A “permission denied” upload, including vsftpd’s 553 Could not create file, is usually caused by more than one control. Check the FTP daemon policy, the Unix account and every directory in the path, chroot path mapping, and (on enforcing systems) SELinux. Then test the exact FTP identity with touch before changing permissions.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The durable fix is narrow: enable write commands in vsftpd, give the FTP account access through a deployment group or a specific upload directory, make the path visible inside any chroot, and apply the correct SELinux context. Do not make the entire web root world-writable.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What the error actually means
FTP can authenticate successfully and still be unable to create a file. Authentication proves only that vsftpd accepted the credentials; the subsequent STOR (upload), MKD (make directory), rename, or delete operation must pass several independent checks.
- vsftpd policy: the daemon must allow filesystem-changing commands.
- Unix discretionary access control: the account used for the FTP session needs write permission on the destination and execute (traverse) permission on every parent directory.
- Path mapping: a local root or chroot can make the path seen by FTP different from the path you inspect in the shell.
- SELinux mandatory access control: an enforcing policy can deny an operation even when Unix owner, group, and mode bits look correct.
- Application identity: PHP-FPM may run as a different user and group from FTP, so a web application can fail to write to files that FTP can create, or vice versa.
A 553 response is therefore a symptom, not a single diagnosis. Find which layer rejects the operation instead of repeatedly changing mode bits.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
1. Check vsftpd’s write policy first
In the Debian reference configuration, write_enable defaults to NO. The vsftpd project FAQ states: “By default, write commands, including uploads and new directories, are disabled.” When this setting is off, changing ownership or running chmod cannot make uploads work because the daemon will not issue the filesystem-changing operation.
Inspect the effective settings
sudo grep -E '^(write_enable|local_enable|guest_enable|virtual_use_local_privs|chroot_local_user|local_root)' /etc/vsftpd.confFor local-user uploads, local_enable=YES must permit local accounts to log in and write_enable=YES must permit commands such as STOR, DELE, RNFR, RNTO, MKD, RMD, APPE, and SITE. If you use guest or virtual users, check those settings separately rather than assuming they inherit local-user behavior.
Virtual users are more restricted by default. virtual_use_local_privs=YES makes a virtual user use local-user privileges; it does not replace the need for correct Unix ownership, modes, path traversal, or SELinux authorization. Change only the options required by your account model, then reload the daemon:
sudo systemctl reload vsftpdUse the service’s logs after reloading if the client still reports the same error. A successful reload confirms that the configuration parses; it does not confirm that the target directory is writable.
2. Identify the account and inspect the complete path
The important identity is the one vsftpd uses for the session, not necessarily the administrator account that created the directory. Determine whether the login is a local user, a virtual user mapped to a system account, or a guest account. Then inspect that account and the entire destination path.
id FTPUSER
namei -l /var/www/example/upload
ls -ld /var/www /var/www/example /var/www/example/uploadReplace FTPUSER and the path with your actual values. namei -l displays each component, making hidden traversal failures visible. A user can have write permission on upload and still receive a denial if, for example, /var/www/example lacks execute permission for that user or an applicable group.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
What permissions must exist
- Every parent directory from the filesystem root to the destination needs execute permission for the FTP account or one of its groups. Execute on a directory means “traverse”; read permission is not a substitute.
- The destination directory needs write permission for the account or a group it belongs to. Directory write allows creating and removing entries; directory execute allows accessing them.
- For an upload that also replaces or renames an existing file, the directory’s permissions matter, not just the file’s mode.
- Ownership and group membership must match the identity shown by
id. A group added recently may require a new login session before the FTP process receives it.
Prefer a dedicated deployment or upload group and a narrowly scoped directory. This makes the intended writers explicit and avoids granting unrelated system users write access to the web root.
Prove Unix access without FTP
Run a harmless create-and-remove test as the same Unix identity:
sudo -u FTPUSER touch /var/www/example/upload/.permission-test
sudo -u FTPUSER rm /var/www/example/upload/.permission-testIf touch fails, fix ownership, group membership, directory modes, or parent traversal before changing any vsftpd option. If both commands succeed, Unix discretionary access is sufficient for that path; continue with chroot mapping, SELinux, and daemon logs.
3. Understand chroot and local-root path mapping
A chroot changes the filesystem view presented to the FTP process. With chroot_local_user=YES, a local account is confined to its jail. A virtual-user local_root likewise maps that user into a selected directory. The path a client calls /upload may therefore correspond to a different host path than the one you tested from an administrative shell.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsKeep the jail root protected
Do not make the chroot’s top directory writable merely to satisfy an FTP client. Keep the jail root owned and protected, then create a writable child such as /upload or /files beneath it. Grant the FTP identity write access to that child only. This arrangement satisfies the jail’s path requirements without turning the account’s entire visible filesystem into a writable location.
When diagnosing a failure, map both sides explicitly:
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
- Record the host path configured by
local_root, if present. - Record the directory the client sees after login and whether the client starts in a subdirectory.
- Run
namei -lagainst the host-side target, then verify that the same target is reachable inside the jail.
Options that provide unrestricted filesystem access can create serious security problems. Use the narrowest root and writable child that supports the deployment task.
4. Check SELinux when Unix permissions look correct
On an SELinux-enforcing distribution, discretionary access control (owner, group, and mode) is only one decision. The SELinux file context and policy must also allow the FTP operation.
Confirm enforcement and inspect labels
getenforce
ls -Zd /var/www/example/upload
sudo ausearch -m AVC -ts recentgetenforce reports whether the policy is enforcing. ls -Zd shows the directory’s SELinux context, while ausearch searches recent access-vector-cache (AVC) denials. Run the search soon after reproducing the FTP error so unrelated events do not obscure the relevant denial.
Use the policy’s intended labels and booleans
The ftpd policy documents controls including ftp_home_dir and allow_ftpd_anon_write. Public FTP content normally uses public_content_t for read-only access and public_content_rw_t when a service must write. Select the label and boolean that match your account and directory design; do not enable anonymous write merely because a local user cannot upload.
For a persistent custom path, use semanage fcontext to define the desired context and restorecon to apply it. A temporary chcon change can appear to fix the problem but may be lost after a relabel, policy update, or filesystem restoration.
If the Unix touch test succeeds and the host is enforcing SELinux, correct the context or narrowly required boolean, then repeat the test and the FTP upload. If an AVC remains, use its source and target labels to avoid enabling a broader permission than the application needs.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
5. Make FTP and PHP-FPM share files safely
LEMP deployments commonly involve three identities: FTP, nginx, and PHP-FPM. PHP-FPM pools can be configured with their own uid and gid; those values determine the effective identity of PHP application code. They may differ from both the FTP account and the nginx worker.
Choose directories by purpose
Separate release files, runtime uploads, and caches instead of making one web-root tree writable by every service.
- Releases: FTP or a deployment process writes a new release. nginx needs read and execute access to serve it; PHP-FPM generally does not need to modify released code.
- Runtime uploads: grant write access to the application identity and, only where required, the FTP deployment group. Keep executable code out of user-uploaded locations when possible.
- Caches and generated data: grant PHP-FPM write access only to the application directories that generate them.
A dedicated shared group can provide controlled cooperation: add the FTP and PHP-FPM identities to that group, make the relevant directory group-owned, and use group write permission there. Confirm the effective pool user and group in the PHP-FPM pool configuration before making changes; guessing from the web server’s account is unreliable.
Do not expose the PHP-FPM FastCGI listener to an untrusted network. PHP documentation warns that an exposed FastCGI connection can enable code execution. Keep the listener on a protected local socket or otherwise restrict its network reachability while you solve file permissions.
A safe troubleshooting sequence
Follow this order so each test isolates one layer and leaves an audit trail:
- Capture the exact failure. Note whether the client is uploading, creating a directory, deleting, or renaming, and record the server’s response, such as
553 Could not create file. - Inspect daemon policy. Check
write_enable, local or virtual-user settings, chroot options, andlocal_root. Set only the required write policy and reload vsftpd. - Identify the effective Unix account. Run
id FTPUSERfor the mapped account, not merely the name typed into the client. - Inspect every path component. Use
namei -landls -ldon the host-side destination. Verify traverse permission on all parents and write permission on the target directory. - Run the harmless identity test. Execute
sudo -u FTPUSER touch ..., followed by removal. A failure here is a Unix ownership, group, mode, or traversal problem. - Validate the FTP-visible path. If chroot or
local_rootis enabled, map the client path to the host path and ensure the writable child exists inside the jail. - Check SELinux. On an enforcing host, inspect
getenforce, the directory label, and recent AVC records. Apply a persistent context and the narrow policy control required for that directory. - Read daemon logs and retry. If the direct Unix test succeeds but FTP still fails, logs can distinguish a policy rejection, path mapping error, or an operation-specific restriction.
Common fixes that do not solve the real problem
“I ran chmod 777”
World-writable mode bits do not enable a daemon whose write_enable is off, do not change a chroot path, and do not override SELinux. They also grant write access to every local account and make it harder to identify the intended writer. Revert broad modes and grant access through a dedicated group or a specific upload directory.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
“FTP can log in, so the account must have access”
Login and file creation are separate operations. Authentication does not grant directory traversal or write permission.
“The directory owner is correct, but uploads still fail”
Check parent-directory execute bits, the account’s supplementary groups, the FTP-visible path inside a jail, and SELinux labels. A correct owner on the final directory is only one condition.
“PHP can write, so FTP should work”
PHP-FPM and vsftpd may use different UIDs, GIDs, chroots, and SELinux domains. Test each identity independently and share only the directories that genuinely require both writers.
Compare fixes by the layer they address
| Fix | Layer | What it changes | When it is appropriate |
|---|---|---|---|
write_enable=YES |
vsftpd daemon policy | Allows filesystem-changing FTP commands such as uploads and new directories | The daemon rejects writes before filesystem permissions are evaluated |
| Dedicated group and directory modes | Unix discretionary access | Grants the FTP identity, or a controlled group, write and traverse access | The sudo -u FTPUSER touch test fails |
Chroot child directory and correct local_root |
FTP path visibility | Places a writable directory inside the account’s FTP-visible filesystem | The host path is writable but the client’s jailed path is not |
| SELinux context and narrowly scoped boolean | Mandatory access control | Authorizes the FTP domain to write the labeled directory | Unix checks pass on an enforcing SELinux host and AVC records show a denial |
| Shared application-data group | LEMP identity design | Lets FTP and PHP-FPM write the same limited data directory | Both services genuinely need write access to one path |
A secure end state
A working configuration is not simply one that accepts an upload. It should also limit what a compromised FTP credential or web process can modify. Keep the web root and release tree non-writable to unrelated users, expose only the required FTP directory through a chroot or local root, and separate immutable code from mutable data. Use persistent SELinux file-context rules where applicable, verify PHP-FPM’s effective identity, and keep its FastCGI endpoint off untrusted networks.
After each change, repeat the identity-level create-and-remove test and then perform the smallest real FTP operation needed: upload one harmless file, create one test directory only if required, and remove the test artifacts. This confirms the precise operation without normalizing excessive permissions.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
