ProFTPd "Incorrect Password" even when the password is correct

Question

I'm trying to configure ProFTPd with virtual users to satisfy client requirements. Currently, I'm testing locally, and only have a test user for myself listed in the virtual user file (I am refusing to consider system users):

nicole:[secret redacted]:10001:10001::/srv/ftp/nicole:/bin/false

When trying to connect with the same username and password, I get 530 Login Incorrect. Logs generated by proftpd -nd10 aren't informative:

2024-01-15 19:02:12,618 108c14613dd6 proftpd[7] 108c14613dd6 (172.17.0.1[172.17.0.1]): mod_auth_file/1.0: using passwd file '...'
2024-01-15 19:02:12,618 108c14613dd6 proftpd[7] 108c14613dd6 (172.17.0.1[172.17.0.1]): retrieved UID 10001 for user 'nicole'
2024-01-15 19:02:12,618 108c14613dd6 proftpd[7] 108c14613dd6 (172.17.0.1[172.17.0.1]): no supplemental groups found for user 'nicole'
2024-01-15 19:02:12,618 108c14613dd6 proftpd[7] 108c14613dd6 (172.17.0.1[172.17.0.1]): ROOT PRIVS at mod_auth_pam.c:348
2024-01-15 19:02:14,265 108c14613dd6 proftpd[7] 108c14613dd6 (172.17.0.1[172.17.0.1]): RELINQUISH PRIVS at mod_auth_pam.c:582
2024-01-15 19:02:14,265 108c14613dd6 proftpd[7] 108c14613dd6 (172.17.0.1[172.17.0.1]): USER nicole (Login failed): Incorrect password
2024-01-15 19:02:14,265 108c14613dd6 proftpd[7] 108c14613dd6 (172.17.0.1[172.17.0.1]): dispatching POST_CMD_ERR command 'PASS (hidden)' to mod_exec
2024-01-15 19:02:14,265 108c14613dd6 proftpd[7] 108c14613dd6 (172.17.0.1[172.17.0.1]): dispatching POST_CMD_ERR command 'PASS (hidden)' to mod_shaper
2024-01-15 19:02:14,265 108c14613dd6 proftpd[7] 108c14613dd6 (172.17.0.1[172.17.0.1]): dispatching POST_CMD_ERR command 'PASS (hidden)' to mod_wrap2
2024-01-15 19:02:14,265 108c14613dd6 proftpd[7] 108c14613dd6 (172.17.0.1[172.17.0.1]): dispatching POST_CMD_ERR command 'PASS (hidden)' to mod_radius
2024-01-15 19:02:14,265 108c14613dd6 proftpd[7] 108c14613dd6 (172.17.0.1[172.17.0.1]): dispatching POST_CMD_ERR command 'PASS (hidden)' to mod_delay
2024-01-15 19:02:14,265 108c14613dd6 proftpd[7] 108c14613dd6 (172.17.0.1[172.17.0.1]): dispatching LOG_CMD_ERR command 'PASS (hidden)' to mod_log
2024-01-15 19:02:14,265 108c14613dd6 proftpd[7] 108c14613dd6 (172.17.0.1[172.17.0.1]): dispatching LOG_CMD_ERR command 'PASS (hidden)' to mod_delay
2024-01-15 19:02:14,265 108c14613dd6 proftpd[7] 108c14613dd6 (172.17.0.1[172.17.0.1]): dispatching LOG_CMD_ERR command 'PASS (hidden)' to mod_auth
2024-01-15 19:02:14,266 108c14613dd6 proftpd[7] 108c14613dd6 (172.17.0.1[172.17.0.1]): dispatching PRE_CMD command 'SYST' to mod_exec
2024-01-15 19:02:14,266 108c14613dd6 proftpd[7] 108c14613dd6 (172.17.0.1[172.17.0.1]): dispatching PRE_CMD command 'SYST' to mod_rewrite
2024-01-15 19:02:14,266 108c14613dd6 proftpd[7] 108c14613dd6 (172.17.0.1[172.17.0.1]): dispatching PRE_CMD command 'SYST' to mod_core
2024-01-15 19:02:14,266 108c14613dd6 proftpd[7] 108c14613dd6 (172.17.0.1[172.17.0.1]): dispatching PRE_CMD command 'SYST' to mod_core
2024-01-15 19:02:14,266 108c14613dd6 proftpd[7] 108c14613dd6 (172.17.0.1[172.17.0.1]): dispatching CMD command 'SYST' to mod_core
2024-01-15 19:02:14,266 108c14613dd6 proftpd[7] 108c14613dd6 (172.17.0.1[172.17.0.1]): dispatching POST_CMD command 'SYST' to mod_exec
2024-01-15 19:02:14,266 108c14613dd6 proftpd[7] 108c14613dd6 (172.17.0.1[172.17.0.1]): dispatching LOG_CMD command 'SYST' to mod_log

RequireValidShell is disabled, as is the shell check in the PAM configuration. This is running in a Docker container, so I don't have any PAM logs (I shouldn't need them if I'm not using a system user, right? Documentation and search results are unclear on this).

Is there another source of error messages I can check? I don't believe Login Incorrect is my true error, and something else is going wrong, but I haven't seriously worked with an FTP daemon in about ten years and I've forgotten most of the troubleshooting steps.

(I am aware that configuring globally deprecated protocols like FTP in any sense is a Bad Idea™ and I should use literally anything else instead, but I am at least two degrees removed from any position where I can make that kind of change, so FTP it must be.)

Answer 1

The problem was still PAM.

The documentation heavily assumes that you definitely for sure want to use system users in your server, whether you have virtual ones or not, and will insist that you keep PAM enabled, leading me to believe it was a requirement for authentication to occur at all. The problem is, PAM authentication is "all or nothing"; meaning if you have it enabled, your virtual users are effectively ignored, and if they're not in the system user database, you will be denied access, even if everything lines up.

If you're looking to deny system users access to your FTP server and have a purely virtual user database, you must set your AuthOrder to exactly this:

AuthOrder mod_auth_file.c