vsftpd: **ONLY** Ftp access for local user?

I have vsftpd server that allow local users to login to ftp. How to prevent some local user to login to shell account and allow only login to ftp server (vsftpd) ?

Solution 1:

You should use virtual users and be careful with logins match between them

[vsftpd.conf]/etc/vsftpd.conf

listen=YES
anonymous_enable=NO
local_enable=YES
virtual_use_local_privs=YES
write_enable=YES
connect_from_port_20=YES
secure_chroot_dir=/var/run/vsftpd
pam_service_name=vsftpd #look here
guest_enable=YES
guest_username=ftp #carefull
user_sub_token=$USER
local_root=/var/ftpserver/ #careful
chroot_local_user=YES
hide_ids=YES
syslog_enable=YES
file_open_mode=0666
local_umask=0022

[vsftpd]/etc/pam.d/vsftpd
auth    required pam_pwdfile.so pwdfile /etc/vsftpd.passwd # htpasswd file
account required pam_permit.so

and create htpasswd -c /etc/vsftpd.passwd username

Solution 2:

In short: Use virtual users.

http://howto.gumph.org/content/setup-virtual-users-and-directories-in-vsftpd/

http://eviladmin.org/tutorials/vsftpd.html

Solution 3:

I don't think using virtual users is necessary at all. Regular users will do just fine.

Add a line to /etc/shells, if it is not already there:

/bin/false

For the users you would like only to be able to use FTP, edit /etc/passwd and change their shell (usually defaults to with /bin/bash or /bin/sh) to /bin/false

e.g.:

From this:

jdoe:x:1000:1000:John:/home/fbh:/bin/bash

To this

jdoe:x:1000:1000:John:/home/fbh:/bin/false

This way, that user will only be able to login using FTP.