iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
To secure vsftpd on an Ubuntu VPS, install the server, give it a certificate whose name matches your FTP hostname, enable TLS in /etc/vsftpd.conf, require TLS for local logins and data transfers, define a small passive-port range, open the matching ports in every firewall, and connect with explicit FTPS. The result is FTP protected by TLS (often called FTPES), not SFTP: SFTP is an SSH-based protocol with different account and server requirements.
What you are configuring
vsftpd can protect both parts of an FTP session with OpenSSL. The control connection carries commands such as authentication and directory requests; a separate data connection carries directory listings and file contents. TLS must be negotiated on the control connection and, when required, on each data connection. A setup that encrypts only the login channel can still expose transferred files, so the configuration below enables and requires both.
Ubuntu’s terminology matters:
| Protocol or mode | How encryption starts | When it is appropriate |
|---|---|---|
| Explicit FTPS (FTPES) | The client first reaches the normal FTP service and then requests TLS (typically with AUTH TLS). |
Default choice for a new vsftpd deployment; it uses the normal FTP control port and is supported by common clients. |
| Implicit FTPS | TLS is expected immediately when the client connects. | Use only when a legacy integration specifically requires it; client and firewall settings differ from explicit mode. |
| SFTP | An SSH subsystem carries file operations inside an SSH connection. | Often simpler when SSH access is already administered, but it is not an FTP mode and does not use vsftpd. |
FTPS can be useful when an existing FTP workflow, client, or account policy must be retained. It can also serve users whose accounts are not allowed to open an interactive shell. SFTP may be preferable when you control both ends and already operate SSH, but switching protocols changes users’ connection settings and server-side controls.
Prerequisites and a safe rollout plan
- An Ubuntu VPS with administrative access through
sudo. - A DNS name for the service, such as
ftp.example.com, pointing to the VPS. The name should be the same name clients use when validating the certificate. - A plan for the firewall at both layers: the VPS provider’s network firewall and the operating system firewall (if enabled).
- Local Unix accounts for people who will use FTP. Anonymous access is disabled in the configuration shown here.
- A certificate and private key. For an internet-facing production server, use a certificate issued by a public CA; Ubuntu recommends Let’s Encrypt for this purpose. A self-signed certificate is suitable only when you can deliberately distribute and maintain trust on every client.
Take a copy of the original configuration before editing:
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
sudo cp /etc/vsftpd.conf /etc/vsftpd.conf.bakKeep the backup outside any automated editing workflow, and record the hostname, passive-port range, and firewall rules you intend to deploy. Those three values must agree across the client-facing path.
Install vsftpd and inspect the service
- Refresh Ubuntu’s package metadata and install the server:
sudo apt update sudo apt install vsftpd - Open the main configuration file:
sudo nano /etc/vsftpd.confUbuntu uses this file for the service’s primary settings. Existing lines may be commented out with
#; an active setting later in the file can override an earlier one, so remove duplicate active directives when you change a value. - Check that the service is present before making client changes:
systemctl status vsftpd.serviceThe service will be restarted after the TLS, user, and passive-mode settings are complete.
Obtain a certificate that vsftpd can use
Public certificate for a production VPS
Request the certificate for the exact DNS name clients will enter. Ubuntu recommends Let’s Encrypt for internet-facing servers. Its ACME HTTP-01 challenge requires port 80 to be reachable during validation. Certbot places the resulting files in a path such as /etc/letsencrypt/live/ftp.example.com/; the two files vsftpd needs are the certificate chain and private key:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →fullchain.pem— the server certificate followed by the issuing chain.privkey.pem— the private key; protect it from non-administrative users.
Certificates issued by Let’s Encrypt are valid for 90 days. Certbot normally installs an automatic renewal timer, but renewal alone does not make an already-running vsftpd process reread the new key. Add a deploy hook that restarts or reloads vsftpd only after a successful renewal. For example, create an executable hook at /etc/letsencrypt/renewal-hooks/deploy/restart-vsftpd.sh containing:
#!/bin/sh
systemctl restart vsftpd.serviceThen set its ownership and mode so only administrators can alter it:
sudo chown root:root /etc/letsencrypt/renewal-hooks/deploy/restart-vsftpd.sh
sudo chmod 750 /etc/letsencrypt/renewal-hooks/deploy/restart-vsftpd.shTest your renewal process in the manner supported by your Certbot installation before relying on it. The important operational check is that a completed renewal is followed by a vsftpd restart and that clients can still negotiate TLS.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Self-signed certificate for a controlled test
A self-signed certificate can prove that the TLS configuration works, but ordinary clients will display a trust warning. Ubuntu does not recommend this approach for production. If you use one temporarily, install the certificate into the trust store of each test client or explicitly accept the warning, and replace it with a CA-issued certificate before exposing the service to general users.
Enable TLS and require it for local users
Add or update the following directives in /etc/vsftpd.conf. The certificate paths below assume a Let’s Encrypt certificate for ftp.example.com; change the hostname to yours.
ssl_enable=YES
rsa_cert_file=/etc/letsencrypt/live/ftp.example.com/fullchain.pem
rsa_private_key_file=/etc/letsencrypt/live/ftp.example.com/privkey.pem
force_local_logins_ssl=YES
force_local_data_ssl=YES
allow_anon_ssl=NO
ssl_sslv2=NO
ssl_sslv3=NO
ssl_tlsv1_2=YES
ssl_tlsv1_3=YESssl_enable=YESenables OpenSSL-protected control and data connections when vsftpd was built with OpenSSL.rsa_cert_fileidentifies the certificate chain andrsa_private_key_fileidentifies its private key.force_local_logins_ssl=YESrejects a local-user login that has not been protected with TLS.force_local_data_ssl=YESrequires TLS on directory listings and file transfers for local users.allow_anon_ssl=NOprevents anonymous users from using SSL. Keep anonymous access disabled unless you have a documented, separate requirement for it.- The protocol switches disable SSLv2 and SSLv3 and enable TLS 1.2 and TLS 1.3. The security of the OpenSSL library installed on the VPS remains the administrator’s responsibility, so keep Ubuntu security updates current.
Do not put the private key in a web directory or a user’s home directory. The privileged vsftpd process must be able to read it, while ordinary accounts should not. If you move the key, update the path in the configuration and verify permissions before restarting.
Restrict users and their filesystem view
Chroot local accounts
To keep local users inside their home directories, enable:
chroot_local_user=YESWith this setting, users are chrooted by default. The interaction with chroot_list_file is easy to misread: when chrooting is enabled, accounts listed in that file are treated inversely to the default. Decide explicitly whether the file is an exception list, create it if you use one, and test one account from each category.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Chrooting is an isolation measure, not a substitute for Unix permissions. Set ownership and mode on upload directories so users can write only where intended, and avoid making a chroot’s top directory broadly writable.
Accounts with a non-login shell
Many administrators assign FTP-only accounts a shell such as /usr/sbin/nologin. Ubuntu’s PAM stack may use pam_shells.so, which rejects a user whose shell is not listed in /etc/shells. If such an account cannot authenticate, add the chosen shell to /etc/shells only after confirming that this matches your access policy:
grep -qxF /usr/sbin/nologin /etc/shells ||
sudo sh -c 'printf "%sn" /usr/sbin/nologin >> /etc/shells'Alternatively, assign a shell already permitted by your policy. The key point is to align the account’s shell, PAM checks, and your intention that the account not receive interactive SSH access.
Configure passive FTP networking
FTP uses a second connection for listings and transfers. In passive mode, the server tells the client which port to connect to, so opening only the control port is insufficient. Define a narrow, dedicated range in /etc/vsftpd.conf:
pasv_min_port=40000
pasv_max_port=40100The numbers above are an example range, not a universal requirement. Choose a range appropriate for your concurrent-session needs and your provider’s firewall controls. A bounded range is easier to audit than allowing thousands of ephemeral ports, but it must be large enough for the number of simultaneous passive data connections you expect.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
If the VPS has a public address directly on its interface, clients can normally use that address. If it sits behind NAT or a provider load balancer, configure the externally reachable address using the relevant vsftpd passive-address setting for that topology and ensure the forwarding device sends the entire range to the VPS. Do not guess this value: a server advertising an unreachable private address produces the classic “login succeeds, directory listing hangs” symptom.
Open the matching firewall ports
Permit the normal FTP control port and exactly the passive range in every firewall between the client and the VPS. With UFW on Ubuntu, an example is:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
sudo ufw allow 21/tcp
sudo ufw allow 40000:40100/tcp
sudo ufw statusApply equivalent rules in the VPS provider’s security group or network firewall. If your provider has a separate inbound policy, an operating-system rule alone will not help. Conversely, a provider rule cannot override a host firewall that blocks the traffic.
Do not open port 20 merely because traditional active FTP uses it; passive FTPS clients connect to the negotiated passive range instead. If you intentionally support active mode for a legacy client, document and firewall that design separately rather than broadening the passive rule.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Restart vsftpd and connect with explicit FTPS
- Save the configuration and restart the service:
sudo systemctl restart vsftpd.serviceIf the restart fails, inspect the service status and system journal before changing client settings. A misspelled directive, an unreadable key, or a certificate path that does not exist prevents startup.
- In the FTP client, select FTP over explicit TLS/SSL (often labelled FTPES), not plain FTP. Use the normal FTP control port unless your environment has deliberately changed it.
- Enter the VPS hostname, a local username, and its password. Reject the connection if the certificate name does not match the hostname you entered, unless you are knowingly testing a self-signed certificate.
- After authentication, list a directory. This tests the TLS-protected data channel and passive networking, not just the login.
- Upload a small file, download it to a different local name, and verify its contents. Test both directions because directory permissions often differ for reads and writes.
- Remove the test file and record the successful client mode, hostname, and passive behavior for future troubleshooting.
Command-line users can use an FTP client with FTPS support such as lftp; select its explicit TLS mode and verify the certificate according to your trust policy. Graphical clients commonly expose the same choice as “FTPES – FTP over explicit TLS/SSL.”
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Troubleshoot the failures that matter most
“Connection refused” or the service will not start
- Run
systemctl status vsftpd.serviceand inspect the journal for the first error. - Confirm that
ssl_enable=YESis supported by the installed build and that both certificate paths exist. - Check that the private key is readable by the privileged vsftpd process and has not been replaced by a broken symlink.
- Verify that another service is not already bound to the FTP control port.
Login works without TLS or the client reports a plain-FTP requirement
Ensure the client is set to explicit TLS and that force_local_logins_ssl=YES is active, not commented out or overridden later in the file. A client configured for implicit FTPS will not negotiate the same way as an explicit client.
Login succeeds but the directory listing hangs or times out
- Confirm the client is using passive mode.
- Compare
pasv_min_portandpasv_max_portwith the provider firewall and UFW rules character for character. - Check whether the server advertises a private or stale address because of NAT or a load balancer.
- Temporarily test a single small file only after the passive path is corrected; repeatedly widening the firewall is not a reliable fix.
Directory listing works but uploads fail
This usually indicates Unix permissions or a read-only target directory rather than TLS. Check the destination directory’s owner, group, mode, and available disk space. Keep the data-channel requirement enabled; do not weaken TLS to solve a filesystem problem.
Certificate warnings or a hostname mismatch
Connect using the DNS name included in the certificate, not an unrelated IP address or alias. For a public certificate, confirm the renewed files under /etc/letsencrypt/live/<domain>/ and restart vsftpd after renewal. For a self-signed certificate, distribute trust deliberately or replace it with a CA-issued certificate.
Authentication fails for an FTP-only account
Check that the account exists, its password is current, and its configured shell is compatible with PAM’s shell check. If the shell is /usr/sbin/nologin, verify that it appears in /etc/shells when your PAM policy requires that. Then test the account’s home-directory ownership and chroot behavior.
Operational security and maintenance checklist
- Use a certificate issued for the public service name; avoid self-signed certificates for ordinary production clients.
- Require TLS for both local logins and local data channels; never assume an encrypted login protects later transfers.
- Keep SSLv2 and SSLv3 disabled and apply Ubuntu updates so the linked OpenSSL library receives security fixes.
- Disable anonymous SSL and do not enable anonymous access unless you have a narrowly defined, monitored use case.
- Use chroot and Unix permissions to limit each account’s view and write access.
- Keep the passive range bounded, document it, and permit only that range in provider and host firewalls.
- Renew public certificates before their 90-day validity ends, and use a deploy hook to restart or reload vsftpd after successful renewal.
- After every configuration or certificate change, repeat a login, directory listing, upload, and download test with explicit FTPS.
FTPS, SFTP, and certificate choices: a practical decision
| Decision | Choose this when | Main trade-off |
|---|---|---|
| FTPS with explicit TLS | You need FTP protocol compatibility, separate FTP accounts, or clients that already support FTPES. | You must manage a certificate, control and passive data ports, and two firewall layers. |
| SFTP over SSH | You already manage SSH and can change client workflows and account policy. | It is a different protocol; vsftpd settings and FTP passive ports do not apply. |
| Public CA certificate | Users connect from ordinary, unmanaged clients across the internet. | Requires DNS/ACME validation and recurring renewal operations. |
| Self-signed certificate | Short-lived testing or a tightly controlled fleet where you distribute trust yourself. | Every client must trust it manually, and replacement or hostname changes require coordinated updates. |
The configuration is complete when the service starts cleanly, the certificate name is accepted, local users cannot authenticate without TLS, directory listings and transfers succeed through the bounded passive range, and renewal testing demonstrates that a new certificate is loaded without manual emergency work.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
