vsftpd — FTP server configuration

vsftpd, or Very Secure FTP Daemon, is an FTP server for Unix-like systems. FTP normally uses TCP port 21 for its control connection and a separate data connection for directory listings and file transfers.

Traditional FTP does not encrypt credentials or transferred data. Use FTPS when FTP compatibility is required over an untrusted network, or consider SFTP when SSH-based file transfer is suitable.

On Debian and Ubuntu, install vsftpd with APT and enable the service at boot.

The main configuration file is normally /etc/vsftpd.conf. Back it up before making changes.

Changing the port does not encrypt or secure FTP. It only changes where the service listens.

local_enable=YES allows local Linux accounts to authenticate. Anonymous access can remain disabled when the server is intended only for known users.

anon_upload_enable is only for anonymous users. It is not required for a local authenticated user to run put.

The user needs execute permission on every parent directory and write plus execute permission on the destination directory.

Avoid placing real passwords directly in a command when shell history or process visibility is a concern. curl -u ftpuser prompts for the password.

Use 002 instead when files should remain group-writable in a controlled shared group.

The safer layout is a non-writable chroot root containing a writable subdirectory. This avoids making the root of the jail writable.

This option does not enable uploads by itself. write_enable=YES and suitable filesystem permissions are still required.

If several users share this path, manage ownership and group permissions carefully instead of granting broad world-write permissions.

user_config_dir allows individual users to override supported directives. Each file inside the directory must have the same name as the Linux account.

With userlist_deny=NO, the meaning changes: only users in the file may log in.

When the server is behind NAT, advertise the public address or DNS name that clients can reach.

The router or cloud firewall must also forward or permit the same ports when applicable.

Anonymous FTP can provide public downloads. Keep write access disabled unless there is a clear operational requirement.

Exact service account and group names vary by distribution. Verify them before applying ownership changes.

Enable transfer logging for operational troubleshooting and security review. Protocol logging is more verbose and may record sensitive session details, so use it deliberately.

Limits can reduce resource exhaustion and abandoned sessions. Choose values that fit the expected number of legitimate users.

Use a certificate trusted by clients in production. Available TLS directives can vary by distribution and vsftpd build, so confirm them with the installed manual.

Create a writable subdirectory such as /home/ftpuser/uploads; do not assume this configuration alone grants filesystem access.

Restart vsftpd, check that it started successfully and confirm that the expected socket is listening.

Common causes include:

• write_enable=NO or a missing write_enable directive.
• The destination directory is not writable by the authenticated Linux account.
• A parent directory lacks execute permission.
• The FTP user is chrooted somewhere different from the expected path.
• Mandatory access controls such as AppArmor or SELinux deny the operation.
• The filesystem is mounted read-only or has no free space.

The passive port range must match across vsftpd, the host firewall, any cloud firewall and NAT port forwarding.

These commands run inside an interactive FTP client.

• FTP is the traditional protocol, normally using TCP 21, without encryption by default.
• FTPS is FTP protected by TLS and can be served by vsftpd.
• SFTP is the SSH File Transfer Protocol, normally using TCP 22.

SFTP is not FTP over TLS and is not provided by vsftpd.