I have a ftp server running on the machine 192.168.122.50
Below are the last three directives from /etc/vsftpd/vsftpd.conf file
pam_service_name=vsftpd
#userlist_enable=YES
#userlist_deny=YES
Below is the content of /etc/pam.d/vsftpd file
#%PAM-1.0
session optional pam_keyinit.so force revoke
auth required pam_listfile.so item=user sense=deny file=/etc/vsftpd/ftpusers onerr=succeed
auth required pam_shells.so
auth include password-auth
account include password-auth
session required pam_loginuid.so
session include password-auth
Below is the content of the /etc/vsftpd/ftpusers file
#This is the list of blocked users as per the following line /etc/pam.d/vsftpd
#auth required pam_listfile.so item=user sense=deny file=/etc/vsftpd/ftpusers onerr=succeed
root
bin
daemon
adm
lp
sync
shutdown
halt
mail
news
uucp
operator
games
nobody
So two users, for example, root
should be blocked from accessing the ftp server at this machine and ssam
should be allowed.
Now from client machine 192.168.0.2, I tried this.
am@centos ~]$ ftp 192.168.122.50
Connected to 192.168.122.50 (192.168.122.50).
220 (vsFTPd 2.2.2)
Name (192.168.122.50:ssam): ssam
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> exit
221 Goodbye.
[ssam@centos ~]$ ftp 192.168.122.50
Connected to 192.168.122.50 (192.168.122.50).
220 (vsFTPd 2.2.2)
Name (192.168.122.50:ssam): root
331 Please specify the password.
Password:
530 Login incorrect.
Login failed.
ftp> bye
221 Goodbye.
The output was inline with the pam settings as the user ssam
was allowed and user root
was blocked.
Now I have tried the lftp command at the client to connect to the server for the user root.
[ssam@centos ~]$ lftp [email protected]
Password:
lftp [email protected]:~>
The login was indeed possible blocked user root
as I got the lftp prompt. Now I tried to run a command.
lftp [email protected]:~>
ls: Login failed: 530 Login incorrect.
Now it seems like the server has come to good senses and it tells me I was not able to do anything else. But the pluggable authentication module should have blocked the user root
from entering the server at the first instance.
Could anybody explain this for me?