8

I did a vsftpd setup on my home server. I got some authentication error so I searched through this forum and got a solution. This solution worked for me

As in the solution. the default setting

pam_service_name=vsftpd

doesnt work and FTP server doesnt allow me to login.

And After I changed it to

pam_service_name=ftp

It works and I can login as my local user to the FTP server. What is the reason behind this? Why the default doesnt work? I'm learning linux so your good explanation can help me a lot

7

I faced the same authentication error with pam_service_name=vsftpd.

Following advice online, I couldn't work out why setting pam_service_name=ftp fixed the problem so I tested setting this to pam_service_name=foobar and it also fixed the issue!

Disclaimer: I too am new to linux however I believe the generally accepted advice to set pam_service_name=ftp is wrong.

pam_service_name=vsftpd selects the existing configuration file /etc/pam.d/vsftpd, however pam_service_name=ftp will look for /etc/pam.d/ftp which does not exist (at least on my system - Ubuntu 14.04.2 LTS). I suspect this is actually bypassing the PAM authentication without complaining it can't find the file.

By not using a valid PAM config, it may less secure.

Final solution

I ended up keeping pam_service_name=vsftpd and made sure the user's shell existed in the /etc/shells file. http://www.cyberciti.biz/tips/howto-linux-shell-restricting-access.html

Looking at /etc/pam.d/vsftd

# Standard behaviour for ftpd(8).
auth    required    pam_listfile.so item=user sense=deny file=/etc/ftpusers onerr=succeed

# Note: vsftpd handles anonymous logins on its own. Do not enable pam_ftp.so.

# Standard pam includes
@include common-account
@include common-session
@include common-auth
auth    required    pam_shells.so

My issue was that it was failing at the auth required pam_shells.so step. I had made all my FTP users use the /usr/sbin/nologin shell which didn't exist in the /etc/shells file (non-ubuntu this might be just /sbin/nologin). If you're not sure, try commenting out the auth required pam_shells.so to see if this is the cause when pam_service_name=vsftpd.

Note: Further reading suggests it is cleaner to instead create virtual users but this requires different vsftpd and PAM configuration - http://www.sigerr.org/linux/setup-vsftpd-custom-multiple-directories-users-accounts-ubuntu-step-by-step/.

|improve this answer|||||
  • 2
    Agree with the explanations and the disclaimer about the general accepted advice is wrong. For the final solution, I used usermod -s /bin/sh <username> (with /bin/sh follow the one from /etc/shells) and I'm able to login ftp already. – checksum May 4 '16 at 13:01
  • @checksum Thank you! I've been googling a lot, and I believe this is THE missing step, I just needed usermod -s /bin/sh <username> – Kar.ma Feb 22 '19 at 16:36
2

In /etc/pam.d/vsftpd you can specify

auth required pam_nologin.so

so users whose login is disabled via /usr/sbin/nologin can only login to the system by the means of ftp.

Note: I read that adding nologin to /etc/shells might pose a security threat on Serverfault.

|improve this answer|||||
1

For me the problem was that I created the PAM configuration (/etc/pam.d/vsftpd) on a Windows machine, resulting in \r\n line endings.

Once I converted the line endings to Linux style (just \n), the PAM config started to work.

I also first thought the PAM service name was wrong, and tried with pam_service_name=ftp instead of pam_service_name=vsftpd, but that did not help at all, and I agree with the assessment of Josef P. that this is not the way to go.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for?Browse other questions tagged or ask your own question.