How to Set Up a Secure FTP Server with vsftpd on elementary OS

File Transfer Protocol remains useful when a desktop needs to exchange files with a camera, web host, media workstation, or older network device. On elementary OS, vsftpd provides a lightweight server that can be managed from the Terminal and integrated with the system’s existing users and permissions.

There is an important distinction between traditional FTP and secure file transfer. Basic FTP sends usernames, passwords, and file contents without encryption. This guide therefore covers a controlled setup, explains how to enable TLS, and shows when SFTP through OpenSSH is the safer choice.

The instructions suit a home lab, a small office, or a local development machine. Before exposing anything to the internet, check your router, firewall, ISP terms, and Australian privacy obligations. A server shared only across a trusted home network is considerably easier to protect than one reachable from Sydney, Melbourne, or anywhere else online.

Option	Encryption	Best use	Main consideration
FTP with vsftpd	None by default	Isolated legacy devices	Credentials and files can be intercepted
FTP over TLS with vsftpd	Yes, when configured correctly	FTP clients that require FTP	Passive ports and certificates need planning
SFTP with OpenSSH	Yes by design	General-purpose secure transfers	Requires an SFTP-capable client, not an FTP-only device
Local network sharing	Depends on the protocol	Trusted home or office networks	Access is limited by network security

Check The System Before Installing

Open Terminal from the Applications menu and update the package index:

sudo apt update
sudo apt upgrade

Installing available updates first is worthwhile because elementary OS follows an Ubuntu-based package system, and security fixes may affect the kernel, OpenSSL, user authentication, or firewall tools. Reboot if the system reports that a kernel or core desktop component needs it.

Install vsftpd with:

sudo apt install vsftpd

The service normally starts immediately after installation. Check its state with:

sudo systemctl status vsftpd

If the status view is long, press q to return to the shell. You can also enable the service at boot:

sudo systemctl enable --now vsftpd

A dedicated account is safer than sharing your everyday desktop login. Create a user with a home directory:

sudo adduser fileuser

The command asks for a password and optional profile details. Use a long, unique password, especially if the account may later be allowed to connect from outside the home network. Create a directory for uploads or shared files and assign ownership:

sudo mkdir -p /home/fileuser/ftp/upload
sudo chown fileuser:fileuser /home/fileuser/ftp/upload

Keeping the account’s writable area separate reduces the chance that a remote transfer session can modify unrelated files in the user’s home directory.

Configure A Restricted FTP Service

Back up the original configuration before editing it:

sudo cp /etc/vsftpd.conf /etc/vsftpd.conf.backup

Open the configuration file in a text editor:

sudo nano /etc/vsftpd.conf

For a basic local-user setup, make sure these settings exist and are not preceded by #:

listen=NO
listen_ipv6=YES

anonymous_enable=NO
local_enable=YES
write_enable=YES

local_umask=022
dirmessage_enable=YES
use_localtime=YES
xferlog_enable=YES

chroot_local_user=YES
allow_writeable_chroot=YES
user_sub_token=$USER
local_root=/home/$USER/ftp

pasv_min_port=40000
pasv_max_port=40100

anonymous_enable=NO prevents unauthenticated public access. local_enable=YES allows Linux users to log in, while write_enable=YES is required for uploads, renames, and deletions. If the server only needs to provide downloads, leaving write access disabled is a safer choice.

The chroot settings confine each account to its FTP directory. With local_root=/home/$USER/ftp, the fileuser account sees /home/fileuser/ftp as its top-level location rather than the entire filesystem. The upload directory is writable, while the parent FTP directory can remain less permissive.

On some vsftpd versions, allow_writeable_chroot=YES is needed when the chroot directory is writable by its owner. A more restrictive arrangement is to make /home/fileuser/ftp owned by root and keep only the subdirectory writable:

sudo chown root:root /home/fileuser/ftp
sudo chmod 755 /home/fileuser/ftp
sudo chown fileuser:fileuser /home/fileuser/ftp/upload

This layout is preferable when it works with the intended client. Avoid adding broad permissions such as chmod -R 777, since they allow every local process or user to alter transferred files.

Save the file in Nano with Ctrl+O, press Enter, and exit with Ctrl+X. Validate and restart the service:

sudo systemctl restart vsftpd
sudo systemctl status vsftpd

If the restart fails, inspect the recent service messages:

sudo journalctl -u vsftpd --no-pager -n 50

A typo, duplicate directive, or incompatible listen setting is usually visible in this output.

Add Firewall Rules And Test Locally

If the uncomplicated firewall is installed, permit SSH before making other changes so that remote administration is not accidentally cut off:

sudo ufw allow OpenSSH
sudo ufw enable

Allow the FTP control connection and the passive transfer range selected earlier:

sudo ufw allow 21/tcp
sudo ufw allow 40000:40100/tcp
sudo ufw status verbose

FTP uses a control connection on port 21 and separate data connections for directory listings and file transfers. Passive mode lets the client initiate those data connections, which is generally more practical behind routers and firewalls. The selected range must match the pasv_min_port and pasv_max_port values.

Test from the same elementary OS computer first. In a file manager or FTP client, connect to:

ftp://127.0.0.1

Use the fileuser credentials and check that the client can list directories, upload a harmless test file, download it, and delete it. A graphical client such as FileZilla can make diagnostics easier, while the command-line client can confirm that the service itself responds:

ftp 127.0.0.1

For a second device on the same network, find the server’s local address:

ip addr

Look for an address such as 192.168.1.25 or 10.0.0.15, then connect to that address from the other device. Do not use 127.0.0.1 from another computer; it always refers to that computer itself.

If the local test works but another device cannot connect, check the elementary OS firewall, the router’s client isolation settings, and whether both devices are on the same network. Guest Wi-Fi often prevents devices from talking to one another. This is common in cafés, shared accommodation, and some NBN-connected home routers.

Enable TLS And Handle Network Access

Plain FTP should be treated as a local-only protocol. To encrypt credentials and transfers, create a self-signed certificate for private use:

sudo openssl req -x509 -nodes -days 365 \
  -newkey rsa:2048 \
  -keyout /etc/ssl/private/vsftpd.key \
  -out /etc/ssl/certs/vsftpd.crt

The command asks for certificate details. For a home server, the Common Name can be the machine’s hostname. A self-signed certificate produces a warning in the client, but it still encrypts the session. For a public service, use a certificate from a trusted authority and a hostname that matches the certificate.

Add these directives to /etc/vsftpd.conf:

ssl_enable=YES
rsa_cert_file=/etc/ssl/certs/vsftpd.crt
rsa_private_key_file=/etc/ssl/private/vsftpd.key

force_local_logins_ssl=YES
force_local_data_ssl=YES
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO
require_ssl_reuse=NO

Some modern clients work better when session reuse is disabled, although this slightly reduces a protection provided by TLS. Keep the certificate’s private key readable only by root:

sudo chmod 600 /etc/ssl/private/vsftpd.key
sudo systemctl restart vsftpd

In the client, select FTP over TLS, often called Explicit FTP over TLS, rather than ordinary FTP. Confirm that the certificate warning is expected and verify the fingerprint through a trusted channel before accepting it.

Remote access requires more than opening UFW. The router must forward TCP port 21 and the passive range 40000-40100 to the elementary OS computer. The vsftpd configuration may also need a public address:

pasv_addr_resolve=YES
pasv_address=ftp.example.net

A changing residential address makes this unreliable unless dynamic DNS is configured. Before troubleshooting external access, you can check your public IP and compare it with the address shown by the router. Australian NBN connections may use carrier-grade NAT, particularly with some providers and plans, so inbound port forwarding may be impossible without requesting a public IPv4 address.

Many households in Brisbane, Perth, Adelaide, and other Australian cities use a single router for work, streaming, smart-home devices, and guests. Forwarding FTP ports exposes a service to automated internet scans, so use a strong account password, restrict user access, monitor logs, and avoid forwarding the service unless there is a clear need. Residential ISP contracts may also restrict servers or incoming traffic, so review the provider’s terms first.

Choose Safe Maintenance Practices

The strongest alternative for most transfers is SFTP, which runs through SSH and does not use FTP’s separate data-channel design. Install or enable the SSH server if required:

sudo apt install openssh-server
sudo systemctl enable --now ssh

A client can then connect using SFTP on port 22:

sftp://fileuser@192.168.1.25

SFTP is usually simpler through routers and firewalls because it needs one port. It also avoids compatibility issues with passive FTP, TLS modes, and certificate prompts. Keep vsftpd when an older device specifically requires FTP or when a workflow depends on standard FTP semantics.

Review logs while testing:

sudo tail -f /var/log/vsftpd.log

Depending on the Ubuntu package configuration, additional authentication details may appear in /var/log/auth.log. Look for repeated failed logins, unexpected source addresses, and uploads with suspicious filenames. Logs can contain usernames, IP addresses, and timestamps, which may qualify as personal information under the Australian Privacy Act when operated in a business context. Store them securely, limit access, and establish a sensible retention period.

Give each person a separate account instead of distributing one shared password. Disable an account when it is no longer needed:

sudo sudo usermod --lock fileuser

The duplicated sudo is harmless on many systems but unnecessary; the cleaner command is:

sudo usermod --lock fileuser

Remove unused accounts only after checking ownership of files:

sudo userdel --remove fileuser

Keep elementary OS and vsftpd updated:

sudo apt update
sudo apt upgrade

Back up /etc/vsftpd.conf, certificates, important transferred data, and any firewall notes. Test restoration rather than assuming a backup is usable. The practical rule is simple: use SFTP whenever possible, use FTP over TLS when compatibility demands it, and never expose password-protected plain FTP to the public internet. A correctly configured server is one with minimal users, narrow permissions, encrypted sessions, limited network exposure, and logs that are reviewed regularly.