The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →ProFTPD’s 530 Login incorrect response is a generic authentication rejection. It does not prove that the password is wrong: PAM policy, the account source, shell restrictions, login limits, a malformed virtual-user file, or a home-directory/chroot failure can produce the same reply. Start by finding the matching failure in the logs, then verify the configuration actually loaded by the running service before changing credentials.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What the 530 response means
FTP status code 530 means that ProFTPD did not accept the login. ProFTPD normally returns this code for a failed authentication attempt, but the code does not identify which layer rejected the session. A correct password can still be refused when the account is locked or expired, a PAM rule denies FTP access, the daemon is reading a different configuration file, a virtual-user record is malformed, or the requested home or chroot path cannot be accessed.
As an Amazon Associate I earn from qualifying purchases.
Use the username and exact time of one failed attempt as your investigation key. Avoid repeated guesses while troubleshooting: each attempt adds noise to the logs and can trigger account lockout policy.
Use this order to isolate the failure
- Read the system and ProFTPD logs for the failed username and timestamp.
- Confirm which configuration file and included snippets the running service uses.
- Run a configuration syntax test before restarting anything.
- Verify the account exists in the identity source ProFTPD is configured to query and that its password and policy state permit login.
- Inspect PAM rules and the order in which PAM, Unix, file, SQL, or LDAP authentication modules are consulted.
- If virtual users are enabled, validate
AuthUserFileandAuthGroupFile, including ownership, permissions, and record syntax. - Check shell restrictions,
<Limit LOGIN>rules, and every directory permission needed to reach the home or chroot path. - If the cause is still unclear, reproduce one attempt in foreground, high-debug mode.
This sequence separates an authentication decision from a configuration or filesystem failure. It also prevents a restart from hiding the evidence you need.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Read the logs before changing credentials
ProFTPD sends authentication messages through the auth or authpriv syslog facility. Ubuntu installations commonly expose these records through the system journal and /var/log/auth.log, although a host may route them to another syslog destination. Successful and failed sessions are logged through syslog as well.
Search the journal
sudo journalctl -u proftpd --since "15 minutes ago"
sudo journalctl --since "15 minutes ago" | grep -i proftpdAdjust the time window to include the failed attempt. If the service is named differently on your installation, use the unit name shown by systemctl list-units or the package’s service status output.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Search the authentication log
sudo grep -i 'username' /var/log/auth.log
sudo tail -n 100 /var/log/auth.logReplace username with the actual login name. Search by both name and timestamp because a busy host can contain messages from several services. Look for wording that identifies PAM, an authorization rule, an authentication-file parse error, or a chroot/path permission failure. The detailed log line is more useful than the 530 shown by the FTP client.
Interpret the evidence
- A password or PAM denial points to the account state, PAM service file, or authentication order.
- “Malformed entry in AuthUserFile/AuthGroupFile” points to a missing field or an extra colon in a virtual-user record.
- A message naming a chroot or home path indicates a filesystem permission or path problem rather than a bad password.
- No matching ProFTPD message often means you are reading the wrong log destination, the wrong time range, or a different daemon/configuration than the client is reaching.
Confirm the configuration the daemon is actually using
Ubuntu’s documented default configuration is /etc/proftpd/proftpd.conf, but ProFTPD can be started with -c and therefore use another file. A systemd unit, a wrapper, or a manually launched process may also load a different path. Directives are case-insensitive; their values are case-sensitive.
Inspect the service command line and status
sudo systemctl status proftpd
sudo systemctl cat proftpd
ps -ef | grep '[p]roftpd'Check the displayed ExecStart command and process arguments for a -c option. Treat that path as authoritative for the running service. Do not assume that editing /etc/proftpd/proftpd.conf changes a daemon started with a custom file.
Follow included files
Open the active main file and inspect every Include directive. Authentication settings are often split between the main file and package snippets. Record the effective values for the PAM service, AuthUserFile, AuthGroupFile, RequireValidShell, login limits, and any chroot or home-directory directives.
Test syntax with the same path
sudo proftpd -t -c /etc/proftpd/proftpd.confUse the actual path found in the service command line if it differs. A successful test means the file can be parsed; it does not prove that a user will be accepted. Fix every syntax error before restarting, otherwise configuration errors can be mistaken for authentication failures.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Restart only after validation
sudo systemctl restart proftpd
sudo systemctl status proftpd --no-pagerAfter the restart, make one login attempt and immediately correlate its timestamp with the logs. If the service fails to start, return to the configuration test and the unit’s status output instead of troubleshooting the client’s password.
Verify the Unix account and password state
First identify the account source in the active configuration. ProFTPD may authenticate against local Unix accounts through PAM, a flat file named by AuthUserFile, SQL, LDAP, or another configured module. Check the same source the daemon is configured to use; changing a local Unix password will not fix a login that is actually mapped to a virtual-user database.
Confirm that the name resolves
getent passwd usernameA returned record confirms that the system’s configured identity service can provide the account’s UID, GID, home directory, and shell. No result means ProFTPD cannot obtain the identity from that source. For a virtual user, inspect the configured authentication file or backend instead of relying on getent.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteCheck password and account policy
Verify that the password is current and that the account is not locked, expired, or disabled by local policy. Review the account’s password-aging and lock state with the administration tools used on your Ubuntu release, and check any central directory policy if the account comes from LDAP or another service. Reset the password only after confirming the correct identity source.
Also check the client. FTP programs can silently reuse a saved username or password, connect to a different host, or send an old credential from a stored site profile. Create a one-time connection entry with the exact hostname and username and compare its timestamp with the server log.
Why an SSH login does not settle the question
An account working over SSH proves only that the SSH daemon’s authentication and authorization path accepted it. ProFTPD can use a different PAM service file, a different module order, shell checks, login limits, or a virtual-user source. SSH success therefore does not prove that FTP authentication is configured correctly.
Inspect PAM and authentication order
ProFTPD’s PAM integration is deliberately narrow: PAM decides whether a given user should be allowed to log in. PAM does not provide the UID, GID, home directory, or other account metadata by itself. Those values must resolve through a Unix account, AuthUserFile, SQL, LDAP, or another ProFTPD identity source.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsRank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Find the PAM service used by the package
Inspect the PAM service file named by the active ProFTPD configuration and by the Ubuntu package. On many installations this is a file under /etc/pam.d/ with a ProFTPD-specific name, but do not assume the filename if AuthPAMServiceName or an equivalent directive sets another value.
sudo grep -Rni 'AuthPAM' /etc/proftpd
sudo ls -l /etc/pam.d/Read the referenced PAM stack for deny lists, shell checks, account-expiry checks, and modules that require a particular group or service. A rule intended for another service can reject FTP even when the password is valid.
Understand module order
ProFTPD can consult PAM and Unix/file modules in an order controlled by its configuration. An authoritative module can stop fallback to another source. For example, a PAM denial may prevent ProFTPD from trying a file-based virtual user, while a file module may be authoritative for the configured username. Determine which module handles the name and whether a failure is terminal before changing the order.
Change policy deliberately
Correct an unintended deny rule or adjust authentication order only when the logs and configuration show that it is the required fix. Do not remove a security control merely to make one login work. After any PAM change, run the ProFTPD syntax test, restart the service, and reproduce one attempt while watching the logs.
Validate virtual-user files
If the configuration uses AuthUserFile or AuthGroupFile, verify the exact path, file readability, ownership, permissions, and record format. ProFTPD expects colon-delimited records with all fields required by the configured module. A missing field or an extra colon can make the record invalid.
Check path and daemon access
sudo ls -l /path/to/AuthUserFile /path/to/AuthGroupFile
sudo namei -l /path/to/AuthUserFileEvery parent directory must be searchable by the daemon’s effective user or group, and the files must be readable without granting unnecessary write access. A file that is readable by root but not by the ProFTPD process will behave like a missing or unusable identity source.
Check record syntax safely
Open the files with a method that preserves exact punctuation and inspect the affected username. Look for blank records, missing fields, an accidental extra colon, trailing data, or a line copied from a different backend’s format. Do not paste passwords into tickets or public logs. After repairing a record, run the configuration test and make a single login attempt.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Keep group mapping consistent
If the user record refers to a group, ensure the corresponding group file contains a valid entry and that its path and permissions are correct. A valid password record can still fail when the group mapping is malformed or unreadable.
Check shells, login limits, and account restrictions
RequireValidShell
Review the RequireValidShell directive. When enabled, ProFTPD may reject an account whose shell is not considered valid. The relevant allowlist is commonly derived from /etc/shells, but the actual behavior depends on the active ProFTPD PAM and authentication configuration. Confirm the rule in the logs before changing a shell or editing the allowlist.
PAM shell modules and allowlists
Ubuntu PAM examples can include shell-validation modules that deny a user whose shell is absent from the permitted list. Inspect the PAM stack actually used by ProFTPD rather than copying an SSH-related fix. If FTP-only accounts intentionally use a non-interactive shell, choose a policy that permits the service without granting an unnecessary interactive login.
Limit LOGIN rules
Search the configuration and included files for <Limit LOGIN> blocks and any user, group, allow, or deny directives inside them. A rule may reject only certain names, source addresses, or groups, making the failure appear user-specific. Check both the matching order and whether a later included file changes the effective rule.
Lock and expiry state
Account lockout, password expiry, and directory-service policy can all produce a 530. The log normally identifies an account-policy denial. Resolve the policy condition in the account’s authoritative system, then retry; do not work around it by creating a second account unless that is an intentional access decision.
Free tools Windows power users keep installed
One-click scans. No signup required.
Fix home-directory and chroot permission failures
ProFTPD must be able to enter the configured home or chroot path after authentication. The user needs execute permission on every parent directory leading to that path, and the daemon must be able to perform the required chroot operation. A correct password does not overcome a missing search permission.
Inspect the exact path named in the log
sudo namei -l /path/to/home-or-chroot
sudo ls -ld /path/to/home-or-chrootCompare the ownership and mode of each component with the UID and GID resolved for the login. Correct the narrowest directory or group permission that satisfies the requirement. Avoid making an entire filesystem world-writable.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Distinguish authentication from session setup
Some failures occur immediately after the password is accepted, while the client still receives a 530-class rejection. A log line naming a chroot target, home path, or permission check indicates session setup. Fix the path or permissions, then test again; repeatedly resetting the password will not change that outcome.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Use foreground debug mode for one controlled attempt
When normal logs do not reveal the rejecting module, run a single diagnostic attempt with ProFTPD in the foreground and a high debug level. Upstream ProFTPD supports -d N, where N ranges from 1 through 10; higher values produce more detail. The -n option keeps the daemon in the foreground so messages remain in the terminal.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Run it without creating a port collision
Stop the service only if necessary, because a running instance may already own the FTP control port.
sudo systemctl stop proftpd
sudo proftpd -n -d 10 -c /etc/proftpd/proftpd.confUse the same custom configuration path and startup options as the service if they differ. Reproduce exactly one login, capture the module and directive named in the output, then stop the foreground process with Ctrl+C and restore the service.
sudo systemctl start proftpd
sudo systemctl status proftpd --no-pagerProtect debug output
High-debug output can reveal usernames, paths, policy decisions, and other operational details. Run it locally or through a protected administrative session, and remove sensitive output from shared logs after the investigation. Do not enable maximum debugging permanently on a production server.
Match symptoms to the likely fix
| Observed evidence | Likely layer | Action |
|---|---|---|
| The username or password is rejected and the log shows a PAM denial | PAM policy or authentication order | Inspect the ProFTPD PAM service, deny/allow modules, and module authority; correct the intended policy. |
| The account is absent from the configured Unix identity source | Identity lookup | Use the correct account source or create/fix the required identity record. |
The log reports a malformed AuthUserFile or AuthGroupFile entry |
Virtual-user file syntax | Repair missing fields or extra colons, then verify ownership and readability. |
| The log names a home or chroot path and a permission failure | Filesystem/session setup | Grant the necessary search permission on every parent and correct the configured target. |
| Only users with a particular shell fail | Shell validation | Review RequireValidShell, the active PAM shell modules, and the permitted shell list. |
| Only selected names or networks fail | <Limit LOGIN> or access rules |
Trace included files and matching allow/deny directives. |
| Editing the default file has no effect | Configuration mismatch | Find the service’s -c path and included snippets; test and restart that configuration. |
| No server-side entry appears | Wrong log, host, or daemon | Confirm the destination, timestamp, listener, and service instance before changing authentication settings. |
Why common “fixes” fail
- Resetting the password repeatedly: this does nothing if ProFTPD is using a virtual-user file, a different directory service, or a PAM deny rule.
- Copying the SSH configuration: SSH and FTP can use different PAM service files, shell checks, and authentication order.
- Editing only
/etc/proftpd/proftpd.conf: the service may be started with-cor may override the setting in an included file. - Making the home directory world-readable or writable: broad permissions hide the real path problem and create unnecessary exposure; fix the specific parent-directory execute permission instead.
- Running debug mode while the service is still running: the second process may fail to bind its control port, producing a startup error rather than the login evidence you wanted.
- Disabling shell or PAM checks globally: this may bypass an intentional security policy. Identify the exact rule and make the smallest policy change that meets the access requirement.
Choose a safer protocol after login works
Plain FTP sends credentials and data without encryption. If an existing application requires FTP semantics, configure FTPS/TLS in ProFTPD with a valid certificate and the required passive-data settings. Test both the control connection and data transfers, because a successful login alone does not prove that encrypted passive transfers work through a firewall or NAT device.
Recommended Free Tools
If FTP compatibility is not required, SFTP over OpenSSH is a separate protocol and is often simpler to firewall because it uses the SSH connection rather than an FTP control channel plus a range of passive data ports. SFTP is not a drop-in replacement for software that specifically speaks FTP or requires FTP commands.
Quick Recap
| Option | Use when | Operational considerations |
|---|---|---|
| Plain FTP | Only for isolated, controlled environments where its exposure is explicitly acceptable | Credentials and data are not protected in transit; avoid across untrusted networks. |
| FTPS/TLS | An application requires FTP behavior and can negotiate TLS | Retains FTP’s control/data-channel model; configure certificates and passive ports, then verify firewall and NAT behavior. |
| SFTP | The client supports the SSH file-transfer protocol | Uses SSH authentication and one SSH transport; it is a different protocol and may require client or workflow changes. |
Final verification checklist
- The failed username and timestamp have a corresponding server-side log entry.
- The service command line and every included file have been checked, including any custom
-cpath. proftpd -tsucceeds against the same configuration used by the service.- The selected Unix, file, SQL, or LDAP identity source resolves the account and shows an acceptable password and policy state.
- The active PAM service and authentication order match the intended policy.
AuthUserFileandAuthGroupFile, when used, have valid records and daemon-readable permissions.RequireValidShell, PAM shell checks,<Limit LOGIN>, and account lock/expiry rules allow the user.- The user can traverse every parent directory of the home or chroot path.
- A single foreground
-n -d 10attempt, if needed, identifies the rejecting module without leaving a second daemon running. - The working deployment uses FTPS when FTP semantics are required, or SFTP when an FTP-specific client is unnecessary.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
