Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running a Ubuntu 10.04 LTS server and I want to create users who can only access the server from FTP.

What I did so far is:

  • Install vsftpd
  • Create new user with default login shell set to /bin/false

The normal users on the server are all able to access their home folder through ftp but the users to whom remote shell access is removed by setting it to /bin/false are not able to log by ftp either.

I don't understand how the shell access affects the vsftpd server? How could I enable the ftp access without re-enabling shell?

Update:
I found this reference that states that I should use /sbin/nologin (seems to be /usr/sbin/nologin in Ubuntu) and that it should not affect ftp access but it does not work in my case.

share|improve this question
    
May be try setting to /bin/true – balki Jul 6 '11 at 15:44
    
I've never used vsftpd but I found solution that do what you need. I don't know if it is best solution (I think it should work, but maybe there is something better). – pbm Jul 6 '11 at 15:47
    
Just tried /bin/true and it does not work. – jmbouffard Jul 6 '11 at 15:49
    
Thanks @pbm but it is not exactly what I'm looking for because I'd prefer to use real users. – jmbouffard Jul 6 '11 at 16:40

I don't know if it is good practice to answer my own question but I found a simple solution that enables ftp login.

I needed to add the line

/usr/sbin/nologin

to the file /etc/shells. Right after this modification the ftp server started to accept login from users to whom the shell is set /usr/sbin/nologin. So they cannot login through ssh but it works with ftp exactly as I wanted.

Thanks for your helpful comments.

share|improve this answer

Set users shell back to /bin/false (or some other invalid shell) then set /bin/false in /etc/shells.

I see a major security issue with setting /usr/sbin/nologin into /etc/shells. You are giving FTP (and perhaps other) access to all daemons and logins that have /usr/sbin/nologin as their shell.

share|improve this answer
1  
How, exactly? nologin exists to allow, well, nologin - with an optional customized message in /etc/nologin.txt so the ftp user could know it's ftp only or some such. – Dani_l Apr 17 at 4:51
    
vsftpd is the one protecting from unauthorized access by having it's own access lists. – Dani_l Apr 17 at 5:06

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.