iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
A 530 Login incorrect response means vsftpd rejected the authentication attempt or an account-access policy. It does not prove that the password is wrong. For a local Linux account, first confirm local_enable=YES, then check the PAM service, account status and shell, user-list rules, and finally chroot settings while watching the server logs.
What a 530 Login incorrect response actually means
FTP clients display the same 530 code for several different failures. vsftpd can reject a login before it verifies a password, during PAM authentication, or after authentication when an account policy disallows access. A correct password therefore can still produce 530.
The useful question is not “what password should I try next?” but “which access gate rejected this account?” The gates normally appear in this order:
- vsftpd is running the configuration file you edited.
- Local-user authentication is enabled, or the selected virtual-user method is configured.
- The PAM service named by
pam_service_nameexists and permits the account. - The Linux account is present, usable, unexpired and has an acceptable login shell.
- User-list rules do not deny the name, or an allow list includes it.
- Filesystem isolation and permissions permit the post-login session.
A chroot problem is often a separate error. For example, a writable chroot root normally produces 500 OOPS: vsftpd: refusing to run with writable root inside chroot(), not 530. Treat that as a filesystem-isolation issue after authentication is working.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Start with a controlled diagnosis
Change one setting at a time and test with one known account. Repeated password resets can hide the real cause and may trigger account-locking policies.
- Record the exact username, server address and client protocol. Make sure the client is using FTP or FTPS, not SFTP; SFTP requires an SSH server and is not handled by vsftpd.
- Open a root shell on the server and check the service:
sudo systemctl status vsftpd - In a second terminal, watch logs while making one login attempt:
sudo journalctl -u vsftpd -fOn Debian or Ubuntu, also check the authentication log, commonly
/var/log/auth.log. Other distributions may use/var/log/secure. - Capture the client’s server response. In FileZilla, the message log shows whether the failure is a 530 authentication response or a later data-channel error.
- After each deliberate configuration change, reload or restart the service as appropriate and repeat the same test. Do not make several unrelated edits before testing.
Verify that vsftpd is using the configuration you edited
A surprisingly common cause is editing one file while the service starts with another. Most package installations use /etc/vsftpd.conf, but a unit file or a manually started daemon can specify a different path.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →- Inspect the unit definition and its start command:
sudo systemctl cat vsftpd - Look for an explicit configuration argument in
ExecStart. If it names another file, inspect that file instead of assuming/etc/vsftpd.confis active. - Search the active file for the directives that control local access:
sudo grep -E '^(local_enable|write_enable|pam_service_name|userlist_enable|userlist_deny|userlist_file|chroot_local_user|chroot_list_enable|chroot_list_file|allow_writeable_chroot)' /etc/vsftpd.confIf your distribution uses another path, substitute it.
- Check for duplicate directives. In a simple configuration, keep one authoritative line for each option; a later occurrence can override an earlier one and make troubleshooting confusing.
After editing, apply the change and verify that the service remains active:
sudo systemctl restart vsftpd
sudo systemctl --no-pager --full status vsftpdIf the service fails to start, fix the syntax or unsupported option first. A client cannot authenticate against a daemon that is not running the intended configuration.
Enable local Linux-user authentication
For ordinary accounts from /etc/passwd or a directory service exposed through NSS, the key setting is:
local_enable=YESThe Debian vsftpd manual specifies that this option must be enabled for any non-anonymous login, including virtual users. If it is disabled, every local account can receive a client-facing 530 regardless of password correctness.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Set write access independently. write_enable=YES is needed only for operations such as uploads, directory creation, deletion or renaming that your other permissions allow. It is not required merely to authenticate or download files.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
local_enable=YES
write_enable=NOThis is a sensible read-only starting point. If the account must upload, enable writes deliberately and then restrict the filesystem and commands:
local_enable=YES
write_enable=YESAfter changing either option, restart vsftpd and test again while watching the journal. A successful password exchange followed by a directory or permission error means authentication is fixed and the remaining problem is authorization or filesystem access.
Check PAM: the policy behind the password prompt
vsftpd normally delegates local-user authentication and account checks to Pluggable Authentication Modules (PAM). The service name is selected by pam_service_name; a typical value is vsftpd, which points to /etc/pam.d/vsftpd.
- Read the configured service name in the active vsftpd configuration:
grep '^pam_service_name' /etc/vsftpd.confIf the directive is absent, use the distribution default documented by its package.
- Confirm that the corresponding PAM file exists. For a service name of
vsftpd:sudo ls -l /etc/pam.d/vsftpd sudo sed -n '1,200p' /etc/pam.d/vsftpd - Look for modules that can deny authentication or account access, including password, account-expiry, group, shell and directory-service modules. A missing module, typo, wrong service name or an upstream directory outage can make every password appear wrong.
- Attempt one login and correlate the timestamp with
journalctl -u vsftpdand the system authentication log. PAM usually records the reason more precisely than the FTP client.
Do not replace the PAM file with a random example or remove account checks simply to make a login succeed. PAM may enforce lockout, expiration, group membership, two-factor authentication or a directory-service policy. Fix the failing policy intentionally, and preserve a way to administer the server if the change affects all users.
Validate the Linux account itself
Confirm that the username resolves on the server that runs vsftpd:
getent passwd usernameIf this returns nothing, vsftpd cannot authenticate that name through the local account source you expect. For a local account, inspect its status without exposing the password:
sudo passwd -S username
sudo chage -l usernameThese commands help identify a locked password, an expired password, an expired account or a forced password change. Unlock or renew the account according to your organization’s policy, then test once. Do not assume that resetting a password will clear an account lock or an expired account record.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsRank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Check the account’s shell:
getent passwd usernameThe final field is the configured login shell. Many Debian and Ubuntu PAM configurations include a shell check that requires the shell to appear in /etc/shells. An account using a service shell that is not listed there can therefore receive 530 even with a valid password.
grep -Fx '/bin/bash' /etc/shells
getent passwd username | cut -d: -f7Use the actual shell path returned for the account. If the shell is intentionally non-interactive, decide whether the FTP policy should permit it rather than globally weakening shell checks. Adding a shell to /etc/shells changes which programs consider it a valid login shell, so make that change only after reviewing its security effect.
Understand user-list rules before changing them
When userlist_enable=YES, vsftpd reads the file named by userlist_file. The commonly used default is /etc/vsftpd.user_list, but the active configuration can select another path.
The meaning of that file depends on userlist_deny:
userlist_enable |
userlist_deny |
Effect |
|---|---|---|
| YES | YES | Names in the user-list file are denied. This is a deny list and can reject a user before password verification. |
| YES | NO | Only names in the user-list file are accepted. This is an allow list; every omitted name is rejected. |
| NO | Either value | The user-list mechanism is disabled. |
Inspect the effective values and the file contents:
grep -E '^(userlist_enable|userlist_deny|userlist_file)' /etc/vsftpd.conf
sudo cat /etc/vsftpd.user_listUse the configured path if it differs. Check spelling, capitalization and whitespace: FTP usernames are compared as names, and an unexpected entry can deny a known-good account. With an allow list, add the test account deliberately and retest. With a deny list, remove only the entry that policy says should be permitted.
Separate chroot failures from authentication failures
Chroot settings decide which directory becomes the apparent root after login. They do not fix a rejected password, and changing them too early can obscure the original authentication problem.
How the local-user chroot options interact
| Setting | Practical interpretation |
|---|---|
chroot_local_user=NO |
Local users are not jailed by this option unless another configuration mechanism applies. |
chroot_local_user=YES |
Local users are jailed by default. If a chroot list is enabled, list semantics determine exceptions. |
chroot_list_enable=YES |
Enables the file named by chroot_list_file; whether listed users are jailed or exempt depends on chroot_local_user. |
Read all related directives together, including the path of chroot_list_file. A user may authenticate successfully and then see a 500 refusal because the jail’s root directory is writable. vsftpd refuses that layout because a jailed user who can write the jail root could potentially alter the directory structure used for isolation.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Use a non-writable jail root
The safer layout is a root directory owned and controlled by root, with a separate child directory for uploads:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →sudo chown root:root /srv/ftp/username
sudo chmod 755 /srv/ftp/username
sudo mkdir -p /srv/ftp/username/upload
sudo chown username:username /srv/ftp/username/uploadAdjust paths and ownership to your deployment. The user can write inside upload without writing the jail root itself. Confirm that parent directories are searchable by the account and that any mandatory access-control system, such as AppArmor or SELinux, also permits the intended path.
allow_writeable_chroot=YES can suppress the writable-root refusal on versions that support it, but it is a deliberate security trade-off, not a universal repair. Prefer a non-writable jail root and treat this option as an exception that requires a documented risk decision.
Retest with logs and protocol-appropriate client settings
Once configuration, PAM, account and list rules are correct, make one clean test. Restart or reload vsftpd as required, then run:
sudo journalctl -u vsftpd --since '5 minutes ago'If file logging is enabled, inspect the configured vsftpd log as well. Protocol logging can provide command-level detail while diagnosing a difficult case; enable it temporarily, reproduce one login, collect the evidence, and disable it afterward because logs can contain sensitive connection details.
In FileZilla, create a site entry with:
- The server’s DNS name or IP address.
- FTP as the protocol, not SFTP.
- The port specified by your server; the conventional FTP control port is 21 unless you changed it.
- The exact Linux username and password.
- An encryption mode that matches the server’s plain FTP or explicit/implicit TLS configuration. A TLS mismatch generally produces a negotiation or certificate error rather than a password-specific 530.
Passive-mode data connections affect directory listings and transfers after login. If FileZilla shows 530 during the initial login, concentrate on vsftpd, PAM and account policy first; opening passive data ports will not repair rejected credentials.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Compare the main configuration choices
| Decision | Option A | Option B | Diagnostic clue |
|---|---|---|---|
| Authentication source | Local accounts through NSS and PAM | Directory-service or virtual-user backend through the selected PAM/configuration design | Local users fail while directory users work, or all users fail identically; PAM and service logs distinguish these cases. |
| Access-control model | Deny list: userlist_deny=YES |
Allow list: userlist_deny=NO |
A listed name is rejected in the first model; an unlisted name is rejected in the second. |
| Filesystem isolation | No local-user chroot | Chroot jail with controlled root ownership | A writable jail root can trigger a 500 refusal after authentication. |
| Write requirement | Read-only: write_enable=NO |
Uploads and changes: write_enable=YES plus filesystem permissions |
Successful login followed by upload or mkdir failure indicates authorization, not a bad password. |
Choose the least permissive combination that meets the use case. A configuration that produces a clear PAM or vsftpd log entry for a test login is easier to operate than one that hides all decisions behind a generic client error.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Common symptoms and the correct branch
Every local account gets 530
Check that the active configuration has local_enable=YES, then inspect pam_service_name and the matching PAM file. A missing PAM file, wrong service name or global PAM policy can reject every account.
Only one account gets 530
Compare that account’s lock and expiry state, shell, group or directory-service attributes, and presence in the user-list file. Test with a second known-good account to distinguish a per-user policy from a daemon-wide problem.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallThe password works in another service but not FTP
SSH or a desktop login may use a different PAM service and different shell or group rules. Inspect /etc/pam.d/vsftpd and the vsftpd-specific logs rather than assuming the other service proves FTP policy is correct.
Login succeeds, then the client reports 500 OOPS
Stop changing passwords. Inspect chroot_local_user, chroot_list_enable, the chroot-list file and ownership/mode of the jail root. Make the root non-writable and provide a writable child directory when uploads are required.
Login succeeds but uploads fail
Confirm write_enable=YES, then check Unix ownership, mode bits, ACLs and mandatory access-control policy on the target directory. Authentication and write authorization are separate controls.
FileZilla reports 530 but the server log shows a different reason
Use the server log as the authoritative diagnostic source. The FTP protocol intentionally gives clients a broad status message; PAM and vsftpd logs identify whether the failure was a list rule, account state, shell check or authentication module.
Recommended Free Tools
After the login works: keep the fix safe
- Keep
write_enable=NOunless uploads or other write operations are required. - Use a dedicated account with only the directories and permissions it needs; do not grant administrative privileges to make FTP convenient.
- Keep a non-writable chroot root and a separate writable child directory for uploads.
- Review the PAM file after package upgrades because distribution defaults and module paths can change.
- Retain the user-list policy you intended and document whether it is a deny list or an allow list.
- Use encrypted FTP when credentials must cross an untrusted network, and configure the client’s encryption mode to match the server.
- Disable temporary protocol logging after diagnosis and protect retained authentication logs.
- Record the final configuration and the test account’s expected result so the next incident can be compared against a known baseline.
Minimal read-only local-user example
The following illustrates the essential relationship between the controls; adapt paths, PAM policy and isolation to your distribution:
anonymous_enable=NO
local_enable=YES
write_enable=NO
pam_service_name=vsftpd
userlist_enable=YES
userlist_deny=YES
chroot_local_user=YESThis does not replace review of /etc/pam.d/vsftpd, account status, shell validity, user-list contents or jail ownership. Those controls determine whether a particular account can actually log in and what it can do afterward.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
