Centos – How to config vsftpd to map virtual user to a custom local user

centoscentos7pamvsftpd

I would like that virtual user use a defined local user. this local user is member of groups apache (www-data for debian user, I use here a centos7) and ftp

useradd ftpuser -d /var/www -g apache -G ftp
usermod -s /sbin/nologin ftpuser

I change from the file /etc/vsftpd/vsftpd.conf

  • guest_username=ftp

to

  • guest_username=ftpuser

Since the virtual user password check pass but not the local user:

Mar 31 23:11:29 vps263033 vsftpd: pam_unix(vsftpd:auth): check pass; user unknown
Mar 31 23:11:29 vps263033 vsftpd: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=xxx rhost=localhost
Mar 31 23:11:29 vps263033 vsftpd: pam_userdb(vsftpd:auth): user 'xxx' granted access
Mar 31 23:11:29 vps263033 vsftpd: pam_unix(vsftpd:account): could not identify user (from getpwnam(xxx))

why pam_unix fail ?

Thanks for your help

============ Additional information ==============

full content of /etc/pam.d/vsftpd

#%PAM-1.0
auth    sufficient pam_unix.so
account sufficient pam_unix.so
auth    required   /lib64/security/pam_userdb.so db=/etc/vsftpd/login
account required   /lib64/security/pam_userdb.so db=/etc/vsftpd/login
session required   pam_loginuid.so

full content of /etc/vsftpd/vsftpd.conf

listen_port=21
ftpd_banner=Bienvenue !
pam_service_name=vsftpd

listen=YES
listen_ipv6=NO
anonymous_enable=NO
local_enable=YES

userlist_file=/etc/vsftpd/user_list
userlist_enable=YES
userlist_deny=YES

write_enable=YES

anon_upload_enable=NO
anon_world_readable_only=NO
anon_mkdir_write_enable=NO
anon_other_write_enable=NO

guest_enable=YES
guest_username=ftpuser
chroot_local_user=YES

max_clients=50
max_per_ip=4

user_config_dir=/etc/vsftpd/vsftpd_user_conf

xferlog_enable=YES
xferlog_file=/var/log/vsftpd.log
xferlog_std_format=YES

Best Answer

I finally found the problem

I change the content of /etc/pam.d/vsftpd

#%PAM-1.0
auth    required   /lib64/security/pam_userdb.so db=/etc/vsftpd/login
account required   /lib64/security/pam_userdb.so db=/etc/vsftpd/login

and I run these 2 selinux commands:

setsebool -P ftp_home_dir=on
setsebool -P ftpd_full_access=on
Related Topic