Ultimate Guide to vsftpd: Configuration Files, Commands, and Secure SFTP Migration

The File Transfer Protocol (FTP) is a foundational network protocol used to transfer files between a client and a server on a computer network. It operates on the client-server model and is defined in RFC 959.

1.1 The Two Connection Channels
FTP is unique because it uses two separate TCP connections for a single session:

Control Connection (TCP Port 21):

Purpose: Handles commands, replies, authentication (username/password), and session management.

Nature: Stays open for the entire duration of the session.

Data Format: Uses NVT ASCII (Network Virtual Terminal ASCII) for commands.

Data Connection (TCP Port 20 or Variable):

Purpose: Transfers the actual file data and directory listing contents.

Nature: Is transient—it opens for a single transfer (upload or download) and immediately closes afterward.

---

1.2 Data Transfer Modes
The most complex part of FTP is how the Data Connection is established, which is governed by the connection mode:

Mode	Data Connection Initiator	Control Channel Command	Data Channel Port	Firewall Complexity
Active Mode	The Server connects back to the Client.	PORT	Server uses Port 20 (source).	Difficult for clients behind a firewall.
Passive Mode	The Client connects to the Server.	PASV	Server opens a random high port (e.g., 40000+).	Easier for clients; essential for servers to define a port range.

---

2. vsftpd: The Daemon and Its Files
vsftpd (Very Secure FTP Daemon) is the most popular, stable, and security-focused FTP server software for Linux systems.

2.1 Daemon and Service
Daemon: vsftpd (the executable program running in the background).

Default Service Port: TCP 21 (for the Control Channel).

Management: On modern Linux distributions (like Ubuntu, CentOS 7+), it is managed by systemd.

Start/Stop: sudo systemctl start vsftpd

Status Check: sudo systemctl status vsftpd

Enable at Boot: sudo systemctl enable vsftpd

2.2 Core Configuration Files
The primary file is a simple list of directive=value settings.

File Path	Description
/etc/vsftpd.conf	Main Configuration File. Controls all server behavior, ports, user access, and security policies.
/etc/ftpusers	A list of users that are explicitly denied access to the FTP server (often includes root and other system accounts).
/etc/vsftpd.userlist	A configurable list of users that can either be allowed or denied access, depending on a directive in vsftpd.conf.
/var/log/vsftpd.log	The default location for connection and activity logs (file transfers, login attempts).

---

3. Practical vsftpd Configuration Examples
To configure a basic, working FTP server for local Linux users:

Step 3.1: Enabling Basic Access and Writes
In the /etc/vsftpd.conf file, ensure these lines are set:

# Start the server in standalone mode (not run by inetd)
listen=YES


# Deny anonymous login
anonymous_enable=NO

# Allow local system users (from /etc/passwd) to log in
local_enable=YES

# Allow users to upload, delete, and create files/directories
write_enable=YES

Step 3.2: Implementing Security (Chroot Jail)
The Chroot Jail is paramount. It locks users into their home directories, preventing them from navigating the rest of the server's file system.

# **CRITICAL SECURITY STEP:** Chroot all local users to their home directories
chroot_local_user=YES

# Required on some newer vsftpd versions when chroot is enabled and write_enable=YES
# This allows the jailed user's home directory to be writable
allow_writeable_chroot=YES

Step 3.3: Configuring Passive Mode (for Firewall Compatibility)
Passive Mode is standard today. It requires defining a range of high ports to be opened on your server's firewall.

# Enable Passive Mode
pasv_enable=YES

# Define the minimum port for the data connection
pasv_min_port=40000

# Define the maximum port for the data connection
pasv_max_port=50000

Action Required: You must ensure your server's firewall (e.g., iptables, firewalld, ufw) permits inbound TCP traffic on Port 21 and the entire range of Ports 40000-50000.

---

4. Security and Other Advanced Aspects
Once the server is configured and working, you must focus on security.

4.1 Security Level 1: Hardening vsftpd

Aspect	vsftpd Directive	Purpose
User Listing	userlist_enable=YES userlist_deny=NO userlist_file=/etc/vsftpd.userlist	This creates an allow list: only users listed in /etc/vsftpd.userlist can log in, greatly restricting access.
Data Rate	local_max_rate=500000	Limits the transfer speed for local users to 500 KB/s to prevent resource starvation.
Timeouts	idle_session_timeout=300	Disconnects inactive clients after 300 seconds (5 minutes) to free resources.
Logging	xferlog_enable=YES xferlog_file=/var/log/vsftpd.log	Ensures all file transfers are logged, crucial for auditing and security monitoring.

4.2 Security Level 2: Mandatory Encryption (The Upgrade)
Plain FTP is a massive risk. The immediate security upgrade is to require encryption:

FTPS (FTP over TLS/SSL): This is the native, encrypted mode supported directly by vsftpd. It uses certificates to encrypt the communication on both the control and data channels.

Setup: Requires generating or installing an SSL/TLS certificate and setting directives like ssl_enable=YES and force_local_logins_ssl=YES in vsftpd.conf.

Drawback: It is still based on the complex two-channel architecture, making firewall management difficult.

SFTP (Secure File Transfer Protocol): This is the preferred modern standard. It is an entirely different protocol that runs over the single-port SSH connection (Port 22).

Setup: Requires no additional software if you already run SSH (sshd).

Advantages: Single port (Port 22) simplifies firewalls, and it is inherently more secure, leveraging SSH's strong encryption and key-based authentication methods.

4.3 Other Theoretical Aspects
FTP Commands: The interaction is based on command verbs (e.g., USER, PASS, RETR, STOR, LIST) sent over the control channel.

Data Representation: You define the file type using the TYPE command: ASCII (for text files, handling newline conversion) or IMAGE/BINARY (for all other files).

Anonymous FTP: A historical practice that allows public access with the username anonymous and any email address as the password. This is generally disabled on private servers (anonymous_enable=NO).

---

Server Setup: VSFTPD Installation and Configuration
We'll install vsftpd and configure it to allow a local user to log in and upload files, while being secured by the Chroot Jail.

Step	Action on Server (Linux Shell)	Command/Explanation
1. Install	Install the vsftpd package.	sudo apt update && sudo apt install vsftpd
2. Backup Config	Create a safety copy of the default config file.	sudo cp /etc/vsftpd.conf /etc/vsftpd.conf.orig
3. Create User	Create a dedicated system user for FTP access (e.g., ftpuser).	sudo adduser ftpuser
4. Configure VSFTPD	Open the configuration file for editing.	sudo nano /etc/vsftpd.conf
5. Apply Core Settings	Core Directives (Add/Change): • anonymous_enable=NO • local_enable=YES • write_enable=YES • chroot_local_user=YES • allow_writeable_chroot=YES	Ensure these directives are set (or uncomment/change existing ones). 🔒 Jail users to their home directory and allow writes.
6. Set Passive Ports	Define the port range for the data connection.	pasv_min_port=40000 pasv_max_port=50000
7. Restart Service	Apply the configuration changes.	sudo systemctl restart vsftpd
8. Firewall	Open Ports:	sudo ufw allow 20,21/tcp sudo ufw allow 40000:50000/tcp
9. Test File	Create a test file inside the user's home directory.	sudo -u ftpuser touch /home/ftpuser/README.txt

1. Client Interaction: Getting Files via FTP Now, from a separate client machine on the same network, we will connect to the server and download the file. (Assume your server's IP is 192.168.1.100).

Step	Action on Client (Any System Shell)	Command and Expected Output/Action
1. Initiate Connection	Use the standard ftp client command with the server's IP address.	ftp 192.168.1.100
2. Login	Enter the username and password created on the server.	Connected to 192.168.1.100. Name (192.168.1.100:user): ftpuser Password: (Input password here) 230 Login successful.
3. Check Directory	Use the LS command to see the contents of the remote directory.	ftp> LS 200 PORT command successful. 150 Here comes the directory listing. README.txt 226 Directory send okay.
4. Set Transfer Mode	Specify Binary mode (best practice for any file type).	ftp> BINARY 200 Type set to I.
5. Download File	Use the GET command to download the test file.	ftp> GET README.txt 200 PORT command successful. 150 Opening BINARY mode data connection for README.txt 226 Transfer complete.
6. Verification	Use the local shell command (!) to check if the file is now on your client machine.	ftp> ! ls README.txt
7. Cleanup	End the FTP session.	ftp> QUIT 221 Goodbye.

Thanks for reading the post. Please share your experiences and do like it.