Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am running the FTP daemon VSFTPD. I'd like to control FTP access by adding users to a group such that only members of the defined group can access the FTP services. I am thinking I can do this by modifying /etc/pam.d/vsftpd, but am not sure how to get started. Or is this only for virtual users in VSFTPD?

I am aware of user_list and this does not seem to support groups. This doesn't provide the function I am looking for which is described above. If I am mistaken though this would be great.

share|improve this question
I found this user who was trying to do the same thing with PAM module but was unsuccesful. – Aaron Copley Feb 23 '11 at 0:11
up vote 1 down vote accepted

Figures. I got it sorted out after posting here. I was reading the The Linux-PAM System Administrators' Guide and found pam_succeed_if. There's an example which illustrates emulating pam_wheel.

To emulate the behaviour of pam_wheel, except there is no fallback to group 0:

auth required quiet user ingroup wheel

I inserted this in /etc/pam.d/vsftpd under the last "auth required" line and tested it. Now you must be a user of the defined group to login to FTP. I also am removing the quiet flag as I would like to see authentication failures / successes in the logs.

share|improve this answer

Aaron, if you mean controlling vsftpd in terms of start/stop, etc. you can easily create a group for it and assign the service to start within the groups' privilege. But on the other hand if you need to control access to directories on the server by clients, it should be done in the conf. file.

share|improve this answer
No, sorry, I meant authentication to the FTP service. Also, telling me it should be done in the configuration file isn't very helpful. I've spent the day going over the man page for vsftpd.conf and it provides no mechanism for access control at the group level. If I am mistaken please assist with specifics. – Aaron Copley Feb 23 '11 at 0:03
I got it now. you mean you wanna authenticate ftp users with pam backend. please have a look at link and link – Hosm Feb 23 '11 at 1:04
Sorry, neither of those links address the question. It's ok though, as I've already found and posted the solution. Thanks, anyway. – Aaron Copley Feb 23 '11 at 2:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.