configure --with-modules=mod_ldap\n* make\n* make install\n* The 'user-ldif' file contains a sample user ldif. Modify it to your liking\n  and say ldapadd -D your-root-dn -w your-root-dn-password \u003c ldif\n* You are *strongly* encouraged to read up on the LDAP config-file\n  directives in proftpd-version/doc/Configuration.html. At bare minimum,\n  you'll need LDAPServer, LDAPBindDN, and LDAPUsers configuration directives\n  in your proftpd.conf.\n\n  A set of basic mod_ldap configuration directives would look like:\n\n    LDAPServer localhost\n    LDAPBindDN cn=your-dn,dc=example,dc=com dnpass\n    LDAPUsers dc=users,dc=example,dc=com\n\n  Or, if your users are in a Microsoft Active Directory (note that mod_ldap\n  doesn't currently support Active Directory supplemental group memberships):\n\n    LDAPServer dc.example.com:3268\n    LDAPUseTLS on\n    LDAPBindDN \"cn=SRV_FTP_AUTH,ou=special accounts,dc=example,dc=com\" dnpass\n\n    LDAPUsers ou=Users,dc=example,dc=org (\u0026(sAMAccountName=%u)(objectclass=user))\n    LDAPAttr uid sAMAccountName\n    LDAPAttr gidNumber primaryGroupID\n    LDAPDefaultUID 65534\n    LDAPDefaultGID 65534\n    RequireValidShell off\n\n    CreateHome on\n    LDAPGenerateHomedir on\n    LDAPGenerateHomedirPrefix /home\n\n  Of course, you will need to update these configuration directives with\n  the proper values for your environment.\n\n\n==========\n3. Changes\n==========\nv2.9.3:\n- Fixed swapped DN/attr name interpolation in 'no attr for' error messages.\n  (Bug #3776)\n- %u is now interpolated in the LDAPDoQuotaLookups base DN, not just its\n  search filter template. (Bug #3789)\n- Fail explicitly when on/off is specified as the first argument to\n  LDAPUsers or LDAPGroups.\n- Don't emit the bind DN password in debug output when the bind is\n  successful.\n\nv2.9.2:\n- Prevent segmentation fault when no user filters (second and third\n  arguments to LDAPUsers) are specified.\n\nv2.9.1:\n- Handle potential NULL return value from crypt(). (Bug #3551)\n- Update README to mention the LDAPDNInfo -\u003e LDAPBindDN change in v2.9.0.\n\nv2.9.0:\n- Overhaul configuration directives, hopefully yielding a more\n  straightforward, easier way to configure mod_ldap. \n\n  The LDAPDoAuth and LDAPDoUIDLookups directives have been combined into the\n  new LDAPUsers directive. The third argument to LDAPDoUIDLookups (the UID\n  filter template) is now the third argument to LDAPUsers.\n\n  LDAPDoGIDLookups is now LDAPGroups.\n\n  LDAPDoQuotaLookups is now obsolete. The default quota can be specified\n  with the new LDAPDefaultQuota directive.\n\n  Also, the on/off booleans on these directives have been removed. Now, if\n  the directive is present, the corresponding functionality will be enabled.\n\n  For example, the previous configuration:\n\n    LDAPDNInfo cn=your-dn,dc=example,dc=com dnpass\n    LDAPDoAuth on ou=people,dc=horde,dc=net (uid=%u)\n    LDAPDoUIDLookups on ou=people,dc=horde,dc=net (uidNumber=%u)\n    LDAPDoGIDLookups on ou=groups,dc=horde,dc=net\n    LDAPDoQuotaLookups on ou=people,dc=horde,dc=net (uid=%u) false,hard,10485760,0,0,0,0,0\n\n  becomes:\n\n    LDAPBindDN cn=your-dn,dc=example,dc=com dnpass\n    LDAPUsers ou=people,dc=horde,dc=net (uid=%u) (uidNumber=%u)\n    LDAPGroups ou=groups,dc=horde,dc=net\n    LDAPDefaultQuota false,hard,10485760,0,0,0,0,0\n\n- Remove OpenSSL local verification of password hashes; 'LDAPAuthBinds on'\n  should do exactly the same thing in a more secure and standard way.\n- Remove deprecated LDAPNegativeCache and LDAPUseSSL directives.\n- Add group members to debug output.\n- Various internal improvements to comments, log/debug messages, style, and\n  logic.\n\nv2.8.23:\n* Add support needed by mod_sftp_ldap for fetching user public keys.\n* Bad LDAP lookup can cause mod_ldap segfault under some conditions.\n  (Bug #3424)\n\nv2.8.22:\n* Disable the LDAPUseSSL directive, instead logging a warning so existing\n  configurations do not cause ProFTPD startup failure. Previous versions\n  enabled TLS when this directive was enabled. This behavior was incorrect,\n  since the intended behavior was to enable LDAPS/LDAP over SSL. To use\n  LDAPS, specify the ldaps:// protocol in the LDAPServerURL URL(s).\n\n  If you wish to continue using TLS, you must modify your configuration to\n  specify the ldap:// scheme in the LDAPServerURL URL and add the directive\n  'LDAPUseTLS on' to your configuration.\n* Add support for quota profiles. If a user entry doesn't have an ftpQuota\n  attribute, search for the DN contained in the user's ftpQuotaProfileDN\n  attribute (if present) and use the ftpQuota attribute present on that DN.\n  (Bug #2617)\n* Fix segfaults in debug logging on platforms whose printf() does not\n  gracefully handle NULL string pointers. (Bug #3346)\n* Escape LDAP filter metacharacters in inserted values when interpolating\n  filter templates.\n* Emit a debug warning when an LDAP URL is specified without an explicit\n  search scope.\n* Bug 2922 locks authentication for an account to the same module that\n  fetched the original account information. Remove the kludge wherein\n  \"*\" is passed to pr_auth_check() if we're doing auth binds to prevent\n  other modules from processing authentication. This has the convenient\n  side effect of making the UserPassword directive work with LDAP-sourced\n  accounts. Bump the required ProFTPD version to 1.3.1rc3. \n* Emit correct LDAP timeout in debug message, accounting for the default if\n  none was specified. Reported by Nikos Voutsinas \u003cnvoutsin@noc.uoa.gr\u003e.\n\nv2.8.21:\n* Implement an internal failover mechanism instead of relying on the LDAP\n  SDK's built-in failover (if any). Fixes failover regression introduced\n  in v2.8.19 when ldap_initialize() was first used.\n* Multiple LDAP URL arguments may now be passed to LDAPServer:\n\n  LDAPServer ldap://127.0.0.1/??sub ldap://172.16.0.1/??sub\n* When setting whether to dereference LDAP aliases after connecting to\n  the LDAP server, treat failure as a hard failure and refuse to continue\n  with that LDAP server. Previously, failure when specifying whether to\n  dereference aliases would be logged but the connection to that server\n  would continue.\n\nv2.8.20:\n* Prevent the use of LDAPSearchScope or LDAPUseSSL when LDAPServer specifies\n  a URL. Instead, the desired search scope and SSL setting should be\n  specified by the URL.\n* When using OpenSSL for local password verification (as opposed to\n  'LDAPAuthBinds on'), make the Base64 encoding buffer larger to ensure\n  we account for expansion resulting from the encoding.\n* Retrieve all LDAP attributes when calling pr_ldap_user_lookup() since\n  it will need various attributes (to perform home directory generation,\n  for one). Thanks to Nikos Voutsinas \u003cnvoutsin@noc.uoa.gr\u003e.\n  http://forums.proftpd.org/smf/index.php/topic,3562.0.html\n* Portability fix: don't use ldap_initialize() and ldap_unbind_ext_s()\n  unless we're building against the corresponding versions of the OpenLDAP\n  SDK.\n\nv2.8.19:\n* Fix compilation with old LDAP SDKs (LDAP_API_VERSION \u003c 2000). Thanks to\n  Saju Paul \u003csaju.paul@messageway.com\u003e.\n* Define LDAP_SCOPE_DEFAULT if not defined by the SDK, fixing compilation\n  with (recent?) Sun LDAP headers.\n* Use the configured ldap_port in \"connected...\" debug message, not\n  LDAP_PORT.\n* Fix segfaults on client connect when an LDAP URL is used as an argument\n  to the LDAPServer directive. (Bug #3097)\n* Automatically enable LDAP TLS support based on a best guess as to whether\n  the installed LDAP SDK supports it.\n* Fixed missing ldap_init() -\u003e ldap_initialize() when updating for latest\n  LDAP C API. Fixes segfaults on (some?) 64-bit systems. (Bug #3046)\n\nv2.8.18:\n* Remove all local caching code in favor of the recently added caching in\n  the ProFTPD Auth layer.\n* Silence some compiler warnings.\n* To verify non-crypt() password hashes locally with OpenSSL, it is no\n  longer necessary to edit mod_ldap.c to enable HAVE_OPENSSL. Instead,\n  build ProFTPD with the --enable-openssl argument to configure.\n\nv2.8.17:\n* Use non-deprecated LDAP API functions if the LDAP SDK is new enough to\n  comply with draft-ietf-ldapext-ldap-c-api-04.\n\nv2.8.16:\n* Add 'LDAPAliasDereference never|search|find|always' directive, which\n  defaults to never. This default is compatible with previous versions,\n  which did not support alias dereferencing.\n* Fix LDAPAttr support when more than one LDAPAttr directive is used.\n* Sync with ProFTPD API: set session.auth_mech to indicate that we've\n  successfully authenticated the user.\n* Eliminate segfaults when group information for an LDAP user is available\n  from other sources (such as mod_auth_unix). Thanks to Erick Briere\n  \u003cErick.Briere@afp.com\u003e.\n* Make sure to count %u escapes as well as %v escapes when determining\n  filter length.\n* Fix parenthesizing in connection code.\n\nv2.8.15:\n* Erroneous release; contained 2.8.14 by mistake.\n\nv2.8.14:\n* Fix authentication when LDAPAuthBinds is enabled, which broke in 2.8.13.\n* Fix a typo in the group-by-name filter.\n\nv2.8.13:\n* This release REQUIRES ProFTPD 1.2.11rc1 or later.\n* mod_ldap now uses ProFTPD's CreateHome to create home directories. Some\n  LDAPHomedirOnDemand directives have been removed in favor of CreateHome.\n  The directives that apply to home directory path name generation still\n  exist, but have been renamed to LDAPGenerateHomedir.\n* The LDAP protocol version now defaults to LDAPv3. If you need to use\n  LDAPv2, say 'LDAPProtocolVersion 2' in your proftpd.conf. (Bug #2443)\n* LDAP attribute names are now configurable via proftpd.conf. For example,\n  if you want to change the uid attribute name, say 'LDAPAttr uid myUidAttr'\n  in your proftpd.conf.\n* The define to enable TLS support has been renamed to USE_LDAP_TLS.\n* The '%u' escape is now supported in all cases where '%v' is.\n* ProFTPD's UserPassword directive now works with LDAPAuthBinds enabled.\n  (Bug #2482)\n* Changed ldap_quota_lookup CMD to a HOOK.\n* Fixed a few compiler type warnings.\n\nv2.8.12:\n* Group code memory manipulation fixes (Phil Oester (phil at theoesters dot\n  com))\n* Default quota support\n* LDAP connections created for authenticated binds now honor the LDAPUseTLS\n  directive.\n\nv2.8.11:\n* mod_quotatab limit support\n* Allow ATTR_* compiler defines to be overridden on the build command line,\n  e.g.: CFLAGS=\"-DUID_ATTR=foo\" ./configure\n* The canonical username from the LDAP directory is now used in directory\n  creation.\n* LDAPForceHomedirOnDemand to force the use of the generated home directory\n  instead of the directory provided by the LDAP directory.\n* Support for permissions on LDAPHomedirOnDemand suffixes. You can say:\n\n  LDAPHomedirOnDemandSuffix foo:755 bar:700\n\n  in your proftpd.conf.\n* Support for %v escapes in LDAPDoAuth directive to allow fetching the\n  user's entry directly, without performing a search first. For example,\n\n  LDAPDoAuth on uid=%v,dc=example,dc=com\n\n  will fetch the entry uid=[username],dc=example,dc=com directly when a user\n  logs in, saving some effort on the part of the LDAP directory.\n* Leading directories are now checked for and creation is no longer\n  attempted if they already exist.\n* Miscellaneous pedanticism \u0026 cleanup in error messages and the code itself.\n\nv2.8.10:\n* Ditch ldap_build_filter() (non-portable and/or deprecated) in favor of\n  our own translation function. This should make mod_ldap build against\n  OpenLDAP 2.1.x and Novell eDirectory, among others.\n\nv2.8.9:\n* Added explicit OpenSSL link exception to the license.\n\nv2.8.8:\n* ProFTPD Bug 1659 - LDAP config handlers should use c-\u003epool instead of\n  permanent_pool\n\nv2.8.7:\n* Properly drop root privs in the LDAPHomedirOnDemand code if we're\n  returning prematurely due to an error condition.\n* Small cleanup of the LDAPHomedirOnDemand directory creation code.\n\nv2.8.6:\n* Fix to the user-caching code that now prevents the cache from\n  returning an empty password struct in certain situations.\n\nv2.8.5:\n* Small fix in the group handlers - group lookups would sometimes be\n  attempted even if they were disabled.\n\nv2.8.4:\n* Fix for segfaults when optional arguments are omitted from\n  LDAPDoGIDLookups directive\n\nv2.8.3:\n* Secondary group support (thanks to Andreas Strodl for providing patches)\n* LDAPHomedirOnDemand modes are now absolute; they are no longer subject\n  to ProFTPD's umask.\n* LDAPDefault[UG]ID directives should now support the full range of\n  32-bit UIDs.\n* Sanity checking is now done on LDAPDefault[UG]ID arguments to ensure\n  they're numeric.\n* LDAPDoGIDLookups now takes an extra argument. Its arguments are now:\n\n  LDAPDoGIDLookups on|off group-base-dn by-name-filter by-uid-filter\n\n  by-name-filter defaults to (\u0026(cn=%v)(objectclass=posixGroup)) and\n  by-uid-filter defaults to (\u0026(gidNumber=%v)(objectclass=posixGroup)).\n\nv2.8.2:\n* Fixed a privilege escalation bug. If LDAPHomedirOnDemand is enabled and\n  creation of the user's home directory fails, the server does not\n  relinquish root privileges. There shouldn't be exploitable, but all\n  users with LDAPHomedirOnDemand enabled are encouraged to upgrade.\n\nv2.8.1:\n* Fixed a bug that prevented proper permissions being applied to home\n  directories created on demand.\n* Fixed an issue that would prevent per-VirtualHost configuration directives\n  from being properly recognized.\n\nv2.8:\n* The username escape sequence in search filter templates has changed.\n  You must now use %v instead of %u as the escape for the username. For\n  example, if you had:\n\n    LDAPDoAuth on dc=example,dc=com (uid=%u)\n\n  in your proftpd.conf with a previous version of mod_ldap, you will need\n  to change this to:\n\n    LDAPDoAuth on dc=example,dc=com (uid=%v)\n\n* LDAPAuthBinds is now enabled by default. I'm sick of hearing \"Your\n  mod_ldap is broken; it won't talk to my LDAP server and I've ignored the\n  convenient error message about userPassword that mod_ldap logs.\"\n\n* The full path to user home directories is now created. Directories leading\n  up to the user's home directory are created root-owned and mode 755 (i.e.,\n  they are not subject to the mode argument to LDAPHomedirOnDemand). Home\n  directory creation now works for all users, not just users with the same\n  UID/GID as the main ProFTPD server. Lastly, the mode argument to\n  LDAPHomedirOnDemand is no longer subject to ProFTPD's Umask.\n\n* TLS support (You'll need to edit mod_ldap.c to define USE_LDAPV3_TLS and\n  recompile proftpd, then say 'LDAPUseTLS on' in your proftpd.conf). This\n  may or may not work with non-OpenLDAP SDKs; I'd love to hear if anyone has\n  it working with the Mozilla LDAP SDK or any others.\n\n* The LDAP search sizelimit is now set to prevent LDAP server thrashing with\n  wildcarded usernames.\n\n* Basic caching support has been added. This should cut down on the number\n  of queries made to the directory server. In addition, negative caching\n  is now enabled by default.\n\n* LDAPHomedirOnDemandSuffix can now take multiple arguments (multiple\n  directories to create) and can be activated independently of\n  LDAPHomedirOnDemand.\n\n* With the addition of LDAPHomedirOnDemandPrefix, home directories can now\n  be completely autogenerated, removing the need for a homeDirectory\n  attribute in each user's LDAP entry. Say:\n\n    LDAPHomedirOnDemandPrefix /home\n\n  in your proftpd.conf to give users a home directory with the format\n  /home/username. In this example, the user joe would be given the home\n  directory /home/joe.\n\n* Attribute names are now #defines at the top of mod_ldap.c. You can now\n  change attribute names by editing mod_ldap.c and recompiling.\n\n* The LDAPDefaultUID and LDAPDefaultGID directives can now be forced;\n  enabling LDAPForceDefaultUID or LDAPForceDefaultGID will apply the\n  default UID or GID (respectively) even if a user has a different UID/GID\n  in his uidNumber or gidNumber attribute.\n\n* Fairly extensive code cleanup and comment syncing.\n\nv2.7.6:\n* Fixing the OpenLDAP 2 fixes.\n\nv2.7.5:\n* Fixes for OpenLDAP 2 support.\n* Fix LDAP authentication filter use; previously, the user-specified search\n  filter would not be used in the second stage of authenticating a user.\n\nv2.7.4:\n* The LDAPDefaultAuthScheme directive should function properly now.\n\nv2.7.3:\n* Removed some old, useless code.\n\nv2.7.2:\n* LDAPQueryTimeout fix. In mod_ldap v2.7.1, in some situations, the query\n  timeout could be set to -1, which would cause all LDAP lookups to fail.\n\nv2.7.1:\n* Ported MacGyver's portable UID/GID code to mod_ldap\n* The value passed to LDAPQueryTimeout is now honored (the timeout isn't\n  simply set to 1 second)\n\nv2.7:\n* Added a fix for picky LDAP servers like Sun Directory Services; using\n  AuthBinds with those LDAP servers would break in previous mod_ldap\n  versions.  See the comments in the code for more details (search for \"Sun\n  Directory Services\").\n* You can now pass a file mode to LDAPHomedirOnDemand to create home\n  directories with that mode.\n* Improved group support; mod_ldap now supports multiple memberUid\n  attributes for a group object.\n* Miscellaneous neatening/tightening of high-level auth/lookup handler\n  functions.\n* You can now specify custom LDAP search filters at runtime. See the\n  configuration guide (doc/Configuration.html) entries for LDAPDo* for more\n  details.\n* Objectclass is now enforced. You *must* have an objectclass attribute for\n  each of your LDAP objects. This attribute must have a value of\n  'posixAccount' (\"objectclass: posixAccount\"). For groups, this attribute\n  must have the value 'posixGroup' (\"objectclass: posixGroup\"). If you wish\n  to disable this objectclass enforcement, use the the LDAP filter\n  \"(uid=%u)\" for Auth and UID lookups (see doc/Configuration.html for how to\n  specify a custom LDAP search filter).\n* Removed allowedServices code. The functionality that allowedServices\n  provided can now be duplicated with a modified LDAP search filter.\n\n  For example, to replicate basic allowedServices checking, pass this LDAP\n  search filter to LDAPDoAuth:\n  (\u0026(uid=%u)(|(allowedServices=*FTP*)(!(allowedService=*))))\n\n  To emulate deniedServices checking, use this search filter:\n  (\u0026(uid=%u)(!(deniedServices=*FTP*)))\n\n  To emulate *both* allowedServices and deniedServices checking, use this\n  filter (beware line wrap):\n  (\u0026(uid=%u)(|(allowedServices=*FTP*)(!(allowedService=*)))(!(deniedServices=*FTP*)))\n\nv2.6.1:\n* Fixed a bug that would prevent proper search scope selection.\n\nv2.6:\n* HomedirOnDemandSuffix - create an additional subdirectory in a user's home\n  directory (/home/user/anotherdirectory) on demand\n* Minor group fixes/cleanups - supplementary groups now work properly\n* Password {scheme}s are now treated in a case-insensitive manner.\n* Password-hash support for any crypto method OpenSSL supports\n  To enable extended OpenSSL password hash support, edit mod_ldap.c and\n  uncomment #define HAVE_OPENSSL. You'll also need to edit Make.rules to\n  link against OpenSSL. Further details are provided in mod_ldap.c.\n* Runtime search scope selection; one-level or subtree searches can be\n  selected from proftpd.conf.\n\nv2.5.2:\n* Fixed a bug that would allow unauthorized users to log in when mod_ldap\n  is used with other authentication modules and LDAPAuthBinds is set to on.\n\nv2.5.1:\n* Fixed a one-line bug that broke password authentication when AuthBinds\n  weren't being used.\n\nv2.5:\n* Authenticated bind support added. mod_ldap now fetches all user information\n  except for userPassword as the DN specified in LDAPDNInfo and then re-binds\n  to the LDAP server as the connecting user with the user-supplied password.\n  If the bind succeeds, the user is allowed to log in. This also has the\n  added advantage of allowing mod_ldap to support any password encryption\n  scheme that your LDAP server supports. Also, a privileged DN is no longer\n  needed to read the userPassword attribute from the LDAP server.\n* Realized I wasn't checking the return value of find_config() for NULL\n  values, this would cause ProFTPD to segfault if certain config file\n  entries were not present.\n* Removed debugging code that might contain NULL values; passing a NULL\n  value to printf() and friends under Solaris causes a segfault.\n* Miscellaneous cleanups, code neatening.\n\nv2.0:\n* Config file syntax revamped:\n   LDAPServer            localhost\n   LDAPDNInfo            cn=your-dn,dc=horde,dc=net dnpass\n   LDAPQueryTimeout      5\n   LDAPDoAuth            on \"dc=users,dc=horde,dc=net\"\n   LDAPDoUIDLookups      on \"dc=users,dc=horde,dc=net\"\n   LDAPDoGIDLookups      on \"dc=groups,dc=horde,dc=net\"\n   LDAPDefaultUID        35000\n   LDAPDefaultGID        1000\n   LDAPNegativeCache     on\n   LDAPHomedirOnDemand   on\n   LDAPDefaultAuthScheme clear\n* Configurable LDAP query timeout [Peter Deacon \u003cpeterd@iea-software.com\u003e]\n* Cleartext password \"encryption\" scheme (\"{clear}mypass\")\n* UID-to-name and GID-to-name lookups in directory listings\n* Separate prefixes for user and group lookups\n* Can turn on/off UID-to-name and GID-to-name lookups independently\n* Default [UG]IDs. Say you want to have a web-toaster type of deal, with\n  all users having the same [UG]IDs. Just don't put [ug]idNumber attrs in\n  your LDAP database for those users, and set these configuration\n  directives. Any user that doesn't have a [UG]ID in the LDAP database will\n  have that info filled in with the default [UG]ID.\n* mod_ldap is now able to function in a pure virtual-user environment;\n  please note, however, that the loginShell LDAP attr still must be a\n  valid shell. You can turn this check off by saying RequireValidShell off\n  in your proftpd.conf\n* allowedServices attr: (I broke with objectclass here, couldn't find\n  something that seemed to fit this.) This attribute contains a\n  comma-deliminated list of services to allow this particular user.  The\n  string \"FTP\" corresponds to FTP service. If no allowedServices attr is\n  present, all services will be allowed.\n* You can have alternate LDAP servers; just specify LDAPServer \"host1\n  host2\"; [Peter Deacon \u003cpeterd@iea-software.com\u003e]\n* LDAPHomedirOnDemand to automatically create home directories in a\n  virtual-user environment. [patch: Bert Vermeulen \u003cbert@be.easynet.net\u003e]\n* LDAPDefaultAuthScheme to select the authentication scheme to use when\n  no {prefix} is present in a user's userPassword LDAP attr.\n  [patch: Bert Vermeulen \u003cbert@be.easynet.net\u003e]\n* Virtual hosting support may or may not work okay; theoretically, I think\n  adding LDAP configuration directives to a \u003cVirtualHost\u003e block will work,\n  but this hasn't been tested.\n\nNew Tested Platforms:\n\n* Solaris 2.6 with Netscape Directory Server and the Mozilla LDAP C SDK,\n  available at http://www.mozilla.org/directory/csdk.html.\n  Peter Fabian \u003cfabian@staff.matavnet.hu\u003e\n* Solaris 7 with gcc 2.95.1 and OpenLDAP 1.2.7\n  Ralf Kruedewagen \u003cRalf.Kruedewagen@meocom.de\u003e\n\nv1.2:\n* made the variables for the config entries static\n* moved the meat of the ldap querying code to a separate function, this\n  gets the individual getpw*() handlers down to about 15-20 lines each.\n  also paves the way for easy LDAP group lookups too.\n* explicitly set ld = NULL in p_endpwent(), looks like ldap_unbind()\n  doesn't always set it to NULL, and bad things happen later.\n* fixed a showstopper: if there's a user/group directive in proftpd.conf,\n  mod_ldap:getpwnam() will be called to look up the user. since the\n  LDAP config variables aren't initialized yet, the LDAP libraries crash\n  and burn upon encountering a NULL ldap_prefix. put some checks in\n  p_setpwent() to check for this and disable LDAP lookups before the\n  parent forks and the config is initialized. thanks to Sean Murphy\n  \u003csmurphy@berbee.com\u003e for sending me on this path.\n* modified pw_auth() so that it will assume crypt() if there's no leading\n  {scheme} in the password returned by the LDAP query.\n* pw_auth() turned off logging of unidentifiable password encryption\n  schemes; this would syslog the encrypted password returned by the ldap\n  server. many people have their logs tightened, but not all.\n* a few miscellaneous changes \u0026 cleanups\n\nv1.1:\n* Added $Libraries$ directive to mod_ldap so the module is now entirely\n  self-contained.\n* Changed one reference to sprintf() to snprintf() and changed uidstr\n  in p_getpwuid() to have a length of BUFSIZ.\n* Added config option (LDAPNegativeCache) to turn LDAP negative caching\n  on and off. The default is off (don't do LDAP negative caching).\n* Added entries to doc/Configuration.html for all the LDAP configuration\n  directives.\n* MacGyver added mod_ldap to the ProFTPD CVS tree; proftpd-ldap-1.1\n  is now in sync with ProFTPD CVS.\n\nv1.0:\n* Initial release of proftpd-ldap\n\n\n=========\n4. Thanks\n=========\n\n* Everyone listed in mod_ldap.c for contributing code.\n\n* James (james at wwnet dot net) for a copy of his LDAP module that he never\n  released\n* Krzysztof Dabrowski (brush at pol dot pl) for some big virtual-user ideas\n* Peter Deacon (peterd at iea-software dot com) for ideas \n* Peter Fabian (fabian at staff dot matavnet dot hu) for ideas and a tested\n  platform\n* Justin Hahn (jeh at profitlogic dot com) for good ideas and debate\n* Ralf Kruedewagen (Ralf dot Kruedewagen at meocom dot de) for a tested\n  platform\n* Steve Luzynski (steve at uniteone dot net) for extra help/testing/feedback\n* Scott Murphy (smurphy at berbee dot com) for a trouble report \n* Marcin Obara for lots of testing\n* Miguel Barreiro Paz (mbpaz at edu dot aytolacoruna dot es) for a supported\n  platform and new supported LDAP server\n* Everyone else who has sent feedback, bug reports, feature requests,\n  and ideas.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fproftpd%2Fmod_ldap","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fproftpd%2Fmod_ldap","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fproftpd%2Fmod_ldap/lists"}