Unable to login via FTP unless shell is enabled

Question

I'm trying to set up FTP access on a Debian box running Apache. Creating an FTP user via useradd works over port 22... but only if I don't restrict shell access via -s /dev/null.

I've got vsftpd installed, and have theoretically opened up port 21 with iptables. But attempting to connect over this port causes the FTP client to completely hang and never connect.

Here're the iptables rules I applied:

iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d 202.54.1.20 --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT  
iptables -A OUTPUT -p tcp -s 202.54.1.20 --sport 21 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT  
iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d 202.54.1.20 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT  
iptables -A OUTPUT -p tcp -s 202.54.1.20 --sport 1024:65535 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT  
iptables -A OUTPUT -p tcp -s 202.54.1.20 --sport 20 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT  
iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d 202.54.1.20 --dport 20 -m state --state ESTABLISHED -j ACCEPT  

Answer 1

Try /bin/false as the shell instead of /dev/null. FTP is likely hanging because it's not able to execute /dev/null.

Answer 2

As already suggest, use /bin/false instead of /dev/null.
Check if /bin/false is inserted in /etc/shells.
Or you could use nologin(8).