vsftpd: OK LOGIN but getting repeated password prompt - linux

Question

I am trying to set up vsftpd on a Centos 7 server. We have a bunch of linux users with /usr/sbin/nologin shells just for the purpose of FTP. I also created a regular user testuser with a bash shell.
Anonymous logins are disabled. When I try to login to the FTP server through Chrome I get a password prompt. When I submit the password prompt I just get another password prompt, over and over. However, the contents of vsftpd's log file are as followed:
Wed Aug 5 10:32:05 2020 [pid 30282] CONNECT: Client "my.ip.goes.here"
Wed Aug 5 10:32:05 2020 [pid 30282] FTP response: Client "my.ip.goes.here", "220 SUP GUY"
Wed Aug 5 10:32:05 2020 [pid 30282] FTP command: Client "my.ip.goes.here", "USER anonymous"
Wed Aug 5 10:32:05 2020 [pid 30282] [anonymous] FTP response: Client "my.ip.goes.here", "331 Please specify the password."
Wed Aug 5 10:32:05 2020 [pid 30282] [anonymous] FTP command: Client "my.ip.goes.here", "PASS <password>"
Wed Aug 5 10:32:07 2020 [pid 30281] [anonymous] FAIL LOGIN: Client "my.ip.goes.here"
Wed Aug 5 10:32:08 2020 [pid 30282] [anonymous] FTP response: Client "my.ip.goes.here", "530 Login incorrect."
Wed Aug 5 10:32:08 2020 [pid 30282] FTP command: Client "my.ip.goes.here", "QUIT"
Wed Aug 5 10:32:08 2020 [pid 30282] FTP response: Client "my.ip.goes.here", "221 Goodbye."
Wed Aug 5 10:32:08 2020 [pid 30285] CONNECT: Client "my.ip.goes.here"
Wed Aug 5 10:32:08 2020 [pid 30285] FTP response: Client "my.ip.goes.here", "220 SUP GUY"
Wed Aug 5 10:32:08 2020 [pid 30285] FTP command: Client "my.ip.goes.here", "USER testuser"
Wed Aug 5 10:32:08 2020 [pid 30285] [testuser] FTP response: Client "my.ip.goes.here", "331 Please specify the password."
Wed Aug 5 10:32:08 2020 [pid 30285] [testuser] FTP command: Client "my.ip.goes.here", "PASS <password>"
Wed Aug 5 10:32:08 2020 [pid 30284] [testuser] OK LOGIN: Client "my.ip.goes.here"
As you can see, the last line is OK LOGIN which is funny because the browser sure isn't acting like I logged in successfully.
Here's my vsftpd.conf:
anonymous_enable=NO
local_enable=YES
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
xferlog_std_format=YES
listen=YES
listen_ipv6=NO
pam_service_name=vsftpd
tcp_wrappers=YES
ssl_enable=NO
pasv_enable=YES
pasv_address=my.server.ip.here
pasv_min_port=49152
pasv_max_port=65535
ftpd_banner=SUP GUY
chroot_local_user=YES
chroot_list_enable=NO
allow_writeable_chroot=NO
write_enable=NO
userlist_enable=NO
log_ftp_protocol=YES
dual_log_enable=YES
Here's my /etc/pam.d/vsftpd file:
#%PAM-1.0
session optional pam_keyinit.so force revoke
auth required pam_listfile.so item=user sense=deny file=/etc/vsftpd/ftpusers onerr=succeed
auth required pam_nologin.so
auth include password-auth
account include password-auth
session required pam_loginuid.so
session include password-auth
My testuser account is not in that ftpusers file.
And here are the directory permissions of that testuser's home directory, in case that makes a difference:
total 16K
drwx------. 2 testuser testuser 91 Aug 5 10:27 .
drwxr-xr-x. 6 root root 65 Aug 4 10:42 ..
-rw-------. 1 testuser testuser 25 Aug 5 10:27 .bash_history
-rw-r--r--. 1 testuser testuser 18 Mar 31 21:17 .bash_logout
-rw-r--r--. 1 testuser testuser 193 Mar 31 21:17 .bash_profile
-rw-r--r--. 1 testuser testuser 231 Mar 31 21:17 .bashrc
-rw-rw-r--. 1 testuser testuser 0 Aug 5 10:27 hello```
Any idea what is going on here?

Answer 1

Turns out the culprit was SELinux. Everything was fine as far as vsftpd was concerned, but SELinux was blocking access to that home directory. My /var/log/audit/audit.log was full of entries like this:
type=AVC msg=audit(1596625942.966:385491): avc: denied { read } for pid=6778 comm="vsftpd" name="vsftpd"
dev="sda2" ino=2013664268 scontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file permissive=0
In my case I do not need SELinux, so all I needed to do was set setenforce 0 and set SELINUX=disabled in my /etc/selinux/config.