D. J. Bernstein
Internet publication
FTP: File Transfer Protocol

The USER, PASS, and ACCT verbs

The client normally begins each FTP connection with a USER request; then, depending on the server's response, a PASS request; and then, depending on the server's response, an ACCT request.

As a practical matter, if the server does not accept these requests, the client can give up on the FTP connection. The FTP server is probably going to reject other requests with code 530, except for QUIT, SYST, HELP, and NOOP.

The USER verb

A USER request has a parameter showing a username. Subsequent pathnames are interpreted relative to this username.

The server may accept USER with code 230, meaning that the client has permission to access files under that username; or with code 331 or 332, meaning that permission might be granted after a PASS request.

In theory, the server may reject USER with code 530, meaning that the username is unacceptable. In practice, the server does not check the username until after a PASS request.

Some clients incorrectly treat 230 the same way as 530.

Some servers can accept several USER requests in one FTP connection; some can't. I recommend that clients make a new connection instead.

The PASS verb

A PASS request has a parameter called a password. The client must not send a PASS request except immediately after a USER request.

The server may accept PASS with code 230, meaning that permission to access files under this username has been granted; or with code 202, meaning that permission was already granted in response to USER; or with code 332, meaning that permission might be granted after an ACCT request. The server may reject PASS with code 503 if the previous request was not USER or with code 530 if this username and password are jointly unacceptable.

If USER is accepted with code 230, clients do not need to bother sending PASS. However, pipelining clients will normally send PASS without waiting for the USER response, and many of today's non-pipelining clients send PASS in every case; so it is important for the server to accept PASS with code 202.

The ACCT verb

An ACCT request has a parameter called an account name. The client must not send an ACCT request except immediately after a PASS request.

The server may accept ACCT with code 230, meaning that permission to access files under this username has been granted; or with code 202, meaning that permission was already granted in response to USER or PASS. The server may reject ACCT with code 503 if the previous request was not PASS or with code 530 if the username, password, and account name are jointly unacceptable.

I do not recommend that servers ask for ACCT. Many clients support only USER and PASS, and will give up if ACCT is required. Many other clients will send a useless ACCT noaccount.