What authorities needed for FTP access?

I need to allow a couple of customers FTP access to our AS/400, which we
will be opening a port through the firewall for.

I have created an account, and had it use a group profile, FTPGROUP.  I then
GRTOBJAUT *ALL/QSYS *LIB with *EXCLUDE so this group has no access to any
library.

I then tried to FTP log this user in to see what error would occur, and I'm
getting the error:
530 Not able to set library QGPL for user SHOESPOT; logon rejected.

which is to be expected.  I then removed the *EXCLUDE for the libraries QSYS
and QGPL, but when I try to log in I get the same error, although this group
should have the default *CHANGE authority to these libraries (hey, I didn't
set up the security in the first place, I'm not the one who gave everyone
*change authority to all libraries).

So, what other libraries/objects/programs do I need to give this group
profile specific access to?  They will have their own library where they
will have full access.

Regards,

Jim Langston