Create a limited Virtualmin user for the mailbox or file-transfer task a person needs. A domain owner, mail/FTP user and server administrator have different scopes, so choose the account type before assigning access.
IN THIS ARTICLE
Check access and requirements
Select the correct virtual server and confirm your authority to manage its users. Record the intended mailbox, directory and quota. For file access, back up editable website content and decide whether the server provides FTPS, SFTP or another approved transfer path.
01 Create limited users in Virtualmin
- Choose Edit Users under the selected virtual server. For a mailbox choose Add a user to this server; for a dedicated transfer account use Add FTP user where offered.
- Enter a distinct username and unique strong credential. Review the actual full login name shown by the panel rather than assuming it equals an email short name.
- Enable only the required services. A mailbox-only user does not need an interactive shell or server configuration privileges.
- For a transfer user, select the narrowest suitable home directory and confirm the FTP service is configured to restrict clients to that directory. A chosen starting directory alone is not proof of confinement.
- Set the available quota and save. Configure the client using an encrypted supported protocol and validate its certificate or SSH host key.
- Test the permitted operation and an attempted access outside the intended scope through the limited account. Revoke temporary access when the task ends.
Does an FTP account automatically provide SFTP?
No. SFTP runs over SSH and follows its own account and server policy. Use the protocol actually authorized for the account, and do not confuse FTPS with SFTP.
Confirm the expected result
Confirm the user can reach its mailbox or assigned directory and cannot perform unrelated domain administration. Test any required upload with a harmless file and remove it afterward. Verify account backups and password-recovery ownership.
Resolve setup problems
If authentication fails, compare the exact username, service permission and client protocol. Do not enable shell or grant the domain-owner password merely to make an FTP login succeed. Investigate quota and directory ownership separately from authentication.