3

I'm a bit puzzled with this one and could really use some help.

We have a CentOS 6 box running VSFTPD as a dropbox for our customers. Each customer gets a local user and is chrooted to their home dir. Connections are made with explicit SSL.

VSFTPD config as follows:

anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
xferlog_std_format=YES
chroot_local_user=YES
listen=YES
pam_service_name=vsftpd
userlist_enable=YES
tcp_wrappers=YES
rsa_cert_file=/etc/ssl/private/vsftpd.pem
rsa_private_key_file=/etc/ssl/private/vsftpd.pem
ssl_enable=YES
allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES
ssl_tlsv1=YES
ssl_sslv2=YES
ssl_sslv3=YES
require_ssl_reuse=NO
ssl_ciphers=HIGH
check_shell=NO

So far we have added 3 users, each in the same way.

useradd -s /sbin/nologin username
passwd username

The first 2 users work perfectly. The 3rd gets a Login Incorrect message from VSFTPD.

I've change the 3rd users password to test just to check there wasn't a typo in the connection but get the same thing.

Message in /var/log/secure for the 3rd user attempt is

pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=user3 rhost=127.0.0.1  user=user3

Anyone have any suggestions.

EDIT: In response to comments

The SELinux status is disabled

The output from ls -lZd in each directory is

Working user: drwx------ user1 user1 ? .

Non-working user: drwxr-xr-x user2 user2 ? .

So there is an obvious difference in permissions, but the working user is less permissive?

9
  • can you provoke an authentication failure with another user by entering a wrong password? Are they also known as uid=0 euid=0? Jan 14, 2014 at 15:51
  • @ThorstenStaerk done as asked. Exactly the same output in the secure log when using incorrect password for one of the other users. They are known as uid=0 euid=0
    – fullybaked
    Jan 14, 2014 at 16:01
  • strange to me but this also means the problem is somewhere different Jan 14, 2014 at 16:02
  • Things to scrutinize: (1) home dir. perms (2) .ssh perms. (3) user's have home dirs. defined in /etc/passwd.
    – slm
    Jan 14, 2014 at 19:58
  • What is your SElinux status? Could you provide a ls -lZd /home/user_that_works and ls -lZd /home/user_that_dont_works?
    – ludiegu
    Jan 15, 2014 at 9:32

3 Answers 3

4

PAM won’t let you authorise the user if their shell isn’t listed in /etc/shells.

Change the user shell to a correct nologin:

# chsh -s $(command -v nologin) user3

And make sure it is listed in /etc/shells:

# grep "$(command -v nologin)" /etc/shells || echo "$(command -v nologin)" >> /etc/shells
3

I think the issue is that you used useradd

not adduser

sudo adduser username

Please check this http://ubuntuforums.org/showthread.php?t=2240340

2
  • Thanks for the reply, but as per the tags this is CentOS where the command is useradd ;) but good to know that when I get round to trying Ubuntu it's adduser
    – fullybaked
    Apr 10, 2015 at 9:01
  • This was the issue for me, though. Thank you! Aug 13, 2015 at 14:49
1

Take care you have created the user with /sbin/nologin because a typo error like /bin/nologin makes the difference

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .