Linux FTP with VSFTPD and TLS — Manuel João Lima

FTP separates control and data connections and sends credentials in clear text unless protected with TLS. Prefer SFTP over SSH for general file transfer. Use VSFTPD only when an FTP-compatible client is a requirement.

Install

sudo apt update
sudo apt install vsftpd openssl
sudo cp /etc/vsftpd.conf /etc/vsftpd.conf.orig

Create a local test account and a directory it owns. Do not grant the service access to an entire home directory unless that is intentional.

Minimal local-user configuration

listen=NO
listen_ipv6=YES
anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
chroot_local_user=YES
allow_writeable_chroot=YES
pasv_min_port=40000
pasv_max_port=40100

The passive port range must be allowed through the firewall and any NAT device. allow_writeable_chroot is convenient for a lab but weakens one safety check; a separate non-writable chroot layout is preferable for production.

TLS

Generate a lab certificate, then add:

ssl_enable=YES
rsa_cert_file=/etc/ssl/private/vsftpd.pem
force_local_logins_ssl=YES
force_local_data_ssl=YES

Self-signed certificates are suitable only for controlled testing and will produce trust warnings. Use a certificate from a trusted authority for real clients.

Apply and test

sudo systemctl restart vsftpd
sudo systemctl status vsftpd
sudo journalctl -u vsftpd -e

Test TLS, passive mode, chroot behavior, and upload permissions with a client. Open only the required control and passive ports; never expose a test service without authentication and patching.