Use vsftpd with a dedicated account, a root-owned chroot directory, a writable child directory only when uploads are required, and FTPS encryption. Disable anonymous access, expose a small passive-port range, and verify that the account cannot leave its assigned directory. If your clients support SSH, SFTP is usually simpler and safer; use FTPS when FTP compatibility is required.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Choose the right protocol before creating the account
FTP is not encrypted by itself. A username, password, and transferred data can cross the network in clear text. For an FTP-compatible service, use FTPS: vsftpd provides FTP over TLS, while retaining the FTP command and data-channel model. Require TLS for both login and data connections when credentials or files must be protected.
As an Amazon Associate I earn from qualifying purchases.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteSFTP is a different protocol that runs through SSH. It normally needs an SSH-capable shell account and one SSH service, so it avoids FTP’s separate passive data-channel firewall rules. Choose SFTP when every client supports it and you do not need FTP-specific compatibility. Choose FTPS when existing software, vendors, or automated jobs require FTP.
| Option | Identity and transport | Best fit | Main operational concern |
|---|---|---|---|
| Local vsftpd user | Account exists in the Linux password database; FTP can use a nologin shell |
One or a few administrators, vendors, or site owners | Review whether other services, especially SSH, accept the account |
| vsftpd virtual user | Credentials live in a vsftpd/PAM database and map to one unprivileged local guest account | Several FTP-only customers, vendors, or application identities | Protect the credential database and PAM files; keep the mapped account unprivileged |
| SFTP | SSH authentication and an encrypted SSH transport | Clients that support SSH file transfer | SSH account and chroot design must be configured correctly |
Prerequisites and a least-privilege layout
The commands below use Debian or Ubuntu naming, where the package is vsftpd and the service is managed as vsftpd. Other distributions may use different package, service, firewall, or PAM commands. You need root or sudo access, a public VPS address, a DNS name if clients will validate a certificate by name, and permission to change the VPS provider’s network security group.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Decide whether the account only downloads files or also uploads. Download-only access needs no write permission and can leave write_enable=NO. Uploads, renames, deletion, and directory creation require write support and carefully scoped Unix permissions.
A safe tree keeps the chroot root itself administrative and places writable content below it:
/srv/ftp/client-a/ # jail root; owned by root
└── incoming/ # optional upload directory; writable by clientaThe account sees /srv/ftp/client-a as /. It cannot use cd .. to reach the VPS filesystem. The root directory should not be writable by the jailed user. The vsftpd manual warns:
“Allow chroot()’ing a user to a directory writable by that user. Note that setting this to YES is potentially dangerous. For example, if the user creates an ‘etc’ directory in the new root directory, they could potentially trick the C library into loading a user-created configuration file from the /etc/ directory.”
Install and enable vsftpd
- Update package metadata and install the server:
sudo apt update
sudo apt install vsftpd - Back up the distribution configuration before editing it:
sudo cp /etc/vsftpd.conf /etc/vsftpd.conf.bak - Enable the service at boot and start it:
sudo systemctl enable --now vsftpd - After each configuration change, check syntax and service state with:
sudo systemctl restart vsftpd
sudo systemctl status vsftpd --no-pager
sudo journalctl -u vsftpd -n 50 --no-pager
If your distribution uses a socket-activated service or a different unit name, use the package’s service name rather than copying the Ubuntu commands unchanged.
Pattern A: create one restricted local Linux user
Create the jail and set ownership
Create the directory before assigning it as the user’s home. The example gives the account read access to the jail and write access only to incoming:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →sudo mkdir -p /srv/ftp/client-a/incoming
sudo chown root:root /srv/ftp/client-a
sudo chmod 755 /srv/ftp/client-a
sudo chown clienta:clienta /srv/ftp/client-a/incoming
sudo chmod 750 /srv/ftp/client-a/incomingThe chown clienta:clienta command requires the user to exist, so create the account first if this is a new installation:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
sudo useradd --home-dir /srv/ftp/client-a --shell /usr/sbin/nologin --no-create-home clienta
sudo passwd clientaIf you run the ownership commands before useradd, create the account first, then repeat them. Use a long, unique password and store it in the password manager used by the administrators.
Prevent interactive login
/usr/sbin/nologin prevents a normal interactive shell. It does not by itself prove that every service rejects the account, so review SSH and any other daemon that can authenticate local users. The distribution’s vsftpd PAM file may contain pam_shells.so, which permits only shells listed in /etc/shells. If FTP login fails after you set a nologin shell, inspect:
grep -n pam_shells /etc/pam.d/vsftpd
getent passwd clienta
cat /etc/shellsMake the PAM policy and shell choice agree. On some systems administrators add the nologin path to the permitted-shell policy; on others they use a vsftpd-specific PAM arrangement that does not require an interactive shell. Do not remove a security check without understanding which services it protects.
Free tools Windows power users keep installed
One-click scans. No signup required.
Allow only the intended local account
To create an allow-list, add the account to a dedicated file:
printf '%sn' clienta | sudo tee /etc/vsftpd.userlist
sudo chmod 600 /etc/vsftpd.userlistWith userlist_enable=YES and userlist_deny=NO, only names in that file are accepted. If you instead use the distribution’s deny-list behavior, the meaning reverses. A user-list rule can make a correct password appear to fail, so check the active settings when troubleshooting.
Configure vsftpd for a jailed local user
Edit /etc/vsftpd.conf and set the core controls below. Keep one setting per line; remove conflicting duplicate lines so the effective value is obvious:
anonymous_enable=NO
local_enable=YES
write_enable=YES
chroot_local_user=YES
userlist_enable=YES
userlist_deny=NO
userlist_file=/etc/vsftpd.userlist
local_umask=022Set write_enable=NO for a download-only account. Set it to YES only when the account needs upload, rename, deletion, or directory-creation commands. The filesystem permissions must still deny writes everywhere except the intended child directory.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Do not make the chroot root writable merely to silence a startup or login error. Keep /srv/ftp/client-a owned by root and writable only below that directory. A setting such as allow_writeable_chroot=YES weakens this protection and should not be used as a routine fix.
Ubuntu documents that chroot_local_user=YES limits local users to their home directory. When chrooting is enabled, the interpretation of chroot_list_file reverses: listed users become exceptions rather than the users who are jailed. Omit that file unless you deliberately need exceptions, and document every exception.
Limit commands when the account’s job is narrow
vsftpd can narrow the command surface beyond Unix permissions. The global cmds_allowed option permits only named FTP commands; cmds_denied blocks named commands. Use these only after checking the commands required by your clients, because a restrictive list can break directory listings, resumable transfers, or renames. For different policies per account, set user_config_dir=/etc/vsftpd/users and place a file named after each username in that directory. Per-user files can override settings such as local_root, command lists, and write behavior.
Configure FTPS and protect credentials
Obtain a certificate and private key whose name matches the address clients use. Store the private key so only root can read it, for example under /etc/ssl/private. Then enable TLS in /etc/vsftpd.conf using the certificate and key paths installed on your VPS:
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →ssl_enable=YES
allow_anon_ssl=NO
force_local_logins_ssl=YES
force_local_data_ssl=YES
rsa_cert_file=/etc/ssl/certs/vsftpd.crt
rsa_private_key_file=/etc/ssl/private/vsftpd.keyUse the TLS protocol options supported by the vsftpd version in your distribution and disable obsolete SSL protocols. Client compatibility determines whether you can require the newest policy immediately; where credentials must never be sent in clear text, keep both force_local_logins_ssl and force_local_data_ssl enabled. A self-signed certificate encrypts traffic but causes trust warnings until every client explicitly trusts it; a certificate issued by a trusted authority avoids that administrative step.
After reloading, connect with the client’s explicit FTPS mode, not plain FTP. Confirm that the client reports a TLS session for both the login and the data channel. If the server requires encryption but the client starts plain FTP, login or directory listing will fail by design.
Configure passive FTP and the VPS firewall
FTP uses a control connection and separate data connections. Passive mode lets the client initiate the data connection, which is generally easier through client-side firewalls, but the server must expose a bounded port range:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
pasv_enable=YES
pasv_min_port=40000
pasv_max_port=40100Open TCP port 21 and exactly that passive range in both the VPS host firewall and the provider’s cloud security group. With UFW:
sudo ufw allow 21/tcp
sudo ufw allow 40000:40100/tcp
sudo ufw status verboseIf the VPS is behind NAT, set pasv_address to the public address clients can reach. Do not advertise an internal address. A DNS name can be used when your clients resolve it consistently, but its certificate name and firewall routing must agree with that choice. Keep the range as small as the number of simultaneous transfers requires; opening every high port makes the service harder to audit.
Pattern B: use vsftpd virtual users for FTP-only identities
Virtual users are useful when customers or applications need FTP credentials but must not receive individual Linux accounts. vsftpd authenticates names from a PAM user database and maps them to one unprivileged local guest account. The guest account owns no administrative files and has no interactive shell.
Create the unprivileged guest and directory
sudo useradd --home-dir /srv/ftp --shell /usr/sbin/nologin --no-create-home ftpguest
sudo mkdir -p /srv/ftp/client-a/incoming
sudo chown root:root /srv/ftp/client-a
sudo chmod 755 /srv/ftp/client-a
sudo chown ftpguest:ftpguest /srv/ftp/client-a/incoming
sudo chmod 750 /srv/ftp/client-a/incomingBuild and protect the credential database
Create a root-readable text file containing alternating usernames and passwords, for example:
client-a
use-a-long-random-passwordSave it outside any served directory, restrict it to root, and convert it with the Berkeley DB utility supplied by your distribution:
sudo chmod 600 /etc/vsftpd/virtual-users.txt
sudo db_load -T -t hash -f /etc/vsftpd/virtual-users.txt /etc/vsftpd/virtual-users.db
sudo chmod 600 /etc/vsftpd/virtual-users.dbRemove or securely destroy the clear-text source after confirming the database works, according to your credential-management policy. Protect the database and its parent directory because anyone who reads it may authenticate as an FTP user.
Add a PAM service for the database
Create a vsftpd-specific PAM file such as /etc/pam.d/vsftpd-virtual with the database path expected by your distribution’s pam_userdb module:
auth required pam_userdb.so db=/etc/vsftpd/virtual-users
account required pam_userdb.so db=/etc/vsftpd/virtual-usersPAM database path conventions differ: some configurations omit the .db suffix. Match the syntax in the installed module’s documentation and keep the file readable only by root.
Recommended Free Tools
Map identities to the guest account
In vsftpd.conf, enable virtual-user mode and point authentication at the PAM file:
anonymous_enable=NO
local_enable=YES
write_enable=YES
guest_enable=YES
guest_username=ftpguest
virtual_use_local_privs=YES
pam_service_name=vsftpd-virtual
user_config_dir=/etc/vsftpd/users
chroot_local_user=YES
pasv_enable=YES
pasv_min_port=40000
pasv_max_port=40100Create /etc/vsftpd/users/client-a for the virtual identity and assign its root:
local_root=/srv/ftp/client-aRepeat the per-user file with a different directory for each identity. The mapped guest account, not the virtual name, determines Unix ownership and permissions, so keep every guest-owned directory limited to the files that those identities should share. If identities need genuinely different Unix ownership or ACLs, separate guest accounts or local users may be easier to reason about.
Reload and verify from outside the VPS
Configuration success is not the same as a secure account. Test through the same hostname, protocol mode, and network path that the real client will use:
- Restart vsftpd and inspect the journal for syntax or permission errors.
- Connect with FTPS and confirm that the certificate is the expected one and that TLS protects login and data.
- Confirm the first directory shown is the intended jail root, not the VPS filesystem.
- Run
cd ..repeatedly and verify that the client cannot escape the jail. - Download a permitted file and list the intended directories.
- If uploads are required, upload a small file into the writable child directory, then test an allowed rename or deletion only if the workflow needs it.
- Attempt a write in the root of the jail and in another read-only directory; both should fail.
- Attempt a command excluded by
cmds_allowedor blocked bycmds_denied, if you configured those controls. - Repeat the connection from an external network so a local firewall exception cannot hide a passive-port problem.
Record the expected result for each account. A limited account is finished only when both allowed operations succeed and forbidden operations fail.
Troubleshoot the common failures
Login is rejected
- Confirm the selected mode is enabled: local users need
local_enable=YES; virtual users needguest_enable=YESand the correct PAM service. - Check user-list behavior. With
userlist_deny=NO, a name absent from the list is denied. - For a local user, inspect the shell and the vsftpd PAM file for a
pam_shells.sorequirement. - Check the service journal for a malformed PAM line, unreadable database, or certificate error.
- Ensure the account is not locked and that its password was set in the authentication system you selected.
Listing or transfers hang
- Verify that TCP 21 and the complete passive range are allowed in both the VPS firewall and the cloud security group.
- Confirm the server advertises a reachable public address rather than a private interface address.
- Force the client to use passive mode and FTPS-compatible data protection.
- Check whether another service already occupies a passive port.
Uploads return permission denied
- Inspect ownership and mode bits on every parent directory, not only the final directory.
- Confirm that
write_enable=YESand the required upload command are enabled. - Check ACLs and any SELinux or AppArmor policy that can deny writes even when Unix mode bits appear correct.
- For virtual users, remember that the mapped guest account performs the filesystem operation.
- Do not fix the error by making the chroot root writable; repair the child-directory permissions instead.
TLS negotiation fails
- Check that the certificate and private-key paths exist and that the daemon can read them.
- Make sure the certificate name matches the hostname used by the client.
- Compare the server’s enabled TLS policy with the client’s supported versions and cipher requirements.
- Verify whether the client supports encrypted passive data connections when
force_local_data_ssl=YESis enabled.
Operational safeguards after deployment
- Keep vsftpd, the operating system, and the TLS library patched.
- Use unique credentials per person or automation job; virtual users make revocation possible without creating shell accounts.
- Restrict source addresses in the cloud firewall when partners have stable egress IPs.
- Monitor authentication failures, successful logins, uploads, and deletions, and rotate credentials when a vendor or job ends.
- Give download-only users read-only trees and keep upload directories separate from application or system directories.
- Back up the configuration, PAM policy, certificate renewal procedure, and directory-permission design, but never place passwords or private keys in an ordinary backup readable by unrelated administrators.
Which design should you deploy?
For one or two trusted operators, a local account with a nologin shell, a root-owned home directory, and a writable child directory is straightforward to audit. For many FTP-only identities, virtual users avoid a proliferation of system accounts, but the credential database and PAM configuration become critical secrets. If there is no compatibility reason to retain FTP, use SFTP and manage the SSH account and chroot policy instead. If FTP compatibility is mandatory, deploy FTPS, restrict passive ports, and keep every chroot root directory non-writable by its jailed identity.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
