Set Up a Secure FTPS Server with vsftpd on Linux

vsftpd ("very secure FTP daemon") is a small, reliable FTP server for Linux. Plain FTP sends passwords unencrypted, so this guide configures vsftpd as an FTPS server that forces TLS. Use it when clients or devices only support FTP; otherwise SFTP is simpler.

Before you start

A Linux VPS with root access.
A TLS certificate (Let's Encrypt for your hostname, or a self-signed one for testing).
Firewall access for port 21 and a passive port range.

Install vsftpd

Ubuntu/Debian: sudo apt install -y vsftpd (config /etc/vsftpd.conf)
AlmaLinux/Rocky: sudo dnf install -y vsftpd (config /etc/vsftpd/vsftpd.conf)

Back up the original config before editing: sudo cp /etc/vsftpd.conf /etc/vsftpd.conf.bak.

Create an FTP user

sudo adduser ftpuser
sudo mkdir -p /home/ftpuser/files
sudo chown ftpuser:ftpuser /home/ftpuser/files
sudo chmod a-w /home/ftpuser

The home folder is made non-writable because vsftpd refuses to chroot into a writable root; the user uploads into files.

Configure vsftpd

Set these options in the config file:

listen=YES
listen_ipv6=NO
anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
chroot_local_user=YES
userlist_enable=YES
userlist_file=/etc/vsftpd.userlist
userlist_deny=NO

pasv_enable=YES
pasv_min_port=40000
pasv_max_port=40100
pasv_address=203.0.113.10

ssl_enable=YES
force_local_logins_ssl=YES
force_local_data_ssl=YES
ssl_tlsv1_2=YES
ssl_sslv2=NO
ssl_sslv3=NO
rsa_cert_file=/etc/letsencrypt/live/ftp.example.com/fullchain.pem
rsa_private_key_file=/etc/letsencrypt/live/ftp.example.com/privkey.pem
require_ssl_reuse=NO

Replace pasv_address with your server's public IP. If the distribution config has listen_ipv6=YES, keep only one of listen or listen_ipv6 enabled.

Allow only listed users

echo 'ftpuser' | sudo tee -a /etc/vsftpd.userlist

Open the firewall

UFW: sudo ufw allow 21/tcp && sudo ufw allow 40000:40100/tcp
firewalld: sudo firewall-cmd --permanent --add-port=21/tcp --add-port=40000-40100/tcp && sudo firewall-cmd --reload

Start and test

sudo systemctl enable --now vsftpd && sudo systemctl restart vsftpd
In FileZilla, create a site with protocol FTP, encryption Require explicit FTP over TLS, host ftp.example.com, port 21, logon type Normal.
Accept the certificate if self-signed, connect and upload a file into files.

SELinux note (AlmaLinux/Rocky)

To let users write in their home folders with SELinux enforcing: sudo setsebool -P ftpd_full_access on.

Troubleshooting

"500 OOPS: vsftpd: refusing to run with writable root inside chroot()": remove write permission from the home folder (chmod a-w) and upload into a subfolder.
Login works but directory listing hangs: passive ports are blocked or pasv_address is wrong.
"530 Non-anonymous sessions must use encryption": the client is using plain FTP; switch to explicit TLS.
Logs: check /var/log/vsftpd.log and journalctl -u vsftpd.

FAQ: vsftpd FTPS server

FTPS or SFTP – which should I use?

SFTP if you can: one port, built into OpenSSH. Use FTPS when software or devices only support FTP.

Implicit or explicit FTPS?

Explicit FTPS on port 21 (upgraded with AUTH TLS) is the modern standard; implicit FTPS on port 990 is legacy.

Do cPanel accounts need vsftpd?

No. cPanel servers use Pure-FTPd or ProFTPD managed through WHM, and you create FTP accounts in cPanel.

Next steps

Was this guide helpful?

Still stuck?

Ask MdmHost AI for a quick answer, or open a ticket and our team will take a look. We are here 24/7.

Ask MdmHost AI Open a ticket