I have read, researched, tested, and still cannot seem to get this working correctly. I am running VSFTPD on Debian. With a test account configured to point the user's home directory to a mount point which actually resides on a NAS share, for example /home/ftp/NAS/UserHomeFolder, after connecting I can change directories to the root directory of the Linux Server and navigate to the etc folder, usr, and so forth. In my vsftpd.conf file I have chroot_local_user=YES, the chroot_list_file=/etc/vsftpd.chroot_list option is enabled and the account I am using is listed in the vsftpd.chroot_list file. With regard to PAM, I have pam_service_name=vsftpd. ssl_enable=YES, allow_anon_ss=NO, force_local_data_ssl=YES, force_local_logins_ssl=YES. If I use chsh -s /bin/nologin secureftptestaccount (I added the /bin/nologin to the shells list) I get access denied when attempting to connect to the FTP Server. So, what am I missing here? Thanks in advance for your help and insight.
1 Answer
When you set chroot_local_user=YES the effect of the chroot_list_file= reverses, it becomes a list of users who are NOT confined to chroot.
So remove the username of your test account from /etc/vsftpd.chroot_list and you should be fine.
A quick check with man vsftpd.conf would have explained that:
chroot_list_enable
If activated, you may provide a list of local users who are placed in a chroot() jail in their home directory upon login. The meaning is slightly different if chroot_local_user is set to YES. In this case, the list becomes a list of users which are NOT to be placed in a chroot() jail. By default, the file containing this list is /etc/vsftpd.chroot_list, but you may override this with the chroot_list_file setting.
