I understand how to set up SFTP servers on Linux and create users and their passwords manually.

So basically, the users get authenticated as normal Linux users get authenticated through /etc/passwd. Is there any way to introduce a third party for the user and credentials management?

I am setting up the server on Google Kubernetes Engine. I see AWS provides SFTP as a service and I wanna achieve something similar on GCP.

Here is what AWS is doing: enter image description here

AFAIK, everything (1,2 and 4) from the above image is in place except AWS IAM and Amazon Route S3 (point-3).

I have given AWS reference just as an example. I am looking for a way to use a third party to manage my SFTP users and credentials instead of normally using /etc/passwd.

There are tools available like okta, gsuite, Google Cloud Identity, etc. But I am not sure how to leverage them to manage users in an SFTP server.

  • Try FreeIPA: HA, a lots of integrations, self-managment portal, … Commented Apr 20, 2020 at 20:56

1 Answer 1


On a common linux instances the user are authenticated against /etc/passwd, because YOU SPECIFICALLY ASK for this behavior.

For example, when I install vsftpd, I can see a new file created under /etc/pam.d

cat /etc/pam.d/vsftpd

# Standard behaviour for ftpd(8).
auth    required        pam_listfile.so item=user sense=deny file=/etc/ftpusers onerr=succeed

# Note: vsftpd handles anonymous logins on its own. Do not enable pam_ftp.so.

# Standard pam includes
@include common-account
@include common-session
@include common-auth
auth    required        pam_shells.so

And in common-auth you would find something like

auth [success=1 default=ignore] pam_unix.so nullok_secure

man pam_unix:

       This is the standard Unix authentication module. It uses standard calls from the system's libraries to retrieve and set account information as well as authentication. Usually this is obtained from the /etc/passwd and the
       /etc/shadow file as well if shadow is enabled.

You can authenticate unix logins against MySQL if you want to https://github.com/NigelCunningham/pam-MySQL

So either you can use some kind of a standard sftp solution with a custom pam module like AWS Cognito https://gist.github.com/ergo70/ca776d1f49c464c07930d94c6e8b01aa

Or you can use a solution which includes another means of authentication. I don't say that it is the best solution, but you can try to install CrushFTP - there is a free limited version - just to see if this is the way you want to go.

  • 1
    Another common use case for PAM is to offload authentication to an LDAP server in an enterprise environment, and there are probably PAM modules for using Okta or Google Cloud Identity.
    – Jesusaur
    Commented Sep 27, 2023 at 18:38
  • 1
    @Jesusaur - oh, I always forget about the enterprise environment. Yes, you can write your own module or do anything you want. But you have a good point. LDAP is common and I bet nowadays you can find a PAM module for many things.
    – petrchpetr
    Commented Sep 29, 2023 at 6:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.