Set Up an FTP Server on Ubuntu with vsftpd

Install vsftpd

sudo apt update && sudo apt upgrade -y
sudo apt install vsftpd

Configure vsftpd

Back up the original file and edit it:

sudo cp /etc/vsftpd.conf /etc/vsftpd.conf.bak
sudo nano /etc/vsftpd.conf

Main options:

1. anonymous_enable allows or blocks anonymous logins. Set it to NO.
2. local_enable lets local system users log in. Set it to YES.
3. write_enable allows uploads and changes. Set it to YES.
4. anon_root is the folder for anonymous users.
5. local_root is the folder for local users.
6. chroot_local_user locks users in their home folder.

Recommended settings:

anonymous_enable=NO
local_enable=YES
write_enable=YES
chroot_local_user=YES
allow_writeable_chroot=YES

allow_writeable_chroot=YES is needed when the user's home folder is writable. A safer layout is to make the home folder read-only and give the user a writable sub-folder (see below).

Restart the service:

sudo systemctl restart vsftpd
sudo systemctl enable vsftpd

Create an FTP user

sudo adduser ftpuser

Enter a strong password. To make a user who cannot log in by SSH, use the nologin shell, and add that shell to /etc/shells:

echo /usr/sbin/nologin | sudo tee -a /etc/shells
sudo usermod -s /usr/sbin/nologin ftpuser

Set the permissions

Make a folder for uploads:

sudo mkdir -p /home/ftpuser/files
sudo chown ftpuser:ftpuser /home/ftpuser/files

If you do not use allow_writeable_chroot, make the home folder not writable:

sudo chmod a-w /home/ftpuser

Open the firewall

sudo ufw allow 20/tcp
sudo ufw allow 21/tcp

For passive mode add to vsftpd.conf:

pasv_enable=YES
pasv_min_port=40000
pasv_max_port=40100

and open that range:

sudo ufw allow 40000:40100/tcp

Restart vsftpd.

Connect

Use an FTP client such as FileZilla:

• Host: the server IP
• User: ftpuser
• Password: the user's password
• Port: 21

Quick recap

• Install vsftpd, disable anonymous logins and lock users in their home.
• Open ports 20, 21 and the passive range.