I have a ftp server running on the machine 192.168.122.50
Below are the last three directives from /etc/vsftpd/vsftpd.conf file
pam_service_name=vsftpd #userlist_enable=YES #userlist_deny=YES
Below is the content of /etc/pam.d/vsftpd file
#%PAM-1.0 session optional pam_keyinit.so force revoke auth required pam_listfile.so item=user sense=deny file=/etc/vsftpd/ftpusers onerr=succeed auth required pam_shells.so auth include password-auth account include password-auth session required pam_loginuid.so session include password-auth
Below is the content of the /etc/vsftpd/ftpusers file
#This is the list of blocked users as per the following line /etc/pam.d/vsftpd #auth required pam_listfile.so item=user sense=deny file=/etc/vsftpd/ftpusers onerr=succeed root bin daemon adm lp sync shutdown halt mail news uucp operator games nobody
So two users, for example,
root should be blocked from accessing the ftp server at this machine and
ssam should be allowed.
Now from client machine 192.168.0.2, I tried this.
am@centos ~]$ ftp 192.168.122.50 Connected to 192.168.122.50 (192.168.122.50). 220 (vsFTPd 2.2.2) Name (192.168.122.50:ssam): ssam 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> exit 221 Goodbye. [ssam@centos ~]$ ftp 192.168.122.50 Connected to 192.168.122.50 (192.168.122.50). 220 (vsFTPd 2.2.2) Name (192.168.122.50:ssam): root 331 Please specify the password. Password: 530 Login incorrect. Login failed. ftp> bye 221 Goodbye.
The output was inline with the pam settings as the user
ssam was allowed and user
root was blocked.
Now I have tried the lftp command at the client to connect to the server for the user root.
[ssam@centos ~]$ lftp email@example.com Password: lftp firstname.lastname@example.org:~>
The login was indeed possible blocked user
root as I got the lftp prompt. Now I tried to run a command.
lftp email@example.com:~> ls: Login failed: 530 Login incorrect.
Now it seems like the server has come to good senses and it tells me I was not able to do anything else. But the pluggable authentication module should have blocked the user
root from entering the server at the first instance.
Could anybody explain this for me?