To secure an Ubuntu VPS running vsftpd, configure FTP over TLS (FTPS), not SFTP: install vsftpd, assign it a certificate and private key, require TLS for local logins and data transfers, restrict passive ports, open those ports in both firewalls, then test with explicit FTPS. A public certificate for the FTP hostname prevents trust warnings, while a matching passive-port range is what makes directory listings and file transfers work reliably.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What you are configuring: FTPS, not SFTP
vsftpd can protect the traditional FTP protocol with OpenSSL. This is called FTPS. The FTP control connection is negotiated first and then upgraded to TLS in explicit mode; data connections are protected as well when the server requires TLS for them. SFTP is a different protocol that runs inside SSH. An SFTP client cannot log in to an FTPS-only server, and an FTPS client cannot use an SFTP endpoint.
As an Amazon Associate I earn from qualifying purchases.
FTPS is useful when you must preserve FTP workflows, including separate control and data channels, or when users need file-transfer access without being granted an interactive SSH shell. SFTP is often operationally simpler when your organization already manages SSH accounts, keys and firewall policy. This guide covers vsftpd and FTPS.
Prerequisites and the network plan
Before changing the service, prepare the names, accounts and ports that the configuration will use.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
- Ubuntu VPS access: you need a sudo-capable account and the ability to install packages, edit
/etc/vsftpd.confand restart systemd services. - A DNS name: use a name such as
ftp.example.comthat resolves to the VPS’s public address. The name must be the name on the certificate presented to clients. - A certificate plan: use a certificate issued for that hostname in production. A public CA certificate avoids asking every FTP user to install a private trust anchor.
- Two firewall layers: account for the VPS provider’s network firewall and the operating system firewall. Both must permit the FTP control port and the complete passive range.
- A bounded passive range: choose a relatively small, unused TCP range that you can document and allow. The exact numbers are environment-specific; the server and both firewalls must use the same range.
Explicit FTPS normally uses the ordinary FTP control port, TCP 21. Do not confuse that with implicit FTPS, where a client expects TLS immediately on a separate policy and port. Unless a legacy client requires implicit mode, explicit mode is the practical starting point.
Install vsftpd and preserve the original configuration
- Update package metadata and install the service:
sudo apt update
sudo apt install vsftpdUbuntu’s main configuration file is /etc/vsftpd.conf. Make a dated backup before editing so you can compare changes or restore the previous file:
Free tools Windows power users keep installed
One-click scans. No signup required.
sudo cp /etc/vsftpd.conf /etc/vsftpd.conf.backup.$(date +%F)Inspect the installed file and the service state. A failed start at this stage usually indicates a syntax or file-permission problem that should be fixed before adding TLS:
sudo systemctl status vsftpd.service
sudo sed -n '1,240p' /etc/vsftpd.confKeep one active setting for each directive. The sample file contains comments and may contain duplicate examples; an explicit value later in the file can override an earlier one, which makes troubleshooting unnecessarily difficult.
Obtain a certificate for the FTP hostname
Use a public CA certificate for production
For an internet-facing VPS, Ubuntu recommends a certificate from Let’s Encrypt. Its certificates are valid for 90 days, and Certbot can renew them automatically. The issued files are exposed through a directory such as /etc/letsencrypt/live/<domain>/; for this example, the paths will be /etc/letsencrypt/live/ftp.example.com/fullchain.pem and /etc/letsencrypt/live/ftp.example.com/privkey.pem.
ACME HTTP-01 validation requires the hostname to be reachable on TCP port 80 during validation. Allow that port temporarily or permanently as appropriate for the validation method, and make sure DNS already points at the VPS. Follow the Certbot method appropriate to your web-server layout; do not copy a certificate issued for another hostname into the vsftpd configuration.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
The private key is sensitive. Leave the ownership and restrictive permissions installed by the certificate tooling intact, and verify that the vsftpd process can read the key through the documented certificate path. Do not make the key world-readable just to silence a startup error.
Self-signed certificates are for controlled testing
A self-signed certificate can prove that encryption is working, but ordinary clients will display a trust warning until you distribute and trust that certificate yourself. Ubuntu does not recommend a self-signed certificate for production; replace it with a CA-signed certificate for a public service.
Configure TLS and local-user policy
Open the configuration as root:
sudo editor /etc/vsftpd.confAdd or update the following baseline. Replace the hostname in both certificate paths with the name actually covered by your certificate. The passive ports shown are an example; choose and document your own range.
listen=NO
listen_ipv6=YES
anonymous_enable=NO
local_enable=YES
write_enable=YES
ssl_enable=YES
rsa_cert_file=/etc/letsencrypt/live/ftp.example.com/fullchain.pem
rsa_private_key_file=/etc/letsencrypt/live/ftp.example.com/privkey.pem
force_local_logins_ssl=YES
force_local_data_ssl=YES
allow_anon_ssl=NO
ssl_sslv2=NO
ssl_sslv3=NO
ssl_tlsv1_2=YES
ssl_tlsv1_3=YES
pasv_min_port=40000
pasv_max_port=40100
chroot_local_user=YESIf your existing file already defines listening behavior, retain the setting that matches your deployment rather than enabling both IPv4 and IPv6 listeners for the same address family. The essential TLS directives are these:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors| Directive | Value in this example | Purpose |
|---|---|---|
ssl_enable |
YES |
Enables OpenSSL-protected control and data connections when vsftpd was built with OpenSSL. |
rsa_cert_file |
.../fullchain.pem |
Points to the server certificate chain presented to clients. |
rsa_private_key_file |
.../privkey.pem |
Points to the private key corresponding to that certificate. |
force_local_logins_ssl |
YES |
Rejects local-user authentication unless the control connection is protected by TLS. |
force_local_data_ssl |
YES |
Requires TLS on local-user data channels, including directory listings and file transfers. |
allow_anon_ssl |
NO |
Does not permit anonymous users to use TLS; anonymous access is disabled here as well. |
ssl_sslv2 and ssl_sslv3 |
NO |
Disables obsolete SSL protocol versions. |
ssl_tlsv1_2 and ssl_tlsv1_3 |
YES |
Enables the modern TLS versions supported by the installed vsftpd/OpenSSL combination. |
pasv_min_port/pasv_max_port |
40000/40100 |
Bounds the server’s passive data sockets to a firewallable range. |
The security of TLS also depends on the OpenSSL library supplied by Ubuntu. Keep the operating system and its security updates current; enabling the directives alone does not replace patch management.
Isolate users and handle non-login shells
chroot_local_user=YES confines each local user to a jail rooted at that user’s home directory. This limits what the FTP session can see above the home directory. Ubuntu documents an important inversion: when chrooting is enabled, the meaning of chroot_list_file is reversed compared with the non-chrooted case. Decide explicitly whether the file should contain exceptions, and test one representative account before onboarding many users.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Create or use ordinary local accounts with home directories containing only the files they should transfer. Keep ownership and write permissions narrow; a TLS connection protects traffic but does not correct Unix ownership or mode errors.
Some administrators assign FTP-only accounts the shell /usr/sbin/nologin. If PAM is configured to use pam_shells.so, that shell must appear in /etc/shells or authentication can fail even though the password is correct. Check the account’s shell and PAM policy when a user receives a login rejection:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
getent passwd username
cat /etc/shellsAdd the non-login shell to /etc/shells only when that matches your security policy. Do not grant an interactive shell merely to make FTP authentication succeed.
Set passive ports and open both firewalls
FTP uses a separate data connection for directory listings and transfers. In passive mode, the client connects back to a port selected by vsftpd. If the configured range is not reachable, login and TLS negotiation can succeed while listings hang or transfers time out.
For the example range above, permit TCP 21 and TCP 40000–40100 in the host firewall. With UFW, the corresponding rules are:
sudo ufw allow 21/tcp
sudo ufw allow 40000:40100/tcp
sudo ufw status verboseEnter the same ports in the VPS provider’s firewall or security-group interface. A rule in only one of the two layers is insufficient. If you choose a different range, substitute it consistently in pasv_min_port, pasv_max_port, UFW (or another host firewall), and the provider firewall.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Keep the range as narrow as your concurrency requirement allows. A bounded range is easier to audit than opening a large portion of the port space, but it must contain enough simultaneous data sockets for your users and automation. Record the range in your network documentation so a later firewall cleanup does not silently break FTP.
Restart vsftpd and connect with explicit FTPS
After saving the configuration, restart the service:
sudo systemctl restart vsftpd.service
sudo systemctl status vsftpd.serviceIf the restart fails, read the service log before changing more settings:
sudo journalctl -u vsftpd.service --no-pager -n 100In a graphical client, create a site using the normal FTP protocol and select FTPES – FTP over explicit TLS/SSL (the label used by FileZilla). Use the server hostname, port 21, a local username and password, and passive transfer mode. The client should show a certificate whose name matches the hostname, then request encrypted authentication.
Command-line users can use an FTP client with FTPS support such as lftp. Select an explicit TLS session rather than an SFTP URL; the exact command-line flags depend on the client version and its trust-store policy. Do not disable certificate verification permanently to work around a name or trust error.
Verify every part of the path
Use a small test account and a harmless test file. Perform these checks in order so a failure identifies the layer that needs attention:
- Service: confirm
systemctl status vsftpd.servicereports an active service after the restart. - Control port: confirm the client reaches TCP 21 and receives an FTP banner.
- TLS negotiation: select explicit FTPS and verify that the certificate name and trust status are correct. A plain FTP login should be rejected when local logins are forced to TLS.
- Authentication: log in with the test local account. Check the account shell, home directory and PAM policy if authentication is refused.
- Directory listing: request a listing in passive mode. This opens the first protected data connection and is the quickest test of the passive range and firewall rules.
- Downloads and uploads: transfer a small file in each direction. This checks Unix permissions, chroot behavior and the encrypted data channel rather than only the control connection.
- Second network: repeat the test from outside the VPS network, such as a different internet connection. A local test can succeed when the provider firewall still blocks passive ports.
Keep the client log from a failed test. The sequence of FTP replies, the negotiated TLS result and the selected passive port are more useful than a generic “connection failed” message.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Renew certificates without interrupting service longer than necessary
Let’s Encrypt certificates expire after 90 days. Certbot installs a systemd renewal timer on Ubuntu, but renewing the files on disk does not automatically make an already-running vsftpd process present the new certificate. Configure a renewal deploy hook that reloads or restarts vsftpd after a successful renewal, then verify the hook in a staging or controlled renewal test.
The hook should run only after a successful certificate update and should use the same service command you tested manually:
sudo systemctl reload vsftpd.serviceIf your installed vsftpd/OpenSSL combination does not reliably reload certificate material, use a restart instead. Monitor the renewal timer and service logs, and schedule a periodic external FTPS login test so an expired or stale certificate is detected before users report it.
Troubleshoot common FTPS failures
| Symptom | Likely cause | What to check |
|---|---|---|
| vsftpd will not start after TLS was enabled | Wrong path, unreadable key, malformed directive or a certificate/key mismatch | Read journalctl -u vsftpd.service; verify both files exist, are readable by the service and belong to the same certificate; restore the backup only long enough to isolate the faulty change. |
| Client reports an untrusted or mismatched certificate | The certificate is self-signed, expired, issued for another name, or the client is connecting by an unlisted IP address | Connect using the certificate’s DNS name, install a CA-issued certificate for production, and check the current files under /etc/letsencrypt/live/<domain>/. |
| Login is rejected before a password prompt or with a “secure connection required” message | The client is using plain FTP while local TLS is forced | Change the site profile to explicit FTPS on port 21. Do not weaken force_local_logins_ssl merely to accommodate a client that cannot encrypt. |
| Login works but directory listing times out | Passive ports are blocked, the client is not in passive mode, or the configured range differs between server and firewall | Enable passive mode, compare pasv_min_port/pasv_max_port with both firewall rules, and test from an external network. |
| Listing works but upload or download fails | Unix permissions, chroot paths, or data-channel TLS settings are wrong | Test a small file in both directions, inspect the user’s home-directory ownership and modes, and confirm force_local_data_ssl=YES is supported by the client. |
Accounts with /usr/sbin/nologin cannot authenticate |
PAM’s shell check does not recognize the assigned shell | Compare getent passwd username with /etc/shells; add the shell only if that is intentional for the FTP-only account. |
| Renewal succeeds but clients still see the old certificate | vsftpd has not reloaded the renewed certificate | Run the tested reload or restart command and install a Certbot deploy hook for future renewals. |
Security and protocol choices
Explicit versus implicit FTPS
Explicit FTPS starts on the normal FTP control port and upgrades to TLS at the client’s request. Implicit FTPS expects TLS from the first byte and generally requires a different listener and firewall policy. Explicit mode has broad client support and is the mode described by Ubuntu’s community guidance. Choose implicit mode only when a documented compatibility requirement demands it; do not make clients guess which mode the server expects.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →FTPS versus SFTP
FTPS retains FTP’s control/data-channel design and can be limited to file-transfer accounts. SFTP uses SSH, one encrypted connection and SSH’s account and key-management model. The choice affects clients, ports, logging, account shells and firewall rules; changing the client protocol does not require changing vsftpd settings.
Public CA versus self-signed certificates
A public CA certificate is trusted by normal client platforms and is the appropriate production choice for an internet-facing hostname. A self-signed certificate is reasonable only when you control every client and can distribute trust safely. In either case, renew before expiry and reload vsftpd after the certificate changes.
Operational checklist
- Use a DNS hostname that is included in the certificate and in client connection profiles.
- Keep
ssl_enable=YES, local-login TLS and local-data TLS enabled for accounts that handle sensitive files. - Disable anonymous access unless you have a separately reviewed, documented reason to provide it.
- Use a bounded passive range and allow exactly that range in the provider and host firewalls.
- Keep users chrooted where appropriate, and verify their Unix ownership and permissions.
- Patch Ubuntu’s OpenSSL and vsftpd packages; the TLS directives cannot compensate for an unmaintained library.
- Monitor renewal timers, service logs and an external FTPS test rather than waiting for a user to discover an expired certificate.
With the certificate paths, TLS requirements, passive range and firewall rules aligned, vsftpd provides an encrypted FTP service that clients can authenticate to safely and use for directory listings and transfers without exposing credentials or file data in clear text.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
