Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Moving a tried-and-true vsftpd configuration onto a new server with Fedora 16, I ran into a problem. All seems to go as it should, but user authentication fails. I cannot find any entry in any log that indicates what happened.

Here is the full config file:

anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
xferlog_file=/var/log/vsftpd.log
xferlog_std_format=YES
idle_session_timeout=0
data_connection_timeout=0
nopriv_user=ftpsecure
connect_from_port_20=YES
listen=YES
chroot_local_user=YES
chroot_list_enable=NO
ls_recurse_enable=YES
listen_ipv6=NO

pam_service_name=vsftpd
userlist_enable=YES
tcp_wrappers=YES

FTP challenges me for a username and password, I provide them, Login Incorrect. I have verified, this user is able to login from ssh. Something is screwed up with pam_service.

Anonymous (if changed to allowed) seems to work well.

SELinux is disabled.

Ftpsecure appears to be configured fine... I am at a complete loss!

Here are the log files I examined with no success:

/var/log/messages
/var/log/xferlog      #empty
/var/log/vsftpd.log   #empty
/var/log/secure

Found something in /var/log/audit/audit.log:

type=USER_AUTH msg=audit(1335632253.332:18486): user pid=19528 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:authentication acct="kate" exe="/usr/sbin/vsftpd" hostname=ip68-5-219-23.oc.oc.cox.net addr=68.5.219.23 terminal=ftp res=failed'

Perhaps I should look at /var/log/wtf-is-wrong.help :-)

Further info:

/etc/pam.d/vsftpd looks like this:

#%PAM-1.0
session    optional     pam_keyinit.so    force revoke
auth       required     pam_listfile.so item=user sense=deny file=/etc/vsftpd/ftpusers onerr=succeed
auth       required     pam_shells.so
auth       include      password-auth
account    include      password-auth
session    required     pam_loginuid.so
session    include      password-auth
share|improve this question
1  
What's the PAM configuration (/etc/pam.d/vsftpd, I think)? –  Gilles Apr 28 '12 at 22:32
    
Try /var/log/syslog or dmesg. –  Hello71 Apr 29 '12 at 2:07
    
pam config:session optional pam_keyinit.so force revoke auth required pam_listfile.so item=user sense=deny file=/etc/vsftpd/ftpusers onerr=succeed auth required pam_shells.so auth include password-auth account include password-auth session required pam_loginuid.so session include password-auth –  KateYoak Apr 30 '12 at 3:23
add comment

4 Answers

Whew. I solved the problem. It amounts to a config but within /etc/pam.d/vsftpd

Because ssh sessions succeeded while ftp sessions failed, I went to

/etc/pam.d/vsftpd, removed everything that was there and instead placed the contents of ./sshd to match the rules precisely. All worked!

By method of elimination, I found that the offending line was:

    auth       required     pam_shells.so

Removing it allows me to proceed.

Tuns out, "pam_shells is a PAM module that only allows access to the system if the users shell is listed in /etc/shells." I looked there and sure enough, no bash, no nothing. This is a bug in vsftpd configuration in my opinion as nowhere in the documentation does it have you editing /etc/shells. Thus default installation and instructions do not work as stated.

I'll go find where I can submit the bug now.

share|improve this answer
    
/etc/shells is typically supposed to contain a list of acceptable shells. This is used by quite a few different subsystems and is expected to be correct. This file isn't created or maintained by vsftpd, but rather by your distro's core setup. So this isn't a vsftpd bug, it's a bug with your computer's setup. –  tylerl Apr 24 '13 at 21:30
add comment

As you mentioned in your own answer, the user shell should be listed in /etc/shells. You could set /sbin/nologin as user shell to forbid ssh and allow ftp without changing pam configuration:

usermod -s /sbin/nologin restricted_ftp_user
share|improve this answer
add comment

If interested with PAM authentication and eventual related problems, I started to work on this subject while correctly adding PAM authentication to Openswan/Libreswan.

I today come up with one Web document related to PAM programming in my public knowledge database. You can view this document at http://vouters.dyndns.org/tima/Linux-PAM-C-Pluggable_Authentication_Modules_programming_example.html

If you also view the other document I refer to in the RELATED DOCUMENT section, you will be able to solve some authentication issues which directly relate to vsftp which is the topic dealt with here.

share|improve this answer
add comment

Back up the config file before making a change;

sudo cp /etc/vsftpd.conf /etc/vsftpd.conf.back

and then edit vsftpd.conf (with vi or nano)

nano /etc/vsftpd.conf

Then make the following change

pam_service_name=ftp

Save your change and restart the ftp server (if you use nano hit CTRL+O & enter to save then CTRL+X to exit)

sudo service vsftpd restart
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.