Setup a Basic FTP Server with vsftpd on Ubuntu

Step 1: Accessing Your Ubuntu Server via SSH (Secure Shell)

Before installing anything, you need to securely connect to your remote Ubuntu server. SSH (Secure Shell) is the primary method for this, using a private key file for authentication.

A. Connecting from Linux/macOS Terminal

1. Locate Your Private Key: Ensure the `.pem` file you downloaded (e.g., `my-ec2-key.pem` from an EC2 setup) is in a secure, known location on your local machine (e.g., your home directory `~/` or `~/.ssh/`).
2. Set Correct Permissions: SSH requires your private key file to have restricted permissions (`read-only` for the owner).
chmod 400 /path/to/your-key.pem
Replace `/path/to/your-key.pem` with the actual path to your `.pem` file.
3. Connect via SSH:
   • Open your terminal.
   • Find your server's `Public IPv4 address`.
   • The default username for Ubuntu AMIs is `ubuntu`. For other cloud providers or personal setups, it might be `root` or a user you created. We'll use `ubuntu` for this guide.
   ssh -i /path/to/your-key.pem ubuntu@YOUR_SERVER_PUBLIC_IP
   When connecting for the first time, you might see a warning about the host's authenticity. Type `yes` and press `Enter` to continue. If you get a "Permission denied (publickey)" error, double-check the `chmod 400` command, ensure you're using the correct `.pem` file, and the correct username (`ubuntu`).

B. Connecting from Windows (PuTTY)

On Windows, PuTTY is a popular SSH client. It requires your `.pem` key to be converted to its own format, `.ppk`.

1. Download PuTTY and PuTTYgen:
   • If you don't have them, download the `putty.exe` and `puttygen.exe` executables from the official PuTTY website: www.putty.org.
   • Save them to a convenient location (e.g., a folder on your Desktop).
2. Convert `.pem` to `.ppk` using PuTTYgen:
   • Open `puttygen.exe`.
   • Click `Load`. Navigate to where you saved your `.pem` file (e.g., `my-ec2-key.pem`). You might need to select `All Files (*.*)` in the file dialog to see it.
   • A pop-up will appear saying the key was successfully imported. Click `OK`.
   • Click `Save private key`.
   • PuTTYgen will warn you about saving without a passphrase. For this beginner guide, you can click `Yes` to proceed without one. **For production environments, always set a strong passphrase!**
   • Save the `.ppk` file (e.g., `my-ec2-key.ppk`) in a secure location.
3. Connect with PuTTY:
   • Open `putty.exe`.
   • Session Category:
     • `Host Name (or IP address)`: `ubuntu@YOUR_SERVER_PUBLIC_IP` (replace `YOUR_SERVER_PUBLIC_IP` with your server's public IP).
     • `Port`: `22` (default for SSH).
   • SSH Authentication:
     • In the left pane, navigate to `Connection > SSH > Auth`.
     • Click `Browse` and select your `your-key.ppk` file.
   • Save Session (Optional, but Recommended):
     • Go back to the `Session` category.
     • Enter a name in `Saved Sessions` (e.g., `My Ubuntu FTP Server`).
     • Click `Save`. Now you can just load this session next time.
   • Open Connection: Click `Open`.
   • If a security alert appears about the host key, click `Accept` (after verifying the fingerprint if you're cautious).

Step 2: Update System Packages

Always start by ensuring your system is up-to-date.

Step 3: Install vsftpd

Install the vsftpd package on your Ubuntu server.

Once installed, vsftpd will automatically start. You can check its status:

Step 4: Configure UFW (Firewall) for FTP

By default, UFW blocks most incoming connections. You need to explicitly allow FTP traffic. FTP uses two modes: Active and Passive. Passive mode is more common as it usually works better behind client-side firewalls.

Allow FTP Control (Command) Port (21/TCP):

Allow FTP Data Port (20/TCP) (for Active Mode - often not needed for Passive):

Allow Passive Mode Port Range (Crucial for most clients - example range 40000-40010):

Reload UFW to apply changes:

Verify UFW status:

Step 5: Configure vsftpd

The main configuration file for vsftpd is `/etc/vsftpd.conf`. We'll make several key changes to enhance security and functionality.

1. Backup the original configuration file:

2. Open the configuration file for editing:

3. Make the following changes (uncomment or add lines):

# Allow anonymous FTP? (NO for security)
anonymous_enable=NO

# Allow local users to log in? (YES)
local_enable=YES

# Enable write commands? (YES if users need to upload)
write_enable=YES

# Set umask for uploaded files (e.g., 022 for 755 dir, 644 file)
local_umask=022

# Chroot local users (CRITICAL for security)
chroot_local_user=YES
# If you have specific users you DON'T want chrooted, add them to a list:
# chroot_list_enable=YES
# chroot_list_file=/etc/vsftpd.chroot_list

# Use more secure chroot jail on modern vsftpd versions (Recommended)
allow_writeable_chroot=YES # Needed for chroot if user's home dir is writable

# Enable logging
xferlog_enable=YES
xferlog_file=/var/log/vsftpd.log
xferlog_std_format=NO

# Set timeout values
idle_session_timeout=600
data_connection_timeout=120

# Disable messages to clients about existing files.
hide_file_misses=YES

# Passive mode settings (CRITICAL for modern clients and firewalls)
pasv_enable=YES
pasv_min_port=40000 # Must match UFW range
pasv_max_port=40010 # Must match UFW range
pasv_address=YOUR_SERVER_PUBLIC_IP # Replace with your server's actual public IP

# Prevent users from logging in with a shell other than nologin (security)
pam_service_name=vsftpd

# Restrict users to a list (Recommended for security)
userlist_enable=YES
userlist_deny=NO # If NO, only users in userlist_file CAN log in (whitelisting)
userlist_file=/etc/vsftpd.userlist

# (Optional) For FTPS/SSL configuration - Covered in Step 8
# ssl_enable=YES
# rsa_cert_file=/etc/ssl/certs/vsftpd.pem
# rsa_private_key_file=/etc/ssl/private/vsftpd.pem
# allow_anon_ssl=NO
# force_local_data_ssl=YES
# force_local_logins_ssl=YES
# ssl_tlsv1=YES
# ssl_sslv2=NO
# ssl_sslv3=NO
# require_ssl_reuse=NO
# ssl_ciphers=HIGH

Save the file (`Ctrl+O`, `Enter`) and exit `nano` (`Ctrl+X`).

Step 6: Create a Dedicated FTP User and its Home Directory

It's a best practice to create a specific user for FTP access, separate from your system users, and restrict its shell access.

1. Create a new user (e.g., `ftpuploader`):

2. Restrict the user's shell access:

3. Prepare the user's home directory (if `chroot_local_user=YES`):

If `chroot_local_user=YES` is enabled (as recommended), users cannot write to their home directory directly if it's writable by them. A common workaround is to create a subdirectory inside the home directory where the user *can* write.

4. Add the user to `/etc/vsftpd.userlist` (if `userlist_enable=YES` and `userlist_deny=NO`):

This explicitly whitelists the user to allow FTP login.

Step 7: Restart vsftpd Service

After all configuration changes, restart vsftpd to apply them.

Verify service status:

Step 8: Test FTP Access from a Client

Now, try connecting from your local machine using an FTP client like FileZilla or directly from your terminal.

Using FileZilla (Recommended for GUI):

1. Download and install FileZilla Client.
2. Open FileZilla.
3. Go to `File > Site Manager`.
4. Click `New Site`.
5. Host: Your server's public IP address (e.g., `YOUR_SERVER_PUBLIC_IP`).
6. Protocol: `FTP - File Transfer Protocol`.
7. Encryption: `Only use plain FTP (insecure)`. (Temporarily for basic FTP test. We will change this to FTPS later!)
8. Logon Type: `Normal`.
9. User: `ftpuploader`.
10. Password: The strong password you set for `ftpuploader`.
11. Click `Connect`.

If successful, you should see the contents of `/home/ftpuploader/ftp_root` in the remote site pane. Try uploading a small file to `/ftp_root` and then downloading it.

Step 9: (Highly Recommended) Secure FTP with SSL/TLS (FTPS)

This is crucial to encrypt your FTP connections. We'll generate a self-signed SSL certificate for this guide. For production, use a certificate from a trusted CA (e.g., Let's Encrypt).

1. Generate a Self-Signed SSL Certificate:

2. Configure vsftpd for SSL/TLS:

Open `/etc/vsftpd.conf` again:

Add or uncomment the following lines at the end of the file:

# Enable SSL
ssl_enable=YES
rsa_cert_file=/etc/ssl/certs/vsftpd.pem
rsa_private_key_file=/etc/ssl/private/vsftpd.pem

# Disable anonymous SSL connections
allow_anon_ssl=NO

# Force SSL for local logins and data transfers (CRITICAL for security)
force_local_data_ssl=YES
force_local_logins_ssl=YES

# Choose TLS protocols (Disable old, insecure SSLv2/SSLv3)
ssl_tlsv1=YES
ssl_tlsv1_1=YES
ssl_tlsv1_2=YES
ssl_sslv2=NO
ssl_sslv3=NO

# Other SSL settings
require_ssl_reuse=NO
ssl_ciphers=HIGH

Save and exit.

3. Restart vsftpd:

Step 10: Test FTPS Access (Secure Client Connection)

Now, connect using FTPS (FTP over SSL/TLS) with your client.

Using FileZilla:

1. Open FileZilla `Site Manager` (File > Site Manager).
2. Select your existing site entry.
3. Encryption: Change to `Require explicit FTP over TLS`.
4. Click `Connect`.