Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to set up FTP access on a Debian box running Apache. Creating an FTP user via useradd works over port 22... but only if I don't restrict shell access via -s /dev/null.

I've got vsftpd installed, and have theoretically opened up port 21 with iptables. But attempting to connect over this port causes the FTP client to completely hang and never connect.

Here're the iptables rules I applied:

iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d 202.54.1.20 --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT  
iptables -A OUTPUT -p tcp -s 202.54.1.20 --sport 21 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT  
iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d 202.54.1.20 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT  
iptables -A OUTPUT -p tcp -s 202.54.1.20 --sport 1024:65535 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT  
iptables -A OUTPUT -p tcp -s 202.54.1.20 --sport 20 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT  
iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d 202.54.1.20 --dport 20 -m state --state ESTABLISHED -j ACCEPT  
share|improve this question

migrated from stackoverflow.com Jul 22 '10 at 0:48

This question came from our site for professional and enthusiast programmers.

add comment

2 Answers 2

Try /bin/false as the shell instead of /dev/null. FTP is likely hanging because it's not able to execute /dev/null.

share|improve this answer
add comment

As already suggest, use /bin/false instead of /dev/null.
Check if /bin/false is inserted in /etc/shells.
Or you could use nologin(8).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.