VSFTPD: Install and Secure an FTP Server on Linux (Complete Guide)
Even in the age of cloud and object storage, the FTP protocol remains an essential standard for industrial PLCs, multi-function printers, or batch transfers. However, using a “naked” FTP is suicidal. VSFTPD (Very Secure FTP Daemon) is the reference solution for securing these exchanges under Linux.
Installation and First Security Reflex
On Debian/Ubuntu, installation is trivial: sudo apt install vsftpd. But before starting the service, clear the default configuration file and start with a clean slate. The first rule is to forbid anonymous access: anonymous_enable=NO.
Chroot: Jailing to Protect
One of the biggest flaws of classic FTP is the ability for a user to move up the system tree (cd ..). With chroot_local_user=YES, the user is confined to their home directory.
Warning: For security reasons, VSFTPD refuses to start if the chroot root directory is writable. You must either create a subfolder for uploads or use the allow_writeable_chroot=YES option (with caution).
SSL/TLS Encryption: Don’t let anything pass in plain text
Classic FTP transmits credentials and data in plain text. Any sniffer on the network can steal your passwords. Enabling TLS is therefore non-negotiable in 2024. Force the use of SSL for connections and data transfers:
ssl_enable=YES
allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES
Passive Mode and Firewall: The headache solved
FTP uses two ports: 21 for commands and a dynamic port for data. If you are behind a firewall, passive mode will fail if you don’t define a fixed range:
pasv_min_port=40000
pasv_max_port=40100Don’t forget to open this range (40000:40100/tcp) in your firewall (ufw or firewalld); otherwise, your users will connect but won’t be able to list files.
Should you still use FTP? If you have the choice, prefer SFTP (via SSH). But if your industrial PLC only swears by FTP, VSFTPD is your best defense. Don’t forget to automate your Linux configuration file backups with Oxidized.
As an Amazon Associate, I earn from qualifying purchases.
Learn more: To master the basics of electronics, don’t miss our guide on Ohm’s Law.
