A ProFTPD 530 Login incorrect response is a generic authentication rejection, not proof that the password is wrong. The quickest reliable fix is to find the matching log entry, verify which configuration and identity source the running daemon uses, then correct the specific PAM, account, virtual-user, policy, or filesystem error it reports.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Work through the checks below in order. They apply to Ubuntu installations using local Unix accounts, PAM, virtual users, or a combination of those methods.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
What ProFTPD’s 530 response actually means
FTP status code 530 means that ProFTPD refused the login. ProFTPD deliberately uses this response for several different failures, including an invalid password, a PAM denial, an account that is locked or expired, a user missing from the configured identity source, a rejected shell, a login limit, malformed virtual-user data, or a home-directory/chroot permission problem.
The number in the FTP client is therefore only the symptom. The daemon’s log message identifies the module and policy that made the decision. Treat the client message as a prompt to inspect server-side evidence rather than repeatedly changing the password.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Use this diagnostic order
- Record the username and exact time of one failed attempt.
- Read the ProFTPD and authentication logs for that attempt.
- Confirm the configuration file and included snippets loaded by the running service.
- Run a configuration test before restarting anything.
- Verify the account, password state, and identity source.
- Inspect PAM policy and the order in which authentication modules are consulted.
- If virtual users are enabled, validate the user and group files and their permissions.
- Check shell, login-limit, home-directory, and chroot restrictions.
- If the cause is still unclear, reproduce one login in foreground debug mode.
Read the logs before changing settings
ProFTPD sends authentication messages through the auth or authpriv syslog facility. Ubuntu installations commonly expose those messages in the system journal and /var/log/auth.log, although a different syslog destination or log rotation policy may be configured.
Immediately after reproducing one failure, search a narrow time window. Replace alice with the actual login name:
Recommended Free Tools
sudo journalctl --since "10 minutes ago" | grep -Ei 'proftpd|ftp|alice'
sudo grep -Ei 'proftpd|ftp|alice' /var/log/auth.logIf the service has its own journal stream, also try:
sudo journalctl -u proftpd --since "10 minutes ago"Look for the first meaningful rejection, not just the final 530 line. Messages about PAM, an unavailable account, a malformed AuthUserFile entry, a denied shell, or a failed chroot point to different fixes. Save the complete line, including the path or module name, before making changes; it gives you a way to confirm whether the next test reached the same code path.
Confirm which ProFTPD configuration is active
Ubuntu’s documented default configuration is /etc/proftpd/proftpd.conf, but the daemon can be started with -c to use another file. A manual diagnostic command that reads the default file can produce misleading results if systemd starts the service with a custom path or wrapper.
Inspect the service command
Check the unit and the running process:
systemctl cat proftpd
ps -ef | grep '[p]roftpd'Find an explicit -c option, an alternate service unit, or an included directory. Then inspect the main file for Include, AuthPAM, AuthUserFile, AuthGroupFile, RequireValidShell, <Limit LOGIN>, and chroot-related directives. Included files may override or narrow settings that appear permissive in the main file.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Directive names are case-insensitive, but directive values are case-sensitive. A path, username, group name, or PAM service name with different capitalization can select a different resource from the one you tested.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Test syntax with the same file
Run ProFTPD’s configuration-test mode before restarting:
sudo proftpd -t -c /etc/proftpd/proftpd.confUse the exact path found in the service command if it is not the Ubuntu default. A successful syntax test means the file parses; it does not prove that the account can authenticate. If the test reports an error, fix that first. ProFTPD logs configuration parsing failures, and a daemon that cannot load the intended settings may be running with a different startup state than you expect.
After a clean test, restart through the service manager and check its status:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
sudo systemctl restart proftpd
sudo systemctl status proftpd --no-pagerVerify the account and password state
For local Unix authentication, first establish that the name resolves from the same identity source ProFTPD is configured to query:
getent passwd aliceThe first command should return the user’s UID, primary GID, home directory, and login shell. If it returns nothing, ProFTPD cannot authenticate that name as a local Unix account. For network identities, use the corresponding NSS, LDAP, SQL, or other source configured on the server instead of assuming /etc/passwd is authoritative.
Check whether the password is usable and whether local account policy has disabled the account:
sudo passwd -S alice
sudo chage -l aliceInterpret the output for an expired password, an account expiration date, or a locked password marker. Unlock or reset the account only when that is consistent with your security policy. Also test for a client-side cause: delete a saved FTP credential or type the username again so an old password is not being submitted silently.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
PAM can decide whether a user is allowed to log in, but it does not by itself supply the UID, GID, home directory, or other account metadata ProFTPD needs for a session. Those attributes must resolve through a Unix account, an AuthUserFile, SQL, LDAP, or another configured ProFTPD source.
Check PAM policy and authentication order
Ubuntu packages commonly use a PAM service file at /etc/pam.d/proftpd, but the actual filename and stack depend on the package and the AuthPAMServiceName or related settings in the active configuration. Inspect the file named by the running configuration:
sudo sed -n '1,240p' /etc/pam.d/proftpdReview every module in the stack, including account, authentication, session, and shell-related checks. A deny-list module, an expired-account check, an access-time rule, or a shell allowlist can reject an otherwise correct password. Compare the FTP stack with the SSH stack only to understand the difference; SSH success proves that /etc/pam.d/sshd accepted the login, not that ProFTPD’s PAM service did.
ProFTPD can consult PAM and Unix, file, SQL, or LDAP modules in a configured order. An authoritative result from one module can stop fallback to another. For example, a local PAM denial may prevent a virtual-user lookup that would otherwise succeed. Read the authentication directives in the loaded configuration and determine which source is expected to answer for this username.
Do not weaken PAM controls simply to make FTP work. Remove an unintended deny rule or correct the service-file reference, then retest one account and confirm that the intended policy still applies.
Validate virtual users and group files
If the server uses virtual accounts, inspect the paths in AuthUserFile and AuthGroupFile. Confirm that each path exists and that the daemon can read it:
sudo ls -l /path/to/AuthUserFile /path/to/AuthGroupFile
sudo -u proftpd test -r /path/to/AuthUserFile
sudo -u proftpd test -r /path/to/AuthGroupFileReplace proftpd with the actual service account if the unit uses another user. A root-readable file is not necessarily readable by the daemon after it drops privileges.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Entries use a colon-delimited, passwd-style format expected by the configured authentication module. A missing field or an extra colon can shift values into the wrong columns. ProFTPD reports errors such as “Malformed entry in AuthUserFile/AuthGroupFile” when a record is structurally invalid. Check for:
- an accidental blank or truncated line;
- extra colons inside a field;
- a path that differs from the one in the active configuration;
- ownership or mode bits that block daemon access; and
- a UID, GID, or home directory that no longer exists.
Protect these files because they may contain password material or password hashes. Make a controlled backup, edit with a method that preserves ownership and permissions, and avoid printing the entire file into a shared log or terminal recording.
Check shell, login rules, and directory permissions
Valid-shell checks
The RequireValidShell directive can require the account’s shell to appear in /etc/shells. PAM modules can impose a similar rule independently. Check the shell returned by getent passwd and compare it with the server’s policy:
grep -n '^[^#].*' /etc/shells
getent passwd aliceDo not add a shell to /etc/shells merely to bypass a rejection. First determine whether the FTP service is intended to accept that account and whether the PAM stack enforces the allowlist. A non-interactive shell may be appropriate for a restricted FTP identity, but changing it affects other services and should be deliberate.
Login limits and access rules
Search the active configuration for <Limit LOGIN> blocks and any allow or deny directives. A rule can reject a user, group, source address, or class before password verification or immediately afterward. Check spelling and case of usernames and groups, and remember that an included file may contain the rule that wins.
Home and chroot permissions
A successful password still cannot produce a session if ProFTPD cannot enter the home directory or configured chroot. Inspect every path component:
namei -l /srv/ftp/alice
sudo -u proftpd test -x /srv
sudo -u proftpd test -x /srv/ftp
sudo -u proftpd test -x /srv/ftp/aliceUse the daemon’s actual runtime user for these tests. The user needs execute permission on every parent directory and on the target path; read permission alone is insufficient to traverse a directory. If the log names a different chroot target, test that exact path. Correct ownership, group membership, ACLs, or mode bits rather than granting broad permissions to the whole filesystem.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Also check that the configured home directory exists and is not on a mount that failed to start. A missing mount can look like an authentication problem when the session setup fails directly after the password is accepted.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Use foreground debug mode when the log is ambiguous
ProFTPD can emit progressively more diagnostic detail with -d N, where N ranges from 1 through 10. The -n option keeps the daemon in the foreground so messages appear in the terminal.
Only do this during a controlled maintenance window. Stop the service first so the foreground process does not collide with the listener already bound to the FTP port:
sudo systemctl stop proftpd
sudo proftpd -n -d 10 -c /etc/proftpd/proftpd.confUse the same -c path, included files, TLS settings, and listening configuration as the service. From one FTP client, reproduce a single failed login and watch for the first module that returns a denial. The output may expose usernames, paths, or other sensitive details, so do not paste it into a public issue without redacting them.
Press Ctrl+C after the test, start the managed service again, and verify it is healthy:
sudo systemctl start proftpd
sudo systemctl status proftpd --no-pagerDebug output is most useful when paired with the timestamped syslog entry. If the foreground command succeeds but the service fails, the two processes are not using the same configuration, environment, permissions, or identity source.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchMatch the symptom to the likely cause
| Evidence in the log or test | Likely cause | Targeted correction |
|---|---|---|
Unknown user or no result from getent passwd |
The name is absent from the configured Unix/NSS source, or ProFTPD is querying a different source. | Correct the identity-source configuration or create/enable the account in the intended source. |
| Authentication module reports a denial while SSH works | The FTP PAM service, account policy, or module order differs from SSH. | Inspect /etc/pam.d/proftpd and the AuthPAM* settings; fix the specific policy denial. |
| “Malformed entry in AuthUserFile/AuthGroupFile” | A missing field, extra colon, wrong path, or unreadable file. | Repair the record format and verify daemon-readable ownership and permissions. |
| Valid-shell or shell-list error | RequireValidShell or a PAM shell module rejects the account’s shell. |
Align the account and policy intentionally; do not bypass the check blindly. |
Access denied in a <Limit LOGIN> block |
A user, group, address, or class restriction applies. | Correct the allow/deny rule or place the account in the intended group/class. |
| Chroot or “cannot access directory” error | Missing directory, failed mount, or missing execute permission on a parent path. | Restore the path and grant the daemon’s runtime user the required traversal rights. |
| Configuration parse error or different directives in debug mode | The service and diagnostic command load different files or snippets. | Use the service’s actual -c path and rerun proftpd -t. |
Why an SSH login can work while FTP fails
SSH and FTP are separate services. They can use different PAM service files, different authentication modules, different account-source directives, and different post-authentication restrictions. SSH may accept a user through /etc/pam.d/sshd while ProFTPD rejects the same password through /etc/pam.d/proftpd. ProFTPD may also apply a shell requirement, login limit, virtual-user mapping, or chroot that SSH never evaluates.
Compare the complete decision paths rather than treating SSH success as proof of an FTP configuration problem. Confirm which source ProFTPD expects, inspect its PAM stack, and follow the log message generated by the FTP attempt.
After login works: choose a secure transport
Plain FTP sends credentials and file data without encryption. If an existing application requires FTP semantics, configure FTP over TLS (FTPS) with a certificate, enable the ProFTPD TLS module, and open the passive-port range required by the server and network firewall. Test both the control connection and a directory transfer because a firewall can permit login while blocking the data channel.
If FTP compatibility is not required, SFTP is a separate protocol carried over OpenSSH. It normally needs only the SSH service and avoids FTP’s separate passive data ports and NAT complications. It is not enabled by fixing a ProFTPD directive, and an SFTP client cannot connect to an FTP-only listener.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsQuick Recap
| Option | Encryption | Operational considerations | Use it when |
|---|---|---|---|
| Plain FTP | None; credentials and data are exposed on the network. | Simple protocol behavior but unsafe outside a controlled, isolated network. | Only for a tightly controlled legacy environment where exposure is explicitly accepted. |
| FTPS | TLS protects the FTP control and data channels when configured correctly. | Requires certificates, TLS policy, and passive-port/firewall coordination. | An application specifically requires FTP commands or an FTP server endpoint. |
| SFTP | SSH encryption protects the session. | Uses the SSH service and avoids FTP passive data ports; clients and permissions are SSH/SFTP-specific. | You can choose a file-transfer protocol instead of preserving FTP compatibility. |
Prevent the next 530 incident
- Keep the service unit, configuration path, and included files documented so manual tests use the same settings as production.
- Validate
proftpd -tafter configuration changes and before every restart. - Monitor authentication logs and retain enough history to correlate a client attempt with the server decision.
- Use separate, least-privilege accounts for FTP workloads and review lock, expiry, shell, and group policy regularly.
- Protect virtual-user files, verify their permissions after package or deployment changes, and test one known account after edits.
- Document the passive-port range and firewall rules if FTPS is enabled.
- Prefer encrypted transport and avoid exposing plain FTP credentials on untrusted networks.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
