Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm a bit puzzled with this one and could really use some help.

We have a CentOS 6 box running VSFTPD as a dropbox for our customers. Each customer gets a local user and is chrooted to their home dir. Connections are made with explicit SSL.

VSFTPD config as follows:

anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
xferlog_std_format=YES
chroot_local_user=YES
listen=YES
pam_service_name=vsftpd
userlist_enable=YES
tcp_wrappers=YES
rsa_cert_file=/etc/ssl/private/vsftpd.pem
rsa_private_key_file=/etc/ssl/private/vsftpd.pem
ssl_enable=YES
allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES
ssl_tlsv1=YES
ssl_sslv2=YES
ssl_sslv3=YES
require_ssl_reuse=NO
ssl_ciphers=HIGH
check_shell=NO

So far we have added 3 users, each in the same way.

useradd -s /sbin/nologin username
passwd username

The first 2 users work perfectly. The 3rd gets a Login Incorrect message from VSFTPD.

I've change the 3rd users password to test just to check there wasn't a typo in the connection but get the same thing.

Message in /var/log/secure for the 3rd user attempt is

pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=user3 rhost=127.0.0.1  user=user3

Anyone have any suggestions.

EDIT: In response to comments

The SELinux status is disabled

The output from ls -lZd in each directory is

Working user: drwx------ user1 user1 ? .

Non-working user: drwxr-xr-x user2 user2 ? .

So there is an obvious difference in permissions, but the working user is less permissive?

share|improve this question
    
can you provoke an authentication failure with another user by entering a wrong password? Are they also known as uid=0 euid=0? –  Thorsten Staerk Jan 14 at 15:51
    
@ThorstenStaerk done as asked. Exactly the same output in the secure log when using incorrect password for one of the other users. They are known as uid=0 euid=0 –  fullybaked Jan 14 at 16:01
    
strange to me but this also means the problem is somewhere different –  Thorsten Staerk Jan 14 at 16:02
    
Things to scrutinize: (1) home dir. perms (2) .ssh perms. (3) user's have home dirs. defined in /etc/passwd. –  slm Jan 14 at 19:58
    
What is your SElinux status? Could you provide a ls -lZd /home/user_that_works and ls -lZd /home/user_that_dont_works? –  ludiegu Jan 15 at 9:32

2 Answers 2

PAM won’t let you authorise the user if their shell isn’t listed in /etc/shells.

Change the user shell to a correct nologin:

# chsh -s $(command -v nologin) user3

And make sure it is listed in /etc/shells:

# grep "$(command -v nologin)" /etc/shells || echo "$(command -v nologin)" >> /etc/shells
share|improve this answer

Take care you have created the user with /sbin/nologin because a typo error like /bin/nologin makes the difference

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.