1

I am attempting to configure vsftp to use PAM to authenticate virtual users on my Arch server. It seems so straight forward, I must be missing something simple.

Configuration

  • local user virtualftp in group virtualftp
  • folders /srv/ftp and /srv/ftp/test1 owned by virtualftp:virtualftp
  • PAM user test1 with password test1p in /etc/vsftpd_login.db
/etc/pam.d/vsftpd
auth required pam_userdb.so db=/etc/vsftpd_login crypt=hash
account required pam_userdb.so db=/etc/vsftpd_login crypt=hash
session required pam_loginuid.so
/etc/vsftp.conf
anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
ftpd_banner=Welcome to MCID's FTP server.
chroot_local_user=YES
chroot_list_enable=YES
chroot_list_file=/etc/vsftpd.chroot_list
listen=YES
# nopriv_user=virtualftp

# SSL Configuration
# ssl_enable=YES
# allow_anon_ssl=NO
# force_local_data_ssl=NO
# force_local_logins_ssl=YES
# ssl_tlsv1=YES
# ssl_sslv2=YES
# ssl_sslv3=YES
# rsa_cert_file=/etc/ssl/certs/vsftpd.pem
# rsa_private_key_file=/etc/ssl/certs/vsftpd.pem

# Passive Port Range
pasv_min_port=49152
pasv_max_port=65534

# Added settings for PAM virtualftp logins
pam_service_name=vsftpd
guest_enable=YES
guest_username=virtualftp
virtual_use_local_privs=YES

# Private folders for virtual users
local_root=/srv/ftp/$USER
user_sub_token=$USER

Currently I can login with sftp://[email protected] (my local user) just fine. However, if I attempt to login with test1, I get "permission denied". What am I missing or confused about?

1

3 Answers 3

1

vsftpd (very secure FTP daemon) is an FTP daemon, and has nothing to do with sftp (SSH File Transfer Protocol).

0

Try this for virtual users to enable write access:

virtual_use_local_privs=YES
0

Have you checked that the file pam_userdb.so exists on your system? The PAM modules are usually located at /lib/security/. But the userdb module has been removed on certain pam versions: https://bbs.archlinux.org/viewtopic.php?id=177265

A possible solution discussed here is to install and use the module libpam-pwdfile instead.

New contributor
BlueJohn is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
1
  • 1
    While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. - From Review
    – AdminBee
    Commented Jul 9 at 13:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .