Using an allowed user list with VSFTPD
According to the Wiki here, you can only allow certain users to log in over FTP using the following configuration in your /etc/vsftp.conf
file:
userlist_enable=YES
userlist_file=/etc/vsftp.user_list
userlist_deny=NO
I've configured my system to use this configuration, and I only have one user which I'd like to expose over FTP named streams
, so my /etc/vsftp.user_list
looks like this:
streams
Interestingly enough, I cannot log in once I enable to user list. If I change userlist_enable
to NO
, then things work properly, but if I enable it, I can't log in all, it just keeps trying to reconnect. I don't get a login failed message, it just keeps trying to reconnect when using lftp
.
My /etc/vsftp.conf
file is available on Pastebin here and my /etc/vsftp.user_list
is available here.
What am I doing wrong here? I'd just like to only make the streams
user able to log in.
A cursory glance doesn't show anything wrong with your config file... the problem may lie elsewhere.
You've probably already tried this but it might be worth checking the following:
- Make sure that that whatever user vsftpd is running as has the appropriate privileges on
/etc/vsftp.user_list
. You don't have your own non-privileged user configured with thenopriv_user
directive, but the default is nobody. - Try commenting out the
chroot_local_users
directive to see if there is an issue with chroot-ing. - Have you restarted the vsftpd process after making changes? A common Doh! sysadmin moment for me is I make the config changes but forget to HUP to the process... (embarrassing, yes I know).
- Try running vsftpd directly from the command line so any errors go to STDERR.
- Have you configured your user
streams
to have/bin/false
as a login shell? Try using/bin/nologin
instead./bin/false
will prevent that user from logging in at all. - As a last resort consider using PAM and virtual users.
I may be late, but i figured this out. I ran into this issue while configuring mine. Uncomment the following line in the config file:
#local_enable=YES *Change To* local_enable=YES