Setup a Basic FTP Server with vsftpd on Ubuntu

Step 1: Accessing Your Ubuntu Server via SSH (Secure Shell)

Before installing anything, you need to securely connect to your remote Ubuntu server. SSH (Secure Shell) is the primary method for this, using a private key file for authentication.

A. Connecting from Linux/macOS Terminal

1. Locate Your Private Key: Ensure the .pem file you downloaded (e.g., my-ec2-key.pem from an EC2 setup) is in a secure, known location on your local machine (e.g., your home directory ~/ or ~/.ssh/).
2. Set Correct Permissions: SSH requires your private key file to have restricted permissions (read-only for the owner).
chmod 400 /path/to/your-key.pem
Replace /path/to/your-key.pem with the actual path to your .pem file.
3. Connect via SSH:
   • Open your terminal.
   • Find your server's Public IPv4 address.
   • The default username for Ubuntu AMIs is ubuntu. For other cloud providers or personal setups, it might be root or a user you created. We'll use ubuntu for this guide.
   ssh -i /path/to/your-key.pem ubuntu@YOUR_SERVER_PUBLIC_IP
   When connecting for the first time, you might see a warning about the host's authenticity. Type yes and press Enter to continue. If you get a "Permission denied (publickey)" error, double-check the chmod 400 command, ensure you're using the correct .pem file, and the correct username (ubuntu).

B. Connecting from Windows (PuTTY)

On Windows, PuTTY is a popular SSH client. It requires your .pem key to be converted to its own format, .ppk.

1. Download PuTTY and PuTTYgen:
   • If you don't have them, download the putty.exe and puttygen.exe executables from the official PuTTY website: www.putty.org .
   • Save them to a convenient location (e.g., a folder on your Desktop).
2. Convert .pem to .ppk using PuTTYgen:
   • Open puttygen.exe.
   • Click Load. Navigate to where you saved your .pem file (e.g., my-ec2-key.pem). You might need to select All Files (*.*) in the file dialog to see it.
   • A pop-up will appear saying the key was successfully imported. Click OK.
   • Click Save private key.
   • PuTTYgen will warn you about saving without a passphrase. For this beginner guide, you can click Yes to proceed without one. **For production environments, always set a strong passphrase!**
   • Save the .ppk file (e.g., my-ec2-key.ppk) in a secure location.
3. Connect with PuTTY:
   • Open putty.exe.
   • Session Category:
     • Host Name (or IP address): ubuntu@YOUR_SERVER_PUBLIC_IP (replace YOUR_SERVER_PUBLIC_IP with your server's public IP).
     • Port: 22 (default for SSH).
   • SSH Authentication:
     • In the left pane, navigate to Connection > SSH > Auth.
     • Click Browse and select your your-key.ppk file.
   • Save Session (Optional, but Recommended):
     • Go back to the Session category.
     • Enter a name in Saved Sessions (e.g., My Ubuntu FTP Server).
     • Click Save. Now you can just load this session next time.
   • Open Connection: Click Open.
   • If a security alert appears about the host key, click Accept (after verifying the fingerprint if you're cautious).

Step 2: Update System Packages

Always start by ensuring your system is up-to-date.

Step 3: Install vsftpd

Install the vsftpd package on your Ubuntu server.

Once installed, vsftpd will automatically start. You can check its status:

Step 4: Configure UFW (Firewall) for FTP

By default, UFW blocks most incoming connections. You need to explicitly allow FTP traffic. FTP uses two modes: Active and Passive. Passive mode is more common as it usually works better behind client-side firewalls.

Allow FTP Control (Command) Port (21/TCP):

Allow FTP Data Port (20/TCP) (for Active Mode - often not needed for Passive):

Allow Passive Mode Port Range (Crucial for most clients - example range 40000-40010):

Reload UFW to apply changes:

Verify UFW status:

Step 5: Configure vsftpd

The main configuration file for vsftpd is /etc/vsftpd.conf. We'll make several key changes to enhance security and functionality.

1. Backup the original configuration file:

2. Open the configuration file for editing:

3. Make the following changes (uncomment or add lines):

# Allow anonymous FTP? (NO for security)
anonymous_enable=NO

# Allow local users to log in? (YES)
local_enable=YES

# Enable write commands? (YES if users need to upload)
write_enable=YES

# Set umask for uploaded files (e.g., 022 for 755 dir, 644 file)
local_umask=022

# Chroot local users (CRITICAL for security)
chroot_local_user=YES
# If you have specific users you DON'T want chrooted, add them to a list:
# chroot_list_enable=YES
# chroot_list_file=/etc/vsftpd.chroot_list

# Use more secure chroot jail on modern vsftpd versions (Recommended)
allow_writeable_chroot=YES # Needed for chroot if user's home dir is writable

# Enable logging
xferlog_enable=YES
xferlog_file=/var/log/vsftpd.log
xferlog_std_format=NO

# Set timeout values
idle_session_timeout=600
data_connection_timeout=120

# Disable messages to clients about existing files.
hide_file_misses=YES

# Passive mode settings (CRITICAL for modern clients and firewalls)
pasv_enable=YES
pasv_min_port=40000 # Must match UFW range
pasv_max_port=40010 # Must match UFW range
pasv_address=YOUR_SERVER_PUBLIC_IP # Replace with your server's actual public IP

# Prevent users from logging in with a shell other than nologin (security)
pam_service_name=vsftpd

# Restrict users to a list (Recommended for security)
userlist_enable=YES
userlist_deny=NO # If NO, only users in userlist_file CAN log in (whitelisting)
userlist_file=/etc/vsftpd.userlist

# (Optional) For FTPS/SSL configuration - Covered in Step 8
# ssl_enable=YES
# rsa_cert_file=/etc/ssl/certs/vsftpd.pem
# rsa_private_key_file=/etc/ssl/private/vsftpd.pem
# allow_anon_ssl=NO
# force_local_data_ssl=YES
# force_local_logins_ssl=YES
# ssl_tlsv1=YES
# ssl_sslv2=NO
# ssl_sslv3=NO
# require_ssl_reuse=NO
# ssl_ciphers=HIGH

Save the file (Ctrl+O, Enter) and exit nano (Ctrl+X).

Step 6: Create a Dedicated FTP User and its Home Directory

It's a best practice to create a specific user for FTP access, separate from your system users, and restrict its shell access.

1. Create a new user (e.g., ftpuploader):

2. Restrict the user's shell access:

3. Prepare the user's home directory (if chroot_local_user=YES):

If chroot_local_user=YES is enabled (as recommended), users cannot write to their home directory directly if it's writable by them. A common workaround is to create a subdirectory inside the home directory where the user *can* write.

4. Add the user to /etc/vsftpd.userlist (if userlist_enable=YES and userlist_deny=NO):

This explicitly whitelists the user to allow FTP login.

Step 7: Restart vsftpd Service

After all configuration changes, restart vsftpd to apply them.

Verify service status:

Step 8: Test FTP Access from a Client

Now, try connecting from your local machine using an FTP client like FileZilla or directly from your terminal.

Using FileZilla (Recommended for GUI):

1. Download and install FileZilla Client .
2. Open FileZilla.
3. Go to File > Site Manager.
4. Click New Site.
5. Host: Your server's public IP address (e.g., YOUR_SERVER_PUBLIC_IP).
6. Protocol: FTP - File Transfer Protocol.
7. Encryption: Only use plain FTP (insecure). (Temporarily for basic FTP test. We will change this to FTPS later!)
8. Logon Type: Normal.
9. User: ftpuploader.
10. Password: The strong password you set for ftpuploader.
11. Click Connect.

If successful, you should see the contents of /home/ftpuploader/ftp_root in the remote site pane. Try uploading a small file to /ftp_root and then downloading it.

Step 9: (Highly Recommended) Secure FTP with SSL/TLS (FTPS)

This is crucial to encrypt your FTP connections. We'll generate a self-signed SSL certificate for this guide. For production, use a certificate from a trusted CA (e.g., Let's Encrypt).

1. Generate a Self-Signed SSL Certificate:

2. Configure vsftpd for SSL/TLS:

Open /etc/vsftpd.conf again:

Add or uncomment the following lines at the end of the file:

# Enable SSL
ssl_enable=YES
rsa_cert_file=/etc/ssl/certs/vsftpd.pem
rsa_private_key_file=/etc/ssl/private/vsftpd.pem

# Disable anonymous SSL connections
allow_anon_ssl=NO

# Force SSL for local logins and data transfers (CRITICAL for security)
force_local_data_ssl=YES
force_local_logins_ssl=YES

# Choose TLS protocols (Disable old, insecure SSLv2/SSLv3)
ssl_tlsv1=YES
ssl_tlsv1_1=YES
ssl_tlsv1_2=YES
ssl_sslv2=NO
ssl_sslv3=NO

# Other SSL settings
require_ssl_reuse=NO
ssl_ciphers=HIGH

Save and exit.

3. Restart vsftpd:

Step 10: Test FTPS Access (Secure Client Connection)

Now, connect using FTPS (FTP over SSL/TLS) with your client.

Using FileZilla:

1. Open FileZilla Site Manager (File > Site Manager).
2. Select your existing site entry.
3. Encryption: Change to Require explicit FTP over TLS.
4. Click Connect.