Home / server / Questions / 298673
Accepted
Naftuli Kay
Asked: 2011-08-08 15:27:51 +0800 CST

Using an allowed user list with VSFTPD

  • 772

According to the Wiki here, you can only allow certain users to log in over FTP using the following configuration in your /etc/vsftp.conf file:

userlist_enable=YES
userlist_file=/etc/vsftp.user_list
userlist_deny=NO

I've configured my system to use this configuration, and I only have one user which I'd like to expose over FTP named streams, so my /etc/vsftp.user_list looks like this:

streams

Interestingly enough, I cannot log in once I enable to user list. If I change userlist_enable to NO, then things work properly, but if I enable it, I can't log in all, it just keeps trying to reconnect. I don't get a login failed message, it just keeps trying to reconnect when using lftp.

My /etc/vsftp.conf file is available on Pastebin here and my /etc/vsftp.user_list is available here.

What am I doing wrong here? I'd just like to only make the streams user able to log in.

linux ftp vsftpd

2 Answers

  1. Best Answer

    A cursory glance doesn't show anything wrong with your config file... the problem may lie elsewhere.

    You've probably already tried this but it might be worth checking the following:

    • Make sure that that whatever user vsftpd is running as has the appropriate privileges on /etc/vsftp.user_list. You don't have your own non-privileged user configured with the nopriv_user directive, but the default is nobody.
    • Try commenting out the chroot_local_users directive to see if there is an issue with chroot-ing.
    • Have you restarted the vsftpd process after making changes? A common Doh! sysadmin moment for me is I make the config changes but forget to HUP to the process... (embarrassing, yes I know).
    • Try running vsftpd directly from the command line so any errors go to STDERR.
    • Have you configured your user streams to have /bin/false as a login shell? Try using /bin/nologin instead. /bin/false will prevent that user from logging in at all.
    • As a last resort consider using PAM and virtual users.
    • 3

  2. I may be late, but i figured this out. I ran into this issue while configuring mine. Uncomment the following line in the config file:

    #local_enable=YES *Change To* local_enable=YES

    • 1