Authenticate vsftpd Users with Active Directory Using SSSD

vsftpd does not connect to Active Directory itself. It asks PAM to authenticate the login, and PAM can use SSSD to check the AD account. If id jane@lab.example already works on the server, the AD side of the setup is mostly done.

Red Hat lists vsftpd among deprecated FTP-related components in RHEL 10. Use this setup only when an existing application or client still requires FTP or FTPS. For a new file-transfer service, use SFTP over OpenSSH instead.

Quick answer

         FTP client
              ↓
           vsftpd
              ↓
      /etc/pam.d/vsftpd
              ↓
      password-auth (pam_sss)
              ↓
            SSSD
              ↓
     Active Directory

Before touching vsftpd, make sure the Linux server can already find and authenticate the AD user through SSSD.

FTP, FTPS, and SFTP

SFTP is a different protocol from FTP. It runs through OpenSSH on port 22 and does not use vsftpd. See SFTP with Active Directory for the modern approach.

Test environment

Prerequisite: verify Active Directory on Linux

This article assumes the server uses SSSD for AD logins. Check that first:

realm list

lab.example
  type: kerberos
  realm-name: LAB.EXAMPLE
  domain-name: lab.example
  configured: kerberos-member
  client-software: sssd
  login-formats: %U@lab.example
  login-policy: allow-realm-logins

client-software: sssd is the important line here.

Check that Linux can find the AD user:

id jane@lab.example

uid=758601105(jane@lab.example) gid=758600513(domain users@lab.example) groups=758600513(domain users@lab.example),758601103(network-admins@lab.example)

If this command fails, fix the AD join before continuing. vsftpd cannot authenticate an account that Linux cannot resolve.

Finally, make sure SSSD can currently reach a domain controller:

sudo sssctl domain-status lab.example

Online status: Online
...
AD Domain Controller: win-8s0k67ep5eo.lab.example

Install vsftpd

Install the package from the RHEL 10 repositories:

sudo dnf install -y vsftpd

Installed:
  vsftpd-3.0.5-12.el10.x86_64

vsftpd is deprecated in RHEL 10. It is still available, but do not choose it for a new file-transfer service unless you have a specific FTP compatibility requirement.

When a user logs in, vsftpd hands the username and password to PAM:

ls -l /etc/pam.d/vsftpd

-rw-r--r--. 1 root root 335 Jan 16  2026 /etc/pam.d/vsftpd

Configure vsftpd for authenticated users

For this AD login test, make sure these options are present in /etc/vsftpd/vsftpd.conf:

anonymous_enable=NO
local_enable=YES
write_enable=YES

local_enable=YES allows users that PAM can authenticate. That includes AD users provided by SSSD; they do not have to be manually created in /etc/passwd.

Add a passive port range so the data channel can traverse firewalls:

pasv_enable=YES
pasv_min_port=21100
pasv_max_port=21110

FTP uses a separate connection for directory listings and file transfers. Limiting passive mode to a known port range makes those data connections easier to allow through the firewall. Without the passive ports open, login may succeed while ls, uploads, or downloads appear to hang. Set pasv_address only when clients need the server to advertise a particular reachable address, such as behind NAT. Open the same port range in firewalld.

This walkthrough does not enable chroot_local_user; omit allow_writeable_chroot unless you deliberately chroot users into their home directories.

How PAM reaches Active Directory

Inspect the service PAM file instead of pasting standalone pam_sss.so lines from older tutorials:

cat /etc/pam.d/vsftpd

auth       required	pam_listfile.so item=user sense=deny file=/etc/vsftpd/ftpusers onerr=succeed
auth       required	pam_shells.so
auth       include	password-auth
account    include	password-auth
session    include	password-auth

The password-auth lines are important. On an authselect-managed RHEL system joined with SSSD, that common PAM file already contains the SSSD integration. You normally do not need to add pam_sss.so directly to /etc/pam.d/vsftpd.

pam_shells.so allows login only when the user’s resolved shell appears in /etc/shells. If SSSD returns /bin/bash, confirm /bin/bash is listed there. An AD account can resolve with id yet still fail vsftpd at the PAM shell check.

Allow the AD user through SSSD account checks

PAM performs more than a password check. The password can be correct but the later account check can still deny the login because of access policy. If the log shows pam_sss(vsftpd:account): Access denied, allow the user through realm permit:

sudo realm permit jane@lab.example

For several users, permit an AD group with realm permit -g 'group@lab.example' instead of adding accounts one at a time.

SELinux and firewall

Inspect FTP-related booleans before you change anything:

getsebool -a | grep ftpd

Do not enable ftpd_full_access by default. It broadly relaxes SELinux confinement for the FTP daemon. Try the upload first. If SELinux blocks it, check recent AVC denials before enabling a broad boolean:

sudo ausearch -m avc -ts recent

Prefer fixing the directory label or enabling a narrowly scoped option when possible.

In this test environment, uploads into Jane’s normal SSSD-created home directory were blocked until ftpd_full_access was enabled:

sudo setsebool -P ftpd_full_access on

That is a broad permission. A dedicated FTP directory with appropriate SELinux context is preferable when you can use one.

Allow FTP and the passive range:

sudo firewall-cmd --permanent --add-service=ftp

Open the passive data port range you configured in vsftpd.conf:

sudo firewall-cmd --permanent --add-port=21100-21110/tcp

Reload firewalld so both rules are active:

sudo firewall-cmd --reload

Start vsftpd and verify the listener

Start vsftpd and enable it at boot:

sudo systemctl enable --now vsftpd

Check that the service started successfully:

sudo systemctl status vsftpd --no-pager

Confirm port 21 is listening:

ss -ltnp | grep ':21'

LISTEN 0 32 *:21 *:* users:(("vsftpd",pid=85804,fd=3))

Test login with an Active Directory user

Use the same fully qualified username that worked with id, for example jane@lab.example. Pass only the username to curl; it will prompt for the password so the AD password does not appear in shell history:

curl -u 'jane@lab.example' ftp://127.0.0.1/

If curl returns a directory listing, vsftpd accepted the login and PAM allowed the AD account.

Upload a test file the same way:

curl -u 'jane@lab.example' -T /etc/hostname ftp://127.0.0.1/ftp-hostname-test.txt

Check that the uploaded file appeared in Jane’s home directory:

ls "/home/jane@lab.example/"

ftp-hostname-test.txt

Check vsftpd logs when a login fails:

sudo journalctl -u vsftpd -n 10 --no-pager

pam_sss(vsftpd:auth): authentication success; ... user=jane@lab.example

If authentication succeeds but the next PAM message denies the account, the problem is access policy rather than the password check. Review realm permit or the SSSD access rules instead of adding another pam_sss.so line.

Secure FTP with TLS when FTP is mandatory

Plain FTP exposes credentials on the wire. When a client cannot move to SFTP, enable FTPS with a server certificate, ssl_enable=YES, and force encryption for login and data channels. FTPS configuration varies with the certificate and client, so this article does not try to turn the FTP authentication example into a full TLS setup guide.

Troubleshooting

Should you use vsftpd with Active Directory in 2026?

Keep vsftpd when an existing application or device still requires FTP or FTPS. For a new setup, use SFTP instead.

Summary

With this setup, vsftpd does not connect to AD directly. It asks PAM to authenticate the user, and PAM reaches Active Directory through SSSD.

Start by making sure id user@domain works, check the existing /etc/pam.d/vsftpd file, and only troubleshoot vsftpd after the AD account works on Linux. Because vsftpd is deprecated and plain FTP is unencrypted, keep it only for compatibility. Use SFTP when you can choose the client and server protocol.

References

• Red Hat Enterprise Linux 10 — Managing FTP servers
• Red Hat Enterprise Linux 10 — Integrating Linux systems with Active Directory