Why does FTP say 553 Could not create file on CentOS 7? In a typical vsftpd installation, the server is refusing to create the destination file. The refusal can come from the path visible inside a chroot, Linux directory permissions, vsftpd upload settings, or SELinux policy. A directory listing is not proof that uploads are allowed: listing requires read access, while creating a file requires write and execute access to the destination directory and execute access through every parent.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Why can I list files but not upload? Check the exact path shown by the FTP session first, then inspect permissions, vsftpd configuration, chroot mapping and SELinux in that order. How do I fix vsftpd 553 permissions? Apply the narrowest correction for the layer that is denying the create operation, reload vsftpd, perform one controlled upload, inspect the logs and remove the test file.
As an Amazon Associate I earn from qualifying purchases.
What FTP 553 means on CentOS 7
FTP reply code 553 is a server-side destination-create denial. The server accepted the upload request far enough to evaluate the target, but it could not create the requested file at that location. The code does not identify one universal cause. In a CentOS 7 vsftpd deployment, troubleshoot four layers in sequence:
- FTP-visible path: the path after
chroot_local_user,local_rootand any per-user settings have been applied. - Linux discretionary access control (DAC): ownership, group membership and directory mode bits.
- vsftpd policy: local-user or anonymous upload settings, umasks and per-user overrides.
- SELinux: file labels and policy booleans that can deny a write even when Unix permissions look correct.
Testing in this order prevents a common mistake: changing chmod on a host path that the FTP session cannot see, or repeatedly changing modes when SELinux is the actual blocker.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
1. Confirm the path the FTP session actually sees
Begin in the FTP client, not at a shell prompt. A physical path on the server can exist and still be outside the session’s chroot-visible tree. Log in as the affected account and run:
pwd
ls -lapwd gives the session’s current FTP path. ls -la shows the entries and their displayed permissions from that same view. Compare the result with the server’s vsftpd configuration, especially local_root and chroot_local_user. Also check whether the account has a per-user configuration file under the directory named by user_config_dir; those files can change the effective root or other settings for one account.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsMap the upload target
Identify the exact filename and directory used by the failing upload. If the client sends only a filename, the destination is the FTP session’s current directory. If it sends a relative path, resolve that path from the session’s current directory. If it sends an absolute-looking FTP path, remember that the path is interpreted inside the FTP namespace, not necessarily as a host-root path.
Do not assume that a directory such as /var/ftp/uploads on the host is the same location as /uploads shown to a chrooted user. The mapping depends on local_root, chroot behavior and per-user configuration. Correct the mapping only after you know which directory the session is actually targeting.
2. Inspect Linux ownership and directory permissions
Once the FTP-visible destination is mapped to a host path, inspect every directory component as root:
namei -l /path/to/upload
ls -ld /path/to/upload
id ftpuserReplace /path/to/upload and ftpuser with the real destination and account. These commands answer different questions:
namei -ldisplays ownership and mode bits for each component in the path, so a restrictive parent directory is not missed.ls -ldshows the destination directory itself rather than its contents.idconfirms the user’s numeric and supplementary group memberships, which matter when access is granted through a group.
Why directory write and execute are both required
Creating a file is a directory operation. The FTP account needs write permission on the destination directory to add a directory entry and execute permission on that directory to access entries within it. It also needs execute permission on every parent directory in the path. Read permission controls listing and name lookup, but it does not by itself permit creation.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
This explains the apparently contradictory result “I can list files but not upload.” The account may have enough read access for ls while lacking write access, execute access, or both on the directory where vsftpd attempts to create the file.
Correct ownership or group access narrowly
Grant access to the specific upload directory and account that need it. Prefer an appropriate owner or group over making an entire tree world-writable. If the service account should write through a group, add the FTP account to the intended group and give that group the required directory permissions. If the directory belongs to the wrong account, change ownership only where the upload is meant to occur.
After changing group membership, start a new FTP session so the account receives its updated supplementary groups. Avoid broad recursive mode changes until you have established which directory is failing; a global chmod -R can expose unrelated files and still leave a chroot or SELinux denial unresolved.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
3. Verify vsftpd allows the requested kind of upload
Linux permissions can be correct while vsftpd refuses the operation. Open /etc/vsftpd/vsftpd.conf and verify the settings that apply to the account.
Local-user uploads
For normal authenticated local users, confirm:
local_enable=YES
write_enable=YESlocal_enable=YES permits local-user logins, while write_enable=YES enables FTP commands that modify the filesystem, including uploads. A missing or disabled write setting can produce a 553 even when the destination directory is writable from a shell.
Anonymous uploads
Anonymous transfers follow a separate policy. The anonymous-write setting must be enabled for anonymous uploads, and the target directory must be intentionally writable for that purpose. Do not enable anonymous writing merely to test a local-user problem: it changes who can place files on the server and increases the exposure of the target directory.
Effective values may come from several places
Review local_root, local_umask and any per-user files under user_config_dir. A per-user file can override the global configuration, so checking only the main file can lead you to believe uploads are enabled when the affected account receives a different value. Conversely, a global setting may appear restrictive while a per-user file enables a behavior for one account.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
local_umask controls the mode bits of newly created files; it does not grant the directory permission needed to create them. Treat it as a post-creation mode policy, not a substitute for directory write and execute access.
4. Check chroot safety and placement
vsftpd commonly places sessions in a chroot jail. Chroot changes the filesystem root presented to the FTP process, so the path the user sees can differ from the host path you inspect in a shell.
Keep the jail base safe
Many configurations require the chroot base itself to be non-writable by the jailed user. A practical layout is a non-writable jail directory with a writable child directory below it. The account enters the jail at the safe base and uploads into the child.
If you make the jail base writable just to clear a 553, you may violate vsftpd’s chroot safety requirements or create an unsafe configuration. Instead, keep the base ownership and mode compliant with the active configuration and place the upload area underneath it.
Recommended Free Tools
Verify the mapping, not just the directory name
Compare the FTP client’s pwd output with the configured local_root and the account’s chroot behavior. Then map the displayed child directory to its host path and run namei -l there. A correctly writable host directory is irrelevant if it is outside the chroot-visible tree; a correctly mapped child can still fail if one parent lacks execute permission.
5. Check SELinux labels and booleans
SELinux can deny file creation independently of Unix ownership and mode bits. Check its state and the label on the destination:
getenforce
ls -Zd /path/to/upload
ausearch -m AVC -ts recentIf the audit search does not show recent records, inspect the system audit log for an AVC denial corresponding to the upload attempt. Perform the check immediately after reproducing the failure so the relevant event is easy to identify.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Use a write-capable content type
Red Hat’s SELinux User’s and Administrator’s Guide for RHEL 7 documents the distinction that matters here: files labeled public_content_t are read-only to the relevant service, while public_content_rw_t is the label for FTP read/write directories. Red Hat states: “Files labeled with the public_content_t type cannot be written to, even if Linux permissions allow write access.”
Free tools Windows power users keep installed
One-click scans. No signup required.
Therefore, changing only chmod will not fix a directory whose label permits reading but not writing. Label the intended FTP upload directory with the policy’s read/write content type, and limit that label to the directory that genuinely needs FTP writes.
Anonymous-write and home-directory policy
Anonymous uploads also require the documented FTP anonymous-write SELinux Boolean to be enabled in addition to a suitable directory label. The exact available Boolean is supplied by the installed policy; inspect the FTP-related booleans on the host and enable the one documented for anonymous writes only when anonymous uploads are intentional.
For authenticated users writing in their home directories, check the ftp_home_dir Boolean on the installed policy. A disabled Boolean can block home-directory access even when the account owns the directory and its mode bits appear correct.
Runtime versus persistent labeling
A runtime relabel such as chcon can be useful for a controlled test, but it may not survive a relabeling operation or policy maintenance. A persistent file-context rule, applied with the system’s file-context tools and followed by a restore operation, survives those events. Choose persistence when the directory is a permanent FTP endpoint; use a temporary change only to isolate the cause, then record and implement the durable policy.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →6. Reload, test and read the logs
After editing /etc/vsftpd/vsftpd.conf or changing a setting that requires service reconfiguration, restart or reload vsftpd. On CentOS 7 a restart can be issued with:
systemctl restart vsftpdUse the service’s normal reload method when you specifically need a reload and the current configuration supports it. If the restart fails, inspect the service status and configuration error before testing another upload.
Use one controlled upload
- Start a fresh FTP session as the affected account so chroot state and group membership are current.
- Run
pwdandls -laagain, then target a uniquely named small file in the intended child directory. - Confirm that the upload completes and that the file appears in the expected host directory.
- Check
/var/log/vsftpd.logand the system journal for the corresponding connection, denial or successful transfer. - Remove the test file and retain only the narrowest permissions, labels and booleans required for the real workflow.
A uniquely named small file distinguishes the current test from an old partial upload and makes the matching log event easier to find. If the test still returns 553, leave the permissions unchanged while you check the next layer; changing several layers at once makes the original cause harder to identify.
Choose the fix that matches the cause
| Cause | Typical correction | Scope | Security impact | Persistence |
|---|---|---|---|---|
| Wrong FTP-visible path or chroot mapping | Correct local_root, chroot placement or per-user path so the target is inside the intended writable child. |
One account, jail or mapped directory. | Usually narrower than granting broad filesystem access. | Configuration change; survives service restarts when saved in the applicable file. |
| Linux DAC ownership or directory mode | Grant the intended owner or group write and execute on the destination, plus execute on each parent. | Selected directory and its access group. | Narrow when applied to the upload directory; world-writable trees are broad and risky. | Persistent in filesystem ownership and mode until changed. |
| vsftpd upload setting | Enable the relevant local, write or anonymous setting and remove conflicting per-user overrides. | Global service or selected users under user_config_dir. |
Anonymous write has a wider exposure than authenticated local-user write. | Persistent in vsftpd configuration after restart or reload. |
| SELinux label or Boolean | Use the appropriate read/write content label and enable only the required FTP policy Boolean. | Specific labeled directory or policy behavior. | Policy-constrained access is safer than disabling SELinux. | chcon is runtime-oriented; a persistent file-context rule survives relabeling. |
Common 553 scenarios and the correct branch
Listing works, upload fails immediately
Start with the destination directory’s write and execute bits, then check write_enable. Listing demonstrates read/list capability only. If both are correct, inspect the SELinux label and AVC records before changing ownership again.
The host directory is writable, but the FTP client cannot create a file
Compare the FTP client’s pwd with local_root and chroot settings. The user may be targeting a different directory inside the jail. Map that displayed path to the host, then repeat the DAC and SELinux checks against the mapped destination.
Only one FTP account receives 553
Inspect that account’s file under user_config_dir, its home or local root, and its group memberships. A per-user setting or a different chroot mapping can produce a failure that other accounts do not share.
Changing chmod did not help
Check for an SELinux denial. A directory labeled public_content_t remains non-writable to the relevant service even when Unix mode bits grant write access. Use the read/write content label intended for FTP and verify the required Boolean rather than disabling SELinux.
The service rejects the configuration after an edit
Undo the last change or correct the syntax, then restart or reload vsftpd and inspect the service status. Do not interpret a failed service start as an upload-permission result; first restore a running, known configuration and then repeat the controlled test.
A repeatable diagnostic checklist
- Record the exact FTP reply, account and destination filename.
- In the FTP client, run
pwdandls -la. - Resolve the FTP path through
local_root,chroot_local_userand any per-user configuration. - As root, run
namei -lon the mapped host path andls -ldon the destination. - Run
id ftpuserand verify the intended owner or group access. - Confirm
local_enable=YESandwrite_enable=YESfor local users, or the separate anonymous-write setting for anonymous transfers. - Check
local_umaskand per-user overrides; do not confuse a file umask with directory write permission. - Keep the chroot base safe and put the writable area in a child directory.
- Run
getenforce,ls -Zdand an AVC search; usepublic_content_rw_tfor an FTP read/write directory where that policy applies. - Check the
ftp_home_dirBoolean for authenticated home-directory access and the documented anonymous-write Boolean for anonymous uploads. - Restart or reload vsftpd, upload one uniquely named small file, inspect logs and the journal, then remove the artifact.
Security practices while fixing 553
Do not make the entire filesystem, a user’s complete home tree or every FTP directory writable simply because one upload fails. Restrict write access to the intended destination and keep parent directories executable but not broadly writable. Treat anonymous uploads as a separate risk decision, because enabling them changes who can place content on the server.
Do not disable SELinux as a first response. The policy is often telling you that the directory’s label or Boolean does not match the intended FTP operation. Correct the context and policy setting, then verify with an AVC-free controlled upload. Keep a record of any persistent file-context rule so a future relabel does not silently restore the original denial.
Final verification
A successful fix has three observable parts: the FTP session reaches the intended directory, the server can create a file there under Linux DAC and vsftpd policy, and SELinux permits the same operation. Verify all three with a new session and a uniquely named test upload, confirm the resulting file and log entries, delete the test artifact and leave the smallest working access scope in place.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
