vsftpd and pam

We will be using PAM to deny access to the VSFTPD service to certain users.

1. Install the VSFTPD FTP server.

yum install vsftpd

2. Start the service and verify it is running.

systemctl start vsftpdsystemctl status vsftpd
[OUTPUT]
● vsftpd.service - Vsftpd ftp daemon
   Loaded: loaded (/usr/lib/systemd/system/vsftpd.service; disabled; vendor preset: disabled)
   Active: active (running) since Fri 2017-02-24 13:39:42 CST; 5min ago
  Process: 17739 ExecStart=/usr/sbin/vsftpd /etc/vsftpd/vsftpd.conf (code=exited, status=0/SUCCESS)
 Main PID: 17741 (vsftpd)
   Memory: 592.0K
   CGroup: /system.slice/vsftpd.service
           └─17741 /usr/sbin/vsftpd /etc/vsftpd/vsftpd.conf

3. Install the FTP client utility.

yum install ftp

4. Using the client, verify that the user account can log in to the server.

ftp localhost
[output]
Connected to localhost (127.0.0.1).
220 (vsFTPd 3.0.2)
Name (localhost:root):

5. Display the contents of the PAM VSFTP module, note the file referred to for denying user access.

cat /etc/pam.d/vsftpd
[output]
#%PAM-1.0
session    optional     pam_keyinit.so    force revoke
auth       required pam_listfile.so item=user sense=deny file=/etc/vsftpd/ftpusers onerr=succeed
auth       required pam_shells.so
auth       include password-auth
account    include password-auth
session    required     pam_loginuid.so
session    include password-auth

6. Add the user account to the appropriate file noted from Step 5.

vim /etc/vsftpd/ftpusers
[contents with our setting on last line]
# Users that are not allowed to login via ftp
root
bin
daemon
adm
lp
sync
shutdown
halt
mail
news
uucp
operator
games
nobody
user

7. Verify the user account is no longer permitted to log in.

ftp localhost
[output]
Connected to localhost (127.0.0.1).
220 (vsFTPd 3.0.2)
Name (localhost:root): user
331 Please specify the password.
Password:
530 Login incorrect.
Login failed.
ftp> quit
221 Goodbye.