In case anyone encountered this. I got creative with my puppet module and created a couple of functions to accomplish the creation/deletion of virtual user accounts within puppet.
This works
Hopefully, anyone else who utilizes LDAP and Puppet will benefit from it.
Here are my functions:
define ftpuser_init{
exec { "remove_existing_users":
command => "rm /etc/vsftpd/users/*; rm /etc/vsftpd/chroot_list; rm /etc/vsftpd/passwd; rm /etc/vsftpd/user_list"
}
package { 'pam_pwdfile':
provider => 'rpm',
ensure => installed,
source => "http://install.companyreposity.com/repo/RCE/SLES11-SP1-Pool/sle-11-x86_64/rpm/x86_64/pam_pwdfile-0.99-9026.1.x86_64.rpm"
}
file { "/etc/vsftpd/"]:
ensure => "directory",
}
file { "/etc/pam.d/vsftp_local_and_virtual":
ensure => 'present',
owner => 'root',
group => 'root',
mode => 0644,
source => "puppet:///ftp/vsftpd_local_and_virtual"
}
exec { "password_file":
require => exec"remove_existing_users"],
command => "touch /etc/vsftpd/passwd"
}
}
define ftpuser ( $username, $password, $homefolder){
user { $username:
ensure => 'present',
}
exec{ "htpasswd_$username":
command => "htpasswd2 -b /etc/vsftpd/passwd ${username} ${password}",
}
exec{ "chroot_list_$username":
require => exec"htpasswd_$username"],
command => "echo ${username} >> /etc/vsftpd/chroot_list",
}
exec{ "user_list_$username":
require => exec"chroot_list_$username"],
command => "echo ${username} >> /etc/vsftpd/user_list",
}
exec { "profile_$username":
require => exec"user_list_$username"],
command => "touch /etc/vsftpd/users/${username}",
}
exec { "guest_username_$username":
require => exec"profile_$username"],
command => "echo guest_username=$username >> /etc/vsftpd/users/$username",
}
exec { "local_root_$username":
require => exec"guest_username_$username"],
command => "echo local_root=$homefolder >> /etc/vsftpd/users/$username",
}
}
ftp_userinit is called before the users are initiated. This allows puppet to clear out the users that are there and start fresh. An example of how to call this would be something like this:
class ftp::users{
#initiate the pam module, clear unused user accounts
ftpuser_init{ 'init': }
######################################################
# FTP USER ACCOUNTS ARE DEFINED HERE! #
######################################################
ftpuser{ 'someuser1':
require => ftpuser_init'init'],
homefolder => "/home/ftpuser/ftp.user1directory.com",
username => "someuser1",
password => "someusers1pass",
}
ftpuser{ 'someuser2':
require => ftpuser_init'init'],
homefolder => "/home/ftpuser/ftp.user2directory.com",
username => "someuser2",
password => "someusers2pass",
}
}
Granted this assumes you have vsftp installed via puppet and your user config files within /etc/vsftp/users
I hope this is helpful for anyone else looking at a way to deploy new ftp users without relying solely on individual system security.