1

I would like that virtual user use a defined local user. this local user is member of groups apache (www-data for debian user, I use here a centos7) and ftp

useradd ftpuser -d /var/www -g apache -G ftp
usermod -s /sbin/nologin ftpuser

I change from the file /etc/vsftpd/vsftpd.conf

  • guest_username=ftp

to

  • guest_username=ftpuser

Since the virtual user password check pass but not the local user:

Mar 31 23:11:29 vps263033 vsftpd: pam_unix(vsftpd:auth): check pass; user unknown
Mar 31 23:11:29 vps263033 vsftpd: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=xxx rhost=localhost
Mar 31 23:11:29 vps263033 vsftpd: pam_userdb(vsftpd:auth): user 'xxx' granted access
Mar 31 23:11:29 vps263033 vsftpd: pam_unix(vsftpd:account): could not identify user (from getpwnam(xxx))

why pam_unix fail ?

Thanks for your help

============ Additional information ==============

full content of /etc/pam.d/vsftpd

#%PAM-1.0
auth    sufficient pam_unix.so
account sufficient pam_unix.so
auth    required   /lib64/security/pam_userdb.so db=/etc/vsftpd/login
account required   /lib64/security/pam_userdb.so db=/etc/vsftpd/login
session required   pam_loginuid.so

full content of /etc/vsftpd/vsftpd.conf

listen_port=21
ftpd_banner=Bienvenue !
pam_service_name=vsftpd

listen=YES
listen_ipv6=NO
anonymous_enable=NO
local_enable=YES

userlist_file=/etc/vsftpd/user_list
userlist_enable=YES
userlist_deny=YES

write_enable=YES

anon_upload_enable=NO
anon_world_readable_only=NO
anon_mkdir_write_enable=NO
anon_other_write_enable=NO

guest_enable=YES
guest_username=ftpuser
chroot_local_user=YES

max_clients=50
max_per_ip=4

user_config_dir=/etc/vsftpd/vsftpd_user_conf

xferlog_enable=YES
xferlog_file=/var/log/vsftpd.log
xferlog_std_format=YES
1

I finally found the problem

I change the content of /etc/pam.d/vsftpd

#%PAM-1.0
auth    required   /lib64/security/pam_userdb.so db=/etc/vsftpd/login
account required   /lib64/security/pam_userdb.so db=/etc/vsftpd/login

and I run these 2 selinux commands:

setsebool -P ftp_home_dir=on
setsebool -P ftpd_full_access=on

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.