How to Allow or Deny Users on a vsftpd FTP Server

Updated: 28 September 2026 · Applies to: vsftpd 3.0.5 on AlmaLinux and Rocky Linux 9 and 10, RHEL 9 and 10, Ubuntu 24.04 and 26.04, Debian 13

vsftpd decides who may log in with three separate mechanisms: a user list that can work as a block list or an allow list, a fixed list of accounts that are always refused, and the login shell check done by PAM. The safest setup is an allow list: only the accounts you name can use FTP. File locations below are for AlmaLinux, Rocky Linux and RHEL; Ubuntu and Debian keep them directly in /etc.

Allow only specific users (recommended)

1. In /etc/vsftpd/vsftpd.conf (or /etc/vsftpd.conf), set:

   userlist_enable=YES
   userlist_deny=NO
   userlist_file=/etc/vsftpd/user_list

2. Put the allowed user names in /etc/vsftpd/user_list, one per line:

   ftpuser1
   ftpuser2

   On AlmaLinux, Rocky Linux and RHEL this file already exists and lists system accounts such as root; replace its contents when you switch to an allow list.
3. Restart: systemctl restart vsftpd

Everyone not in the file is refused before the password is even asked.

Block specific users

With userlist_deny=YES (the default when userlist_enable=YES), the same file becomes a block list: the users in it are refused, everyone else may log in.

Accounts that are always refused

/etc/vsftpd/ftpusers (Red Hat family) or /etc/ftpusers (Ubuntu, Debian) is read through PAM and refuses the listed accounts in every configuration. It contains root and other system accounts by default. Leave them there: FTP sends passwords that others could intercept unless you use TLS.

The shell check

vsftpd's PAM setup refuses users whose login shell is not listed in /etc/shells. If you give FTP-only users the shell /usr/sbin/nologin, add that line to /etc/shells, or they cannot log in.

Test

curl --ssl-reqd -k -u ftpuser1 ftp://localhost/      # with TLS
curl -u ftpuser1 ftp://localhost/                    # without TLS

A refused user gets "530 Permission denied" (user list) or "530 Login incorrect" (password, ftpusers or shell).

To set up encryption and chroot as well, see how to set up vsftpd with TLS; for all common settings, see the beginners guide to vsftpd.

Official documentation: vsftpd.conf manual.