• We value your experience with Plesk during 2025
    Plesk strives to perform even better in 2026. To help us improve further, please answer a few questions about your experience with Plesk Obsidian 2025.
    Please take this short survey:

    https://survey.webpros.com/
  • On Plesk for Linux mod_status is disabled on upgrades to improve Apache security.
    This is a one-time operation that occurs during an upgrade. You can manually enable mod_status later if needed.

Question var/log/wtmp.db created in httpdocs after FTP login

JVG

Basic Pleskian
Server operating system version
Debian 13.3
Plesk version and microupdate number
Plesk Obsidian 18.0.75.0
Hi,

I have a new Debian 13 server and I'm preparing a Wordpress site and created an additional FTP user with home directory httpdocs

I've noticed that when that additional FTP user logs in it creates this directory in the virtual host document root: mysite/httpdocs/var/log/wtmp.db

The wtmp.db file is empty

I've tested the same configuration on Debian 12.13+Obsidian 18.0.74#3 and it doesn't create anything on the document root.

Is this expected behavior?
 
Upon further testing, it seems the problem is with the Service Plan. It was migrated from a Debian 12.13+Obsidian 18.0.74#3 server (tested there, no file created)

Switching it to "Default Domain" on the new server for the domain prevents it from creating that file in the document root.
 
Upon more testing, scratch my last post.

I set up a test server from scratch:
Product version: Plesk Obsidian 18.0.75.0
OS version: Debian 13.3 x86_64

Created a domain, created an additional FTP account with home directory httpdocs and the file was created after closing the FTP session (i used filezilla in windows):
Code:
-rw-r--r-- 1 mysite_243tghetj6j psacln 0 ene 27 11:38 /var/www/vhosts/mysite/httpdocs/var/log/wtmp.db
 
Hi, @JVG . Are you using FTP or SFTP? If SFTP, does the subscription in question have chrooted SSH access? The file in question is not related to FTP and I do not believe closing the connection should have any relation to it.
 
Hi @Sebahat.hadzhi , I'm using FTP, tested with both Filezilla and WinScp confirm the file created after session close.

auth.log:
Code:
Jan 28 10:29:45 test-plesk proftpd[3093]: pam_unix(proftpd:session): session opened for user ftp_user(uid=10000) by (uid=0)
Jan 28 10:29:45 test-plesk systemd-logind[801]: New session c2 of user mysite_243tghetj6j .
Jan 28 10:29:59 test-plesk proftpd[3014]: pam_unix(proftpd:session): session closed for user ftp_user
Jan 28 10:29:59 test-plesk proftpd[3014]: pam_wtmpdb(proftpd:session): open_database_rw: Cannot create/open database (/var/log/wtmp.db): unable to open database file
Jan 28 10:29:59 test-plesk proftpd[3014]: pam_systemd(proftpd:session): Failed to connect to system bus: no such file or directory
Jan 28 10:29:59 test-plesk systemd-logind[801]: Session c1 logged out. Waiting for processes to exit.
Jan 28 10:29:59 test-plesk systemd-logind[801]: Removed session c1.
Jan 28 10:30:11 test-plesk proftpd[3093]: pam_unix(proftpd:session): session closed for user ftp_user
Jan 28 10:30:11 test-plesk proftpd[3093]: pam_wtmpdb(proftpd:session): open_database_rw: Cannot create/open database (/var/log/wtmp.db): unable to open database file
Jan 28 10:30:11 test-plesk proftpd[3093]: pam_systemd(proftpd:session): Failed to connect to system bus: no such file or directory
Jan 28 10:30:11 test-plesk systemd-logind[801]: Session c2 logged out. Waiting for processes to exit.
Jan 28 10:30:11 test-plesk systemd-logind[801]: Removed session c2.
Jan 28 10:30:21 test-plesk (sd-pam)[3026]: pam_unix(systemd-user:session): session closed for user mysite_243tghetj6j

user-10000.journal:
Code:
ene 28 10:29:59 test-plesk.XX-XX-XX-XX.plesk.page proftpd[3014]: pam_unix(proftpd:session): session closed for user ftp_user
ene 28 10:29:59 test-plesk.XX-XX-XX-XX.plesk.page proftpd[3014]: pam_wtmpdb(proftpd:session): open_database_rw: Cannot create/open database (/var/log/wtmp.db): unable to open database file
ene 28 10:29:59 test-plesk.XX-XX-XX-XX.plesk.page proftpd[3014]: pam_systemd(proftpd:session): Failed to connect to system bus: no such file or directory
ene 28 10:30:11 test-plesk.XX-XX-XX-XX.plesk.page proftpd[3093]: pam_unix(proftpd:session): session closed for user ftp_user
ene 28 10:30:11 test-plesk.XX-XX-XX-XX.plesk.page proftpd[3093]: pam_wtmpdb(proftpd:session): open_database_rw: Cannot create/open database (/var/log/wtmp.db): unable to open database file
ene 28 10:30:11 test-plesk.XX-XX-XX-XX.plesk.page proftpd[3093]: pam_systemd(proftpd:session): Failed to connect to system bus: no such file or directory
ene 28 10:30:21 test-plesk.XX-XX-XX-XX.plesk.page systemd[3024]: Activating special unit exit.target...
ene 28 10:30:21 test-plesk.XX-XX-XX-XX.plesk.page systemd[3024]: Stopped target default.target - Main User Target.
ene 28 10:30:21 test-plesk.XX-XX-XX-XX.plesk.page systemd[3024]: Stopped target basic.target - Basic System.
ene 28 10:30:21 test-plesk.XX-XX-XX-XX.plesk.page systemd[3024]: Stopped target paths.target - Paths.
ene 28 10:30:21 test-plesk.XX-XX-XX-XX.plesk.page systemd[3024]: Stopped target sockets.target - Sockets.
ene 28 10:30:21 test-plesk.XX-XX-XX-XX.plesk.page systemd[3024]: Stopped target timers.target - Timers.
ene 28 10:30:21 test-plesk.XX-XX-XX-XX.plesk.page systemd[3024]: Closed dbus.socket - D-Bus User Message Bus Socket.
ene 28 10:30:21 test-plesk.XX-XX-XX-XX.plesk.page systemd[3024]: Closed dirmngr.socket - GnuPG network certificate management daemon.
ene 28 10:30:21 test-plesk.XX-XX-XX-XX.plesk.page systemd[3024]: Closed gpg-agent-browser.socket - GnuPG cryptographic agent and passphrase cache (access for web browsers).
ene 28 10:30:21 test-plesk.XX-XX-XX-XX.plesk.page systemd[3024]: Closed gpg-agent-extra.socket - GnuPG cryptographic agent and passphrase cache (restricted).
ene 28 10:30:21 test-plesk.XX-XX-XX-XX.plesk.page systemd[3024]: Stopping gpg-agent-ssh.socket - GnuPG cryptographic agent (ssh-agent emulation)...
ene 28 10:30:21 test-plesk.XX-XX-XX-XX.plesk.page systemd[3024]: Stopping gpg-agent.socket - GnuPG cryptographic agent and passphrase cache...
ene 28 10:30:21 test-plesk.XX-XX-XX-XX.plesk.page systemd[3024]: Closed keyboxd.socket - GnuPG public key management service.
ene 28 10:30:21 test-plesk.XX-XX-XX-XX.plesk.page systemd[3024]: Stopping ssh-agent.socket - OpenSSH Agent socket...
ene 28 10:30:21 test-plesk.XX-XX-XX-XX.plesk.page systemd[3024]: Closed ssh-agent.socket - OpenSSH Agent socket.
ene 28 10:30:21 test-plesk.XX-XX-XX-XX.plesk.page systemd[3024]: Closed gpg-agent-ssh.socket - GnuPG cryptographic agent (ssh-agent emulation).
ene 28 10:30:21 test-plesk.XX-XX-XX-XX.plesk.page systemd[3024]: Closed gpg-agent.socket - GnuPG cryptographic agent and passphrase cache.
ene 28 10:30:21 test-plesk.XX-XX-XX-XX.plesk.page systemd[3024]: Removed slice app.slice - User Application Slice.
ene 28 10:30:21 test-plesk.XX-XX-XX-XX.plesk.page systemd[3024]: Reached target shutdown.target - Shutdown.
ene 28 10:30:21 test-plesk.XX-XX-XX-XX.plesk.page systemd[3024]: Finished systemd-exit.service - Exit the Session.
ene 28 10:30:21 test-plesk.XX-XX-XX-XX.plesk.page systemd[3024]: Reached target exit.target - Exit the Session.
ene 28 10:30:21 test-plesk.XX-XX-XX-XX.plesk.page (sd-pam)[3026]: pam_unix(systemd-user:session): session closed for user mysite_243tghetj6j
 
Code:
root@test-plesk:~# ls -l /var/log/wtmp*
-rw-rw-r-- 1 root utmp 9600 ene 28 11:09 /var/log/wtmp
-rw-r--r-- 1 root root 8192 ene 28 11:09 /var/log/wtmp.db
 
Thank you for the confirmation and the additional details. I created an additional FTP account with httpdocs home directory, but I am unable to replicate the behavior on a test environment with Plesk 18.0.75 and Debian 13.3.

The owner and permissions of /var/log/wtmp.db look correct. Could you please provide us with the content of /etc/proftpd.conf?
 
Here's /etc/proftpd.conf:

Code:
#
# To have more informations about Proftpd configuration
# look at : http://www.proftpd.org/
#


# This is a basic ProFTPD configuration file (rename it to
# 'proftpd.conf' for actual use.  It establishes a single server
# and a single anonymous login.  It assumes that you have a user/group
# "nobody" and "ftp" for normal operation and anon.


ServerName                      "ProFTPD"
#ServerType                     standalone
ServerType                      inetd
DefaultServer                   on


<Global>
DefaultRoot     ~               psacln
AllowOverwrite          on


# Prefer to put here directives allowed in server config and Global contexts.
# From http://www.proftpd.org/docs/howto/Vhost.html :
# "any configuration directives inside the "server config" section do not apply outside of the context."


DefaultTransferMode     binary
UseFtpUsers                     on


TimesGMT                        off
SetEnv TZ :/etc/localtime
# Umask 022 is a good standard umask to prevent new dirs and files
# from being group and world writable.
Umask                           022


# Primary log file mest be outside of system logrotate province.
TransferLog /var/log/plesk/xferlog


# Enable PAM authentication
AuthPAM on
AuthPAMConfig proftpd
AuthGroupFile   /etc/group


<IfModule mod_ident.c>
IdentLookups off
</IfModule>


<IfModule mod_tls.c>
        # common settings for all virtual hosts
        TLSEngine on
        TLSRequired off


        TLSLog /var/log/plesk/ftp_tls.log


        TLSRSACertificateFile /opt/psa/admin/conf/httpsd.pem
        TLSRSACertificateKeyFile /opt/psa/admin/conf/httpsd.pem
        TLSCertificateChainFile /opt/psa/admin/conf/httpsd.pem


        # Authenticate clients that want to use FTP over TLS?
        TLSVerifyClient off


        # Allow SSL/TLS renegotiations when the client requests them, but
        # do not force the renegotations.  Some clients do not support
        # SSL/TLS renegotiations; when mod_tls forces a renegotiation, these
        # clients will close the data connection, or there will be a timeout
        # on an idle data connection.
        TLSRenegotiate none


        # As of ProFTPD 1.3.3rc1, mod_tls only accepts SSL/TLS data connections
        # that reuse the SSL session of the control connection, as a security measure.
        # Unfortunately, there are some clients (e.g. curl) which do not reuse SSL sessions.
        TLSOptions NoSessionReuseRequired
</IfModule>
</Global>


# Port 21 is the standard FTP port. Note that this ONLY works
# in standalone mode, in inetd mode only the value stored in
# proftpd.socket as Socket.ListenStream makes sense.
Port                            21
# To prevent DoS attacks, set the maximum number of child processes
# to 30.  If you need to allow more than 30 concurrent connections
# at once, simply increase this value.  Note that this ONLY works
# in standalone mode, in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
MaxInstances                    30


#Following part of this config file were generate by PSA automatically
#Any changes in this part will be overwritten by next manipulation
#with Anonymous FTP feature in PSA control panel.


#Include directive should point to place where FTP Virtual Hosts configurations
#preserved


ScoreboardFile /var/run/proftpd.scoreboard


#Change default group for new files and directories in vhosts dir to psacln


<Directory /var/www/vhosts>
        GroupOwner      psacln
</Directory>


UseReverseDNS off


Include /etc/proftpd.d/*.conf
 
Back
Top