12

I'm running a Ubuntu 10.04 LTS server and I want to create users who can only access the server from FTP.

What I did so far is:

  • Install vsftpd
  • Create new user with default login shell set to /bin/false

The normal users on the server are all able to access their home folder through ftp but the users to whom remote shell access is removed by setting it to /bin/false are not able to log by ftp either.

I don't understand how the shell access affects the vsftpd server? How could I enable the ftp access without re-enabling shell?

Update:
I found this reference that states that I should use /sbin/nologin (seems to be /usr/sbin/nologin in Ubuntu) and that it should not affect ftp access but it does not work in my case.

Improve this question
4
  • May be try setting to /bin/true
    – balki
    Jul 6, 2011 at 15:44
  • I've never used vsftpd but I found solution that do what you need. I don't know if it is best solution (I think it should work, but maybe there is something better).
    – pbm
    Jul 6, 2011 at 15:47
  • Just tried /bin/true and it does not work.
    – jmbouffard
    Jul 6, 2011 at 15:49
  • Thanks @pbm but it is not exactly what I'm looking for because I'd prefer to use real users.
    – jmbouffard
    Jul 6, 2011 at 16:40

2 Answers 2

Reset to default
12

I don't know if it is good practice to answer my own question but I found a simple solution that enables ftp login.

I needed to add the line

/usr/sbin/nologin

to the file /etc/shells. Right after this modification the ftp server started to accept login from users to whom the shell is set /usr/sbin/nologin. So they cannot login through ssh but it works with ftp exactly as I wanted.

Thanks for your helpful comments.

Improve this answer
1
  • 1
    I read somewhere a few days ago that this opens security vulnerability. Any experts out there that can clarify this for me.
    – Navneil
    Jul 5, 2017 at 10:53
0

Set users shell back to /bin/false (or some other invalid shell) then set /bin/false in /etc/shells.

I see a major security issue with setting /usr/sbin/nologin into /etc/shells. You are giving FTP (and perhaps other) access to all daemons and logins that have /usr/sbin/nologin as their shell.

Improve this answer
2
  • 1
    How, exactly? nologin exists to allow, well, nologin - with an optional customized message in /etc/nologin.txt so the ftp user could know it's ftp only or some such.
    – Dani_l
    Apr 17, 2016 at 4:51
  • vsftpd is the one protecting from unauthorized access by having it's own access lists.
    – Dani_l
    Apr 17, 2016 at 5:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.