1

I have vsftpd server that allow local users to login to ftp. How to prevent some local user to login to shell account and allow only login to ftp server (vsftpd) ?

3 Answers 3

3

You should use virtual users and be careful with logins match between them

[vsftpd.conf]/etc/vsftpd.conf

listen=YES
anonymous_enable=NO
local_enable=YES
virtual_use_local_privs=YES
write_enable=YES
connect_from_port_20=YES
secure_chroot_dir=/var/run/vsftpd
pam_service_name=vsftpd #look here
guest_enable=YES
guest_username=ftp #carefull
user_sub_token=$USER
local_root=/var/ftpserver/ #careful
chroot_local_user=YES
hide_ids=YES
syslog_enable=YES
file_open_mode=0666
local_umask=0022

[vsftpd]/etc/pam.d/vsftpd
auth    required pam_pwdfile.so pwdfile /etc/vsftpd.passwd # htpasswd file
account required pam_permit.so

and create htpasswd -c /etc/vsftpd.passwd username

1

In short: Use virtual users.

http://howto.gumph.org/content/setup-virtual-users-and-directories-in-vsftpd/

http://eviladmin.org/tutorials/vsftpd.html

1

I don't think using virtual users is necessary at all. Regular users will do just fine.

Add a line to /etc/shells, if it is not already there:

/bin/false

For the users you would like only to be able to use FTP, edit /etc/passwd and change their shell (usually defaults to with /bin/bash or /bin/sh) to /bin/false

e.g.:

From this:

jdoe:x:1000:1000:John:/home/fbh:/bin/bash

To this

jdoe:x:1000:1000:John:/home/fbh:/bin/false

This way, that user will only be able to login using FTP.

2
  • 2
    Unless you are using FTP over TLS, this provides any eavesdropping party with a username and password of a REAL account on the ftp server. Virtual users don't provide that.
    – vezult
    Mar 29, 2011 at 12:56
  • This solution does not work on recent versions of Operating Systems (and/or) vsftpd, at least.. not on CentOS. For this to work, you need to comment out: auth required pam_shells.so in /etc/pam.d/vsftpd Oct 10, 2020 at 2:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .