This ruleset covers the vsftpd server. http://vsftpd.beasts.org/ vsftpd @QSTRING:usracct.username:[]@ OK LOGIN: Client @QSTRING:usracct.device:"@ [czanik] OK LOGIN: Client "::ffff:192.168.2.163" czanik ::ffff:192.168.2.163 login $PID $PROGRAM ACCEPT usracct secevt @QSTRING:usracct.username:[]@ FAIL LOGIN: Client @QSTRING:usracct.device:"@ [czanik] FAIL LOGIN: Client "::ffff:192.168.2.163" czanik ::ffff:192.168.2.163 login $PID $PROGRAM REJECT usracct secevt pam_listfile(@STRING:usracct.service@:auth): Refused user @ESTRING:usracct.username: @for service @ANYSTRING:usracct.service@ pam_listfile(vsftpd:auth): Refused user root for service vsftpd root vsftpd login $PID $PROGRAM REJECT usracct secevt