To provide public, download-only FTP files on Ubuntu, install vsftpd, publish files in a dedicated directory such as /srv/ftp, enable anonymous access, disable every write capability, and open TCP 21 plus a small passive-port range. The essential configuration is in /etc/vsftpd.conf; restart the service after changing it.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
This arrangement is suitable only for content you deliberately want to expose without encryption. Commands, usernames, passwords and file data travel in plain FTP. Use OpenSSH SFTP for private or authenticated transfers.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWhat anonymous vsftpd downloads provide
vsftpd is an FTP daemon available in Ubuntu. In an anonymous configuration, a client can connect without a personal Unix account, usually by entering anonymous or ftp as the username. The server maps that session to a dedicated anonymous root and permits directory listings and downloads while rejecting uploads and other filesystem-changing operations.
Anonymous access is not the same as an unprotected server. The daemon still needs to read the files, traverse every parent directory, and establish FTP data connections. A successful login followed by an empty listing or a transfer timeout usually indicates a path, permission, passive-port, firewall or NAT problem rather than an authentication problem.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Requirements and design decisions
- An Ubuntu system with administrative access and a supported package repository.
- A fixed directory containing only files intended for public download. Use a path such as
/srv/ftp, not a user’s home directory. - A host firewall and, when applicable, cloud security-group or router access for TCP 21 and the passive range.
- A plan for whether clients connect over IPv4, IPv6, or both. The
listenandlisten_ipv6modes are mutually exclusive in vsftpd. - A decision about whether the server is directly reachable or sits behind NAT. NAT normally requires an explicit
pasv_address.
Record the Ubuntu release and the installed vsftpd package version. Distribution defaults and included configuration files can change between releases, so retain a copy of the configuration before editing it.
Install and start vsftpd
Update package metadata, install the daemon, and enable its systemd unit:
sudo apt update
sudo apt install vsftpd
sudo systemctl enable --now vsftpdConfirm that the service is running and note any startup error before proceeding:
systemctl status vsftpd --no-pager
systemctl is-enabled vsftpdDo not expose the service to the Internet until the anonymous root and write restrictions have been configured. A package installation may provide a sample configuration containing settings that differ from the profile below.
Create a dedicated anonymous publication directory
Create a directory outside users’ private homes and place only public material in it. The following example makes root own the directory and gives the FTP process traversal and read access without granting write access:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
sudo install -d -o root -g root -m 0755 /srv/ftp
sudo install -o root -g root -m 0644 release-notes.txt /srv/ftp/release-notes.txt
sudo install -d -o root -g root -m 0755 /srv/ftp/downloadsFor an existing tree, inspect every parent directory and file:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11namei -l /srv/ftp/release-notes.txt
find /srv/ftp -type d -printf '%M %u:%g %pn'
find /srv/ftp -type f -printf '%M %u:%g %pn'With anon_world_readable_only=YES, a downloadable file must be world-readable. A directory must also have execute permission for the process to enter it; read permission on the file alone is insufficient. Typical public files use mode 0644 and directories use 0755, but choose tighter ownership and modes when your layout permits. Never make the entire filesystem readable merely to fix an FTP error.
Build a download-only vsftpd configuration
Back up the existing file, then edit it as root:
sudo cp -a /etc/vsftpd.conf /etc/vsftpd.conf.backup
sudoedit /etc/vsftpd.confA minimal IPv4 profile is:
listen=YES
anonymous_enable=YES
local_enable=NO
write_enable=NO
anon_root=/srv/ftp
anon_world_readable_only=YES
anon_upload_enable=NO
anon_mkdir_write_enable=NO
anon_other_write_enable=NO
dirlist_enable=YES
download_enable=YES
xferlog_enable=YES
pasv_min_port=40000
pasv_max_port=40100Keep only one listening mode. If this host should listen with the IPv6 socket, use listen_ipv6=YES instead of listen=YES, according to the package’s documented configuration, and ensure the firewall and network path support IPv6.
What each access control setting does
anonymous_enable=YESenables anonymous and the conventionalftpusernames.local_enable=NOprevents normal local Unix accounts from logging in through this profile.write_enable=NOis the master gate for commands that change the filesystem. Leave it disabled for a download service.anon_upload_enable=NOblocks anonymous uploads. Even when enabled, uploads would require the relevant write permissions.anon_mkdir_write_enable=NOblocks anonymous directory creation.anon_other_write_enable=NOblocks other anonymous write operations such as deletion and renaming.dirlist_enable=YESallows clients to list directories.download_enable=YESpermits file downloads.anon_root=/srv/ftpmakes that directory the starting point for anonymous sessions. Clients should not be able to browse above it.anon_world_readable_only=YESlimits anonymous downloads to files that are world-readable, reducing the chance that a mistakenly restrictive or private file is exposed.
Check for duplicate or included directives elsewhere in the configuration. The effective value is what matters; a later assignment or an included file can undo an apparently safe setting. In particular, verify all four write controls if anonymous uploads or deletes behave unexpectedly.
Logging
xferlog_enable=YES records transfers. Depending on the Ubuntu package configuration, entries may appear in /var/log/vsftpd.log or another configured path. After a test download, inspect the active log:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
sudo tail -n 50 /var/log/vsftpd.log
sudo journalctl -u vsftpd --since '15 minutes ago'If the configured log path differs, use that path instead. Logs help distinguish a client that never reached the daemon from one that authenticated but failed during a data connection.
Configure passive FTP ports and firewalls
FTP uses a control connection on TCP 21 and a separate data connection for directory listings and file transfers. Passive mode makes the server announce a data port from a configured range. Restricting that range makes firewall rules auditable:
pasv_min_port=40000
pasv_max_port=40100Open TCP 21 and exactly that range on every enforcement point. With UFW, for example:
sudo ufw allow 21/tcp
sudo ufw allow 40000:40100/tcp
sudo ufw status verboseAlso add equivalent rules to a cloud security group, hardware firewall and router port-forwarding policy when those controls exist. Forward TCP 21 and the passive range to the same Ubuntu host. Keep the range narrow but large enough for the number of simultaneous data connections your service expects, and document it so a later firewall change does not silently break listings.
NAT and the passive address
When the server is behind NAT, clients may receive a private address that is not reachable from the Internet. Set the address clients can actually reach:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
pasv_address=<reachable-public-address>Use the address or name appropriate to your network design and make sure the router forwards the passive ports. A correct TCP 21 rule does not compensate for an incorrect passive address. If the public address changes, update this setting and any dependent DNS or forwarding configuration before clients reconnect.
Apply the configuration and verify the daemon
Restart after editing, then check for syntax or startup failures:
sudo systemctl restart vsftpd
sudo systemctl status vsftpd --no-pager
sudo journalctl -u vsftpd -b --no-pagerIf the service fails, restore the backup and reapply changes one at a time:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →sudo cp -a /etc/vsftpd.conf.backup /etc/vsftpd.conf
sudo systemctl restart vsftpdA restart only proves that the daemon accepted its configuration. It does not prove that a remote client can traverse the anonymous root or reach the passive data ports, so perform a test from a separate machine or network.
Test an anonymous download end to end
- Connect from a separate FTP client to the server’s reachable address. Select passive mode if the client does not do so automatically.
- Enter
anonymousorftpas the username. Do not treat the optional password field as a security mechanism; FTP authentication and data remain unencrypted. - List the root directory and confirm that only the intended publication tree appears.
- Download a known test file and compare its size or checksum with the source file.
- Attempt an upload, delete, rename and directory-creation operation. Each should be rejected.
- Check the transfer log and system journal for the connection, listing and download.
These checks should be run from outside the server itself when possible. A local test can succeed even while an Internet client is blocked by NAT, a cloud rule or an upstream firewall. Remove the test file when validation is complete if it was not meant for publication.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshoot the common failure patterns
| Symptom | Checks | Likely correction |
|---|---|---|
| Login succeeds but the directory is empty | Confirm anon_root, inspect the actual directory contents, verify execute permission on every parent, and check dirlist_enable. |
Point anon_root at the intended publication directory, fix traversal permissions, or enable directory listing. |
| Login succeeds but a file download is denied | Inspect the file mode and ownership, then check anon_world_readable_only. |
Make only the intended file world-readable and ensure its parent directories are searchable. Do not expose private files to satisfy the check. |
| Login works but listing or download hangs | Check passive-mode selection, TCP 21, the configured passive range, firewall and cloud rules, router forwarding, and pasv_address. |
Open and forward the complete narrow range, correct the advertised reachable address, and retry from an external network. |
| Anonymous upload, delete or rename unexpectedly works | Inspect every included configuration file and verify write_enable, anon_upload_enable, anon_mkdir_write_enable and anon_other_write_enable are all disabled. |
Remove conflicting assignments, restart vsftpd, and repeat the rejected-operation tests. |
| No evidence of access is visible | Confirm xferlog_enable=YES, identify the configured log path, and inspect both the transfer log and journalctl -u vsftpd. |
Enable transfer logging, correct the log destination if necessary, and generate a fresh test connection. |
| The daemon will not start after editing | Review the journal for an invalid directive, conflicting listening modes, a malformed path or an unavailable port. | Restore the backup, remove the offending line, and add changes incrementally. |
Operate the server with least privilege
Keep the anonymous root deliberately small. Publish generated releases, documentation or other genuinely public artifacts there; do not point it at /, /home or a user’s complete home directory. Home directories can contain names, metadata or files that were never intended for anonymous visitors, and an inaccessible parent can make an apparently readable file unreachable.
Use root ownership for static publication content when practical, copy new files into the tree through an administrative process, and remove obsolete files promptly. Review the directory recursively after every deployment. A file can become downloadable simply because a packaging step changed its mode to world-readable, so treat permissions as part of the publication checklist.
Free tools Windows power users keep installed
One-click scans. No signup required.
Monitor transfer logs for unexpected volume, repeated failures and access to files that should have been removed. Restrict the service at the network layer when the audience is a known set of addresses or a controlled network. Anonymous FTP offers no confidentiality, integrity protection or reliable identity, so do not use it for credentials, personal data, private source code or administrative files.
Anonymous FTP compared with safer delivery methods
| Characteristic | Anonymous FTP with vsftpd | SFTP through OpenSSH | HTTPS download service |
|---|---|---|---|
| Encryption in transit | None for commands or data. | Encrypted by the SSH connection. | Encrypted when configured with HTTPS/TLS. |
| Access model | Public, commonly using anonymous or ftp. |
Named users, keys or passwords; anonymous access is not the normal model. | Can be public or authenticated, depending on the web-server configuration. |
| Firewall and NAT complexity | TCP 21 plus a passive range, with NAT address handling when applicable. | Usually one SSH port, commonly TCP 22, with no FTP data-channel range. | Usually the web ports selected by the web server, commonly TCP 443 for TLS. |
| Least-privilege controls | Dedicated anon_root, world-readable files and disabled write directives. |
Per-user accounts, directory restrictions and SSH keys can provide granular control. | Web-server roots, URL permissions and authentication policies provide control. |
| Client compatibility | Works with FTP clients but may be blocked or mishandled by modern networks. | Supported by SSH/SFTP clients and administration tools. | Works naturally in browsers and standard download tools. |
Choose anonymous FTP when the files are intentionally public, legacy FTP compatibility is required, and you can control the passive-port and firewall design. Choose SFTP when transfer security or authenticated access matters. Choose HTTPS when browser delivery and simple public links are more important than FTP protocol compatibility. vsftpd also has TLS/FTPS controls, including certificate and anonymous-SSL enforcement settings, but enabling them requires deliberate certificate deployment and client testing; it is not a consequence of enabling anonymous FTP.
Quick Recap
Final deployment checklist
- vsftpd is installed and enabled with systemd.
- The anonymous root is a dedicated directory containing only approved public files.
anonymous_enable=YESis set, while local logins are disabled if they are not required.write_enable=NO,anon_upload_enable=NO,anon_mkdir_write_enable=NOandanon_other_write_enable=NOare all effective after includes are processed.- Published files are world-readable and every parent directory is searchable by the FTP process.
dirlist_enable=YES,download_enable=YESand transfer logging are enabled.- TCP 21 and the exact passive range are open on the host firewall and every upstream firewall.
pasv_addressis set when NAT requires a reachable public address.- An external client can list and download, while upload, delete, rename and directory creation are rejected.
- Everyone who needs confidential or authenticated transfer has been directed to SFTP or another encrypted service instead.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
