FTP with vsftpd

Overview

• What you will learn: How to install and configure vsftpd (Very Secure FTP Daemon) on Ubuntu for secure file transfers. You will understand FTP active and passive modes, configure chroot jails for user isolation, enable TLS/SSL encryption, and set up virtual users backed by a PAM database.
• Prerequisites: Understanding of file sharing protocols (Lesson 34), basic Linux administration and firewall configuration
• Estimated reading time: 18 minutes

FTP Modes and vsftpd Installation

The File Transfer Protocol (FTP) uses two channels: a control channel (port 21) for commands and a data channel for file transfers. How the data channel is established differs between the two FTP modes.

In active mode, the client opens a random port and tells the server to connect back to it. This often fails when the client is behind a NAT firewall because the server cannot reach the client’s port. In passive mode, the server opens a random port from a configured range and tells the client to connect to it. Passive mode is strongly preferred in modern deployments because it works reliably through firewalls and NAT.

# Install vsftpd
$ sudo apt update
$ sudo apt install vsftpd

# Verify the service is running
$ sudo systemctl status vsftpd

# Backup the default configuration
$ sudo cp /etc/vsftpd.conf /etc/vsftpd.conf.bak

# Key FTP ports:
# Port 21:        Control channel (commands)
# Port 20:        Active mode data channel (server to client)
# Passive range:  Data channel in passive mode (configurable)

# Active mode flow:
# 1. Client connects to server port 21
# 2. Client sends PORT command with its IP and random port
# 3. Server connects FROM port 20 TO client's specified port

# Passive mode flow:
# 1. Client connects to server port 21
# 2. Client sends PASV command
# 3. Server replies with its IP and a random port from pasv range
# 4. Client connects TO that server port for data transfer

Configuring vsftpd

The main configuration file is /etc/vsftpd.conf. vsftpd follows a security-first design — most features are disabled by default and must be explicitly enabled.

# /etc/vsftpd.conf — Production configuration

# Basic settings
listen=YES
listen_ipv6=NO
anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
use_localtime=YES
xferlog_enable=YES
xferlog_file=/var/log/vsftpd.log
connect_from_port_20=YES

# Chroot jail — confine users to their home directories
chroot_local_user=YES
allow_writeable_chroot=YES
# Or use a more secure approach:
# chroot_local_user=YES
# allow_writeable_chroot=NO
# local_root=/home/$USER/ftp

# Passive mode configuration
pasv_enable=YES
pasv_min_port=30000
pasv_max_port=31000
pasv_address=203.0.113.10

# User access control
userlist_enable=YES
userlist_file=/etc/vsftpd.userlist
userlist_deny=NO

# Connection limits
max_clients=50
max_per_ip=5
idle_session_timeout=300
data_connection_timeout=120

# Banner
ftpd_banner=Welcome to the secure FTP server.

The chroot_local_user=YES directive is critical for security — it confines each user to their home directory, preventing them from browsing the rest of the filesystem. The userlist_deny=NO setting inverts the user list logic, so only users explicitly listed in /etc/vsftpd.userlist are allowed to connect.

# Create the user list (only these users can connect)
$ sudo nano /etc/vsftpd.userlist
ftpuser1
ftpuser2

# Create an FTP user with proper directory structure
$ sudo useradd -m -s /usr/sbin/nologin ftpuser1
$ sudo passwd ftpuser1

# Secure chroot setup (home dir not writable, upload subdir writable)
$ sudo mkdir -p /home/ftpuser1/ftp/upload
$ sudo chown nobody:nogroup /home/ftpuser1/ftp
$ sudo chmod 555 /home/ftpuser1/ftp
$ sudo chown ftpuser1:ftpuser1 /home/ftpuser1/ftp/upload

# Allow nologin shell for FTP access
$ echo "/usr/sbin/nologin" | sudo tee -a /etc/shells

# Configure firewall for FTP
$ sudo ufw allow 21/tcp
$ sudo ufw allow 30000:31000/tcp

# Restart vsftpd
$ sudo systemctl restart vsftpd

# Test the connection
$ ftp localhost
# Or use a command-line client:
$ sudo apt install lftp
$ lftp -u ftpuser1 localhost

Enabling TLS/SSL Encryption

Plain FTP transmits credentials and data in clear text. Enabling TLS (FTPS — FTP over SSL/TLS) encrypts both the control and data channels, protecting sensitive information in transit.

# Generate a self-signed TLS certificate
$ sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 
    -keyout /etc/ssl/private/vsftpd.key 
    -out /etc/ssl/certs/vsftpd.crt 
    -subj "/C=US/ST=State/L=City/O=Org/CN=ftp.example.com"

# Add TLS settings to /etc/vsftpd.conf
$ sudo nano /etc/vsftpd.conf

# TLS/SSL configuration
ssl_enable=YES
rsa_cert_file=/etc/ssl/certs/vsftpd.crt
rsa_private_key_file=/etc/ssl/private/vsftpd.key
allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO
ssl_ciphers=HIGH
require_ssl_reuse=NO

# Restart vsftpd to apply TLS settings
$ sudo systemctl restart vsftpd

# Test TLS connection with lftp
$ lftp -u ftpuser1 -e "set ftp:ssl-force true; set ssl:verify-certificate no" localhost

# Test with curl
$ curl --ftp-ssl -u ftpuser1 ftp://localhost/
# Or with openssl for debugging:
$ openssl s_client -connect localhost:21 -starttls ftp

The force_local_data_ssl=YES and force_local_logins_ssl=YES settings are essential — they refuse unencrypted connections entirely. Setting ssl_sslv2=NO and ssl_sslv3=NO disables older, insecure protocol versions, leaving only TLS 1.x enabled. In production, use certificates from a trusted CA rather than self-signed certificates.

Virtual Users and Advanced Security

Virtual users exist only in a PAM database, not as real system accounts. This provides an additional layer of security because FTP users have no shell access and no system account to compromise.

# Install the PAM database utility
$ sudo apt install libpam-pwdfile apache2-utils

# Create a virtual user database
$ sudo htpasswd -c -d /etc/vsftpd/virtual_users.db vuser1
$ sudo htpasswd -d /etc/vsftpd/virtual_users.db vuser2

# Create a PAM service for vsftpd virtual users
$ sudo nano /etc/pam.d/vsftpd.virtual
auth    required    pam_pwdfile.so pwdfile=/etc/vsftpd/virtual_users.db
account required    pam_permit.so

# Create a system user that maps to all virtual users
$ sudo useradd -d /home/vftp -s /usr/sbin/nologin vftp
$ sudo mkdir -p /home/vftp

# Create per-user configuration directories
$ sudo mkdir -p /etc/vsftpd/user_conf
$ sudo mkdir -p /srv/ftp/vuser1 /srv/ftp/vuser2

# Per-user config — /etc/vsftpd/user_conf/vuser1
local_root=/srv/ftp/vuser1
write_enable=YES
anon_world_readable_only=NO

# Add to vsftpd.conf for virtual user support
guest_enable=YES
guest_username=vftp
user_sub_token=$USER
local_root=/srv/ftp/$USER
virtual_use_local_privs=YES
pam_service_name=vsftpd.virtual
user_config_dir=/etc/vsftpd/user_conf

# Set permissions
$ sudo chown -R vftp:vftp /srv/ftp/
$ sudo chmod 755 /srv/ftp/vuser1 /srv/ftp/vuser2

# Monitoring and logging
$ sudo tail -f /var/log/vsftpd.log

# Check active FTP connections
$ sudo ss -tlnp | grep vsftpd

# Useful vsftpd log format setting
log_ftp_protocol=YES
xferlog_std_format=NO
# This enables detailed protocol logging for debugging

Key Takeaways

• FTP uses separate control (port 21) and data channels; passive mode is preferred over active mode because it works reliably through firewalls and NAT by having clients initiate all connections.
• vsftpd configuration in /etc/vsftpd.conf follows a deny-by-default model; enable chroot_local_user to confine users to their home directories and use userlist_enable with userlist_deny=NO for a whitelist approach.
• TLS encryption is mandatory for production FTP — enable force_local_data_ssl and force_local_logins_ssl to refuse unencrypted connections, and disable SSLv2/SSLv3 to prevent protocol downgrade attacks.
• Virtual users backed by a PAM database provide superior security over system accounts — they have no shell access, no password entries in /etc/shadow, and can be managed independently with per-user configuration files.
• Configure passive port ranges (pasv_min_port / pasv_max_port) and open them in the firewall; for servers behind NAT, set pasv_address to the public IP so clients receive the correct connection address.

What’s Next

In the next lesson, you will learn how to deploy CUPS as a network print server, managing printers, print classes, and sharing configurations for both local and remote printing.

# 安裝 vsftpd
$ sudo apt update
$ sudo apt install vsftpd

# 驗證服務正在執行
$ sudo systemctl status vsftpd

# 備份預設設定
$ sudo cp /etc/vsftpd.conf /etc/vsftpd.conf.bak

# 關鍵 FTP 連接埠：
# 連接埠 21：       控制通道（命令）
# 連接埠 20：       主動模式資料通道（伺服器到用戶端）
# 被動範圍：        被動模式的資料通道（可設定）

# 主動模式流程：
# 1. 用戶端連線到伺服器連接埠 21
# 2. 用戶端傳送 PORT 命令，包含其 IP 和隨機連接埠
# 3. 伺服器從連接埠 20 連線到用戶端指定的連接埠

# 被動模式流程：
# 1. 用戶端連線到伺服器連接埠 21
# 2. 用戶端傳送 PASV 命令
# 3. 伺服器回覆其 IP 和被動範圍中的隨機連接埠
# 4. 用戶端連線到該伺服器連接埠進行資料傳輸

# /etc/vsftpd.conf — 生產環境設定

# 基本設定
listen=YES
listen_ipv6=NO
anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
use_localtime=YES
xferlog_enable=YES
xferlog_file=/var/log/vsftpd.log
connect_from_port_20=YES

# Chroot 限制 — 將使用者限制在其家目錄中
chroot_local_user=YES
allow_writeable_chroot=YES

# 被動模式設定
pasv_enable=YES
pasv_min_port=30000
pasv_max_port=31000
pasv_address=203.0.113.10

# 使用者存取控制
userlist_enable=YES
userlist_file=/etc/vsftpd.userlist
userlist_deny=NO

# 連線限制
max_clients=50
max_per_ip=5
idle_session_timeout=300
data_connection_timeout=120

# 建立使用者清單（只有這些使用者可以連線）
$ sudo nano /etc/vsftpd.userlist
ftpuser1
ftpuser2

# 建立具有適當目錄結構的 FTP 使用者
$ sudo useradd -m -s /usr/sbin/nologin ftpuser1
$ sudo passwd ftpuser1

# 安全的 chroot 設定（家目錄不可寫，上傳子目錄可寫）
$ sudo mkdir -p /home/ftpuser1/ftp/upload
$ sudo chown nobody:nogroup /home/ftpuser1/ftp
$ sudo chmod 555 /home/ftpuser1/ftp
$ sudo chown ftpuser1:ftpuser1 /home/ftpuser1/ftp/upload

# 允許 nologin shell 進行 FTP 存取
$ echo "/usr/sbin/nologin" | sudo tee -a /etc/shells

# 設定 FTP 防火牆
$ sudo ufw allow 21/tcp
$ sudo ufw allow 30000:31000/tcp

# 重新啟動 vsftpd
$ sudo systemctl restart vsftpd

# 產生自簽名 TLS 憑證
$ sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 
    -keyout /etc/ssl/private/vsftpd.key 
    -out /etc/ssl/certs/vsftpd.crt 
    -subj "/C=US/ST=State/L=City/O=Org/CN=ftp.example.com"

# 將 TLS 設定加入 /etc/vsftpd.conf
ssl_enable=YES
rsa_cert_file=/etc/ssl/certs/vsftpd.crt
rsa_private_key_file=/etc/ssl/private/vsftpd.key
allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO
ssl_ciphers=HIGH
require_ssl_reuse=NO

# 重新啟動 vsftpd 以套用 TLS 設定
$ sudo systemctl restart vsftpd

# 使用 lftp 測試 TLS 連線
$ lftp -u ftpuser1 -e "set ftp:ssl-force true; set ssl:verify-certificate no" localhost

# 安裝 PAM 資料庫工具
$ sudo apt install libpam-pwdfile apache2-utils

# 建立虛擬使用者資料庫
$ sudo htpasswd -c -d /etc/vsftpd/virtual_users.db vuser1
$ sudo htpasswd -d /etc/vsftpd/virtual_users.db vuser2

# 為 vsftpd 虛擬使用者建立 PAM 服務
$ sudo nano /etc/pam.d/vsftpd.virtual
auth    required    pam_pwdfile.so pwdfile=/etc/vsftpd/virtual_users.db
account required    pam_permit.so

# 建立映射到所有虛擬使用者的系統使用者
$ sudo useradd -d /home/vftp -s /usr/sbin/nologin vftp
$ sudo mkdir -p /home/vftp

# 建立每個使用者的設定目錄
$ sudo mkdir -p /etc/vsftpd/user_conf
$ sudo mkdir -p /srv/ftp/vuser1 /srv/ftp/vuser2

# 在 vsftpd.conf 中加入虛擬使用者支援
guest_enable=YES
guest_username=vftp
user_sub_token=$USER
local_root=/srv/ftp/$USER
virtual_use_local_privs=YES
pam_service_name=vsftpd.virtual
user_config_dir=/etc/vsftpd/user_conf

# 設定權限
$ sudo chown -R vftp:vftp /srv/ftp/
$ sudo chmod 755 /srv/ftp/vuser1 /srv/ftp/vuser2

# 監控和日誌
$ sudo tail -f /var/log/vsftpd.log

# vsftpd のインストール
$ sudo apt update
$ sudo apt install vsftpd

# サービスの稼働確認
$ sudo systemctl status vsftpd

# デフォルト設定のバックアップ
$ sudo cp /etc/vsftpd.conf /etc/vsftpd.conf.bak

# 主要な FTP ポート：
# ポート 21：       制御チャネル（コマンド）
# ポート 20：       アクティブモードデータチャネル（サーバーからクライアント）
# パッシブ範囲：    パッシブモードのデータチャネル（設定可能）

# アクティブモードのフロー：
# 1. クライアントがサーバーのポート 21 に接続
# 2. クライアントが PORT コマンドで自身の IP とランダムポートを送信
# 3. サーバーがポート 20 からクライアントの指定ポートに接続

# パッシブモードのフロー：
# 1. クライアントがサーバーのポート 21 に接続
# 2. クライアントが PASV コマンドを送信
# 3. サーバーが自身の IP とパッシブ範囲のランダムポートで応答
# 4. クライアントがそのサーバーポートに接続してデータ転送

# /etc/vsftpd.conf — 本番環境設定

# 基本設定
listen=YES
listen_ipv6=NO
anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
use_localtime=YES
xferlog_enable=YES
xferlog_file=/var/log/vsftpd.log
connect_from_port_20=YES

# Chroot ジェイル — ユーザーをホームディレクトリに制限
chroot_local_user=YES
allow_writeable_chroot=YES

# パッシブモード設定
pasv_enable=YES
pasv_min_port=30000
pasv_max_port=31000
pasv_address=203.0.113.10

# ユーザーアクセス制御
userlist_enable=YES
userlist_file=/etc/vsftpd.userlist
userlist_deny=NO

# 接続制限
max_clients=50
max_per_ip=5
idle_session_timeout=300
data_connection_timeout=120

# ユーザーリストの作成（これらのユーザーのみ接続可能）
$ sudo nano /etc/vsftpd.userlist
ftpuser1
ftpuser2

# 適切なディレクトリ構造を持つ FTP ユーザーの作成
$ sudo useradd -m -s /usr/sbin/nologin ftpuser1
$ sudo passwd ftpuser1

# 安全な chroot 設定（ホームディレクトリは書き込み不可、アップロードサブディレクトリは書き込み可能）
$ sudo mkdir -p /home/ftpuser1/ftp/upload
$ sudo chown nobody:nogroup /home/ftpuser1/ftp
$ sudo chmod 555 /home/ftpuser1/ftp
$ sudo chown ftpuser1:ftpuser1 /home/ftpuser1/ftp/upload

# nologin シェルでの FTP アクセスを許可
$ echo "/usr/sbin/nologin" | sudo tee -a /etc/shells

# FTP 用ファイアウォール設定
$ sudo ufw allow 21/tcp
$ sudo ufw allow 30000:31000/tcp

# vsftpd の再起動
$ sudo systemctl restart vsftpd

# 自己署名 TLS 証明書の生成
$ sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 
    -keyout /etc/ssl/private/vsftpd.key 
    -out /etc/ssl/certs/vsftpd.crt 
    -subj "/C=US/ST=State/L=City/O=Org/CN=ftp.example.com"

# /etc/vsftpd.conf に TLS 設定を追加
ssl_enable=YES
rsa_cert_file=/etc/ssl/certs/vsftpd.crt
rsa_private_key_file=/etc/ssl/private/vsftpd.key
allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO
ssl_ciphers=HIGH
require_ssl_reuse=NO

# TLS 設定を適用するため vsftpd を再起動
$ sudo systemctl restart vsftpd

# lftp で TLS 接続をテスト
$ lftp -u ftpuser1 -e "set ftp:ssl-force true; set ssl:verify-certificate no" localhost

# PAM データベースユーティリティのインストール
$ sudo apt install libpam-pwdfile apache2-utils

# 仮想ユーザーデータベースの作成
$ sudo htpasswd -c -d /etc/vsftpd/virtual_users.db vuser1
$ sudo htpasswd -d /etc/vsftpd/virtual_users.db vuser2

# vsftpd 仮想ユーザー用 PAM サービスの作成
$ sudo nano /etc/pam.d/vsftpd.virtual
auth    required    pam_pwdfile.so pwdfile=/etc/vsftpd/virtual_users.db
account required    pam_permit.so

# すべての仮想ユーザーにマッピングされるシステムユーザーの作成
$ sudo useradd -d /home/vftp -s /usr/sbin/nologin vftp
$ sudo mkdir -p /home/vftp

# ユーザーごとの設定ディレクトリの作成
$ sudo mkdir -p /etc/vsftpd/user_conf
$ sudo mkdir -p /srv/ftp/vuser1 /srv/ftp/vuser2

# vsftpd.conf に仮想ユーザーサポートを追加
guest_enable=YES
guest_username=vftp
user_sub_token=$USER
local_root=/srv/ftp/$USER
virtual_use_local_privs=YES
pam_service_name=vsftpd.virtual
user_config_dir=/etc/vsftpd/user_conf

# 権限の設定
$ sudo chown -R vftp:vftp /srv/ftp/
$ sudo chmod 755 /srv/ftp/vuser1 /srv/ftp/vuser2

# 監視とログ
$ sudo tail -f /var/log/vsftpd.log