Sign up ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Moving a tried-and-true vsftpd configuration onto a new server with Fedora 16, I ran into a problem. All seems to go as it should, but user authentication fails. I cannot find any entry in any log that indicates what happened.

Here is the full config file:



FTP challenges me for a username and password, I provide them, Login Incorrect. I have verified, this user is able to login from ssh. Something is screwed up with pam_service.

Anonymous (if changed to allowed) seems to work well.

SELinux is disabled.

Ftpsecure appears to be configured fine... I am at a complete loss!

Here are the log files I examined with no success:

/var/log/xferlog      #empty
/var/log/vsftpd.log   #empty

Found something in /var/log/audit/audit.log:

type=USER_AUTH msg=audit(1335632253.332:18486): user pid=19528 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:authentication acct="kate" exe="/usr/sbin/vsftpd" addr= terminal=ftp res=failed'

Perhaps I should look at /var/log/ :-)

Further info:

/etc/pam.d/vsftpd looks like this:

session    optional    force revoke
auth       required item=user sense=deny file=/etc/vsftpd/ftpusers onerr=succeed
auth       required
auth       include      password-auth
account    include      password-auth
session    required
session    include      password-auth
share|improve this question
What's the PAM configuration (/etc/pam.d/vsftpd, I think)? – Gilles Apr 28 '12 at 22:32
Try /var/log/syslog or dmesg. – Hello71 Apr 29 '12 at 2:07
pam config:session optional force revoke auth required item=user sense=deny file=/etc/vsftpd/ftpusers onerr=succeed auth required auth include password-auth account include password-auth session required session include password-auth – KateYoak Apr 30 '12 at 3:23

5 Answers 5

Whew. I solved the problem. It amounts to a config but within /etc/pam.d/vsftpd

Because ssh sessions succeeded while ftp sessions failed, I went to

/etc/pam.d/vsftpd, removed everything that was there and instead placed the contents of ./sshd to match the rules precisely. All worked!

By method of elimination, I found that the offending line was:

    auth       required

Removing it allows me to proceed.

Tuns out, "pam_shells is a PAM module that only allows access to the system if the users shell is listed in /etc/shells." I looked there and sure enough, no bash, no nothing. This is a bug in vsftpd configuration in my opinion as nowhere in the documentation does it have you editing /etc/shells. Thus default installation and instructions do not work as stated.

I'll go find where I can submit the bug now.

share|improve this answer
/etc/shells is typically supposed to contain a list of acceptable shells. This is used by quite a few different subsystems and is expected to be correct. This file isn't created or maintained by vsftpd, but rather by your distro's core setup. So this isn't a vsftpd bug, it's a bug with your computer's setup. – tylerl Apr 24 '13 at 21:30

I am using ubuntu and had same issue


add-shell /sbin/nologin
sudo usermod -s /sbin/nologin ftpme
sudo vi /etc/pam.d/vsftpd

Then comment and add lines as following

session    optional    force revoke
auth       required item=user sense=deny file=/etc/ftpusers  onerr=succeed
auth       required
#auth       include      password-auth
#account    include      password-auth
#session    required
#session    include      password-auth
@include common-auth
@include common-account
@include common-password
@include common-session
share|improve this answer

As you mentioned in your own answer, the user shell should be listed in /etc/shells. You could set /sbin/nologin as user shell to forbid ssh and allow ftp without changing pam configuration:

usermod -s /sbin/nologin restricted_ftp_user
share|improve this answer

If interested with PAM authentication and eventual related problems, I started to work on this subject while correctly adding PAM authentication to Openswan/Libreswan.

I today come up with one Web document related to PAM programming in my public knowledge database. You can view this document at

If you also view the other document I refer to in the RELATED DOCUMENT section, you will be able to solve some authentication issues which directly relate to vsftp which is the topic dealt with here.

share|improve this answer

Back up the config file before making a change;

sudo cp /etc/vsftpd.conf /etc/vsftpd.conf.back

and then edit vsftpd.conf (with vi or nano)

nano /etc/vsftpd.conf

Then make the following change


Save your change and restart the ftp server (if you use nano hit CTRL+O & enter to save then CTRL+X to exit)

sudo service vsftpd restart
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.