1

I have a ftp server running on the machine 192.168.122.50

Below are the last three directives from /etc/vsftpd/vsftpd.conf file

pam_service_name=vsftpd
#userlist_enable=YES
#userlist_deny=YES

Below is the content of /etc/pam.d/vsftpd file

#%PAM-1.0
session    optional     pam_keyinit.so    force revoke
auth       required     pam_listfile.so item=user sense=deny file=/etc/vsftpd/ftpusers onerr=succeed
auth       required     pam_shells.so
auth       include      password-auth
account    include      password-auth
session    required     pam_loginuid.so
session    include      password-auth

Below is the content of the /etc/vsftpd/ftpusers file

#This is the list of blocked users as per the following line /etc/pam.d/vsftpd
#auth required pam_listfile.so item=user sense=deny file=/etc/vsftpd/ftpusers onerr=succeed

root
bin
daemon
adm
lp
sync
shutdown
halt
mail
news
uucp
operator
games
nobody

So two users, for example, root should be blocked from accessing the ftp server at this machine and ssam should be allowed.

Now from client machine 192.168.0.2, I tried this.

am@centos ~]$ ftp 192.168.122.50
Connected to 192.168.122.50 (192.168.122.50).
220 (vsFTPd 2.2.2)
Name (192.168.122.50:ssam): ssam    
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> exit
221 Goodbye.
[ssam@centos ~]$ ftp 192.168.122.50
Connected to 192.168.122.50 (192.168.122.50).
220 (vsFTPd 2.2.2)
Name (192.168.122.50:ssam): root
331 Please specify the password.
Password:
530 Login incorrect.
Login failed.
ftp> bye
221 Goodbye.

The output was inline with the pam settings as the user ssam was allowed and user root was blocked.

Now I have tried the lftp command at the client to connect to the server for the user root.

[ssam@centos ~]$ lftp [email protected]
Password: 
lftp [email protected]:~>

The login was indeed possible blocked user root as I got the lftp prompt. Now I tried to run a command.

lftp [email protected]:~>
ls: Login failed: 530 Login incorrect.

Now it seems like the server has come to good senses and it tells me I was not able to do anything else. But the pluggable authentication module should have blocked the user root from entering the server at the first instance.

Could anybody explain this for me?

1
  • IMO, it's a way how lftp client works. Check the log file /var/log/secure (on RHEL/CentOS) or similar for events like "pam_listfile(vsftpd:auth): Refused user root for service vsftpd".
    – dsmsk80
    Sep 26, 2013 at 6:52

2 Answers 2

2

IMO, it's a way how lftp client works. Check the log file /var/log/secure (on RHEL/CentOS) or similar for events like

pam_listfile(vsftpd:auth): Refused user root for service vsftpd

I verified such behavior by sniffing FTP traffic (RHEL 6.x, vsftpd 2.2.2, lftp 4.0.9). The FTP connection is not established till you enter some valid FTP command (aka ls) and not when you enter user name and its password.

1
  • @dsmask80 : Thank You. Me too got pam_listfile(vsftpd:auth): Refused user root for service vsftpd in the log. Looks like lftp caches the username and password, and gives a formal sub-prompt, which made me misjudge that an actual connection is established. It tries to make the actual connection only when you enter a valid command. I checked the time when I enter the command and it matches the refusal time in the log.
    – sjsam
    Sep 26, 2013 at 8:41
-1
vim /etc/vsftpd/vsftpd.conf 

Come on second last line.... userlist_enable="NO"

Save it and after that

# vim /etc/vsftpd/ftpusers

remove the "root" user from it...in this file

Users that are not allowed to login via ftp. Save it and restart the service. I hope it will work.....

1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .