Free tools Windows power users keep installed
One-click scans. No signup required.
To secure vsftpd on an Ubuntu VPS, install the service, give it a certificate for the server’s DNS name, enable TLS in /etc/vsftpd.conf, require TLS for local logins and data transfers, define a bounded passive-port range, and open the control and passive ports in both firewalls. Restart vsftpd, then connect with explicit FTPS and test authentication, directory listing, uploads, and downloads.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
FTPS is FTP protected by TLS. It is not SFTP, which carries an FTP-like session through SSH and uses different account and firewall arrangements.
As an Amazon Associate I earn from qualifying purchases.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhat this setup provides
vsftpd can protect both parts of an FTP session with OpenSSL: the control connection used for commands and authentication, and the separate data connections used for directory listings and file transfers. The ssl_enable=YES setting turns on that capability when the Ubuntu package was compiled with OpenSSL.
This guide uses explicit FTPS. The client first connects as FTP on the ordinary control port and then requests TLS. Implicit FTPS is a different compatibility mode in which TLS is expected immediately; use it only when a client or policy specifically requires it.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
FTP data connections make firewall planning important. A successful TLS handshake does not prove that listings or transfers will work: those operations use a separate connection, normally negotiated through passive mode.
Decide the certificate, users and network policy first
Use a name that matches the certificate
Choose the DNS name clients will enter, such as ftp.example.com, and issue the certificate for that name. Clients validate the name presented during TLS; connecting by an unrelated IP address can therefore produce a name-mismatch warning even when the certificate is otherwise valid.
Choose a public or private certificate
| Choice | When it fits | Operational consequence |
|---|---|---|
| Public CA certificate | Internet-facing VPS used by ordinary desktop, mobile or third-party clients | Major clients already trust the issuing chain, so users do not have to install a private root certificate. |
| Self-signed certificate | Closed testing environments where you control every client | Each client must trust the certificate manually; Ubuntu does not recommend this for production. |
Ubuntu recommends Let’s Encrypt for internet-facing servers. ACME HTTP-01 validation requires port 80 to be reachable while the challenge is answered. Certbot places issued material under /etc/letsencrypt/live/<domain>/; the private key is privkey.pem and the certificate chain normally used by clients is fullchain.pem.
Plan local accounts
FTPS can be useful when users need file transfer but should not receive an interactive shell. Decide which local Unix accounts may log in, where their home directories are, and whether they should be confined there with chroot. If an account uses /usr/sbin/nologin, PAM’s pam_shells.so can reject it unless that shell is listed in /etc/shells.
Choose a passive range
Select a small, unused TCP range for passive data connections. The exact numbers depend on your provider and other services; what matters is that the same lower and upper ports are configured in vsftpd, allowed by the VPS provider’s network firewall, and allowed by the host firewall.
Install vsftpd and make a safe configuration copy
- Update package metadata and install the server:
sudo apt update sudo apt install vsftpd - Preserve the original configuration before editing it:
sudo cp /etc/vsftpd.conf /etc/vsftpd.conf.orig - Open the main file in an editor:
sudo nano /etc/vsftpd.conf
Ubuntu uses /etc/vsftpd.conf as the primary configuration file. Settings already present in the file may be commented out with a leading semicolon; remove that character when enabling an existing directive, and ensure you do not leave conflicting duplicate values.
After installation, inspect the unit before making it reachable from the internet. sudo systemctl status vsftpd.service confirms whether the daemon started, while the journal identifies syntax errors, missing files, or permission problems. Keeping the untouched copy makes a rollback possible if an edit prevents startup.
Obtain and install a certificate
Production certificate with Let’s Encrypt
Point the chosen DNS name at the VPS and make port 80 reachable for ACME HTTP-01 validation. Install and run Certbot using Ubuntu’s current package guidance, then confirm that the resulting files exist below /etc/letsencrypt/live/<domain>/. The certificate is valid for 90 days. Certbot normally installs a systemd renewal timer, but vsftpd still needs to reload or restart after a renewed certificate is written.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
For services that Certbot does not reload through a built-in web-server plugin, configure a renewal deploy hook. A deploy hook runs only after a successful renewal and can call systemctl reload vsftpd or, where reload behavior is unsuitable, restart the service. For example, create a root-owned executable hook under /etc/letsencrypt/renewal-hooks/deploy/ containing a command such as systemctl reload vsftpd.service. Test the hook in a maintenance window and check the service journal after the next renewal.
Testing certificate
A self-signed certificate can confirm that TLS negotiation works on an isolated test VPS. Expect normal clients to display a trust warning until you distribute and trust that certificate. Replace it with a CA-issued certificate before exposing the service to users or the public internet.
Recommended Free Tools
Certificate and key details
Use fullchain.pem for the certificate path when clients need the issuing chain and privkey.pem for the private-key path. The private key is sensitive: limit read access to the service and administrative accounts, and never place it in a user-downloadable directory. If vsftpd cannot read either path, it may fail to start or be unable to negotiate TLS. A renewed file is not used by existing daemon processes until the service is reloaded or restarted.
Enable TLS and require it for local sessions
Add or update the following directives in /etc/vsftpd.conf. Replace the example hostname with the name covered by your certificate.
ssl_enable=YES
rsa_cert_file=/etc/letsencrypt/live/ftp.example.com/fullchain.pem
rsa_private_key_file=/etc/letsencrypt/live/ftp.example.com/privkey.pem
force_local_logins_ssl=YES
force_local_data_ssl=YES
allow_anon_ssl=NO
ssl_sslv2=NO
ssl_sslv3=NO
ssl_tlsv1_2=YES
ssl_tlsv1_3=YES
local_enable=YES
write_enable=YES
chroot_local_user=YES
pasv_min_port=40000
pasv_max_port=40100The passive values above are an example of a bounded range, not a universal requirement. Select a range suitable for your VPS and use those exact values in every firewall layer.
What the TLS directives do
ssl_enable=YESenables OpenSSL-protected control and data connections when supported by the installed build.rsa_cert_fileidentifies the server certificate chain;rsa_private_key_fileidentifies its private key. Keep the key readable only by the accounts that must use it.force_local_logins_ssl=YESrejects local-account authentication attempted without TLS.force_local_data_ssl=YESrejects local-account listings and transfers that are not protected.allow_anon_ssl=NOprevents anonymous TLS sessions. Do not enable anonymous access unless you have a separate, documented reason and understand its exposure.ssl_sslv2=NOandssl_sslv3=NOdisable obsolete protocol versions.ssl_tlsv1_2=YESandssl_tlsv1_3=YESpermit current TLS versions supported by the linked OpenSSL library.local_enable=YESallows Unix accounts to authenticate.write_enable=YESis required for operations that modify files, subject to filesystem permissions.
The vsftpd manual places responsibility for the security of the installed OpenSSL library on the administrator. Keep Ubuntu packages and security updates current.
Prevent accidental configuration drift
Keep one authoritative value for each directive. A later duplicate line can override an earlier one and make troubleshooting confusing. Record the selected certificate name, passive range, allowed accounts, and firewall rules alongside your normal server documentation. That record is especially useful when another administrator renews the certificate or adds a client.
Confine accounts and handle shell restrictions
Home-directory isolation
chroot_local_user=YES places local users in a filesystem jail rooted at their home directory. Ubuntu documents that chroot_list_file has inverse behavior when chrooting is enabled, so read its installed man page before adding exceptions: depending on the combination, the list can identify users who are jailed or users who are exempt.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Accounts with nologin
Using /usr/sbin/nologin for a transfer-only account prevents interactive shell access, but PAM may reject that account through pam_shells.so. If that occurs, add the exact shell path to /etc/shells, then retry authentication. Do not change a user’s shell to grant more access than intended.
Filesystem permissions
Chrooting does not grant write permission. The Unix owner, group and mode bits on the home directory and its upload subdirectories still determine whether an upload, rename or deletion succeeds. Test with a least-privilege account rather than an administrator account.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Separate upload directories from application or system files when possible. Verify the account’s home path, ownership, and available space before blaming TLS for a failed transfer. A successful login proves only that authentication worked; it does not imply that the account can create, overwrite, or remove files.
Configure passive FTP and both firewalls
In passive mode, the client opens the data connection to a port selected by vsftpd. Configure the same bounded range shown in the file and permit it in every network layer between the client and VPS.
- In
/etc/vsftpd.conf, setpasv_min_portandpasv_max_portto your selected lower and upper ports. - In the VPS provider’s security-group or network firewall, allow TCP port 21 for explicit FTPS control traffic and allow the complete passive range.
- In Ubuntu’s host firewall, apply matching rules. For the illustrative range above:
sudo ufw allow 21/tcp sudo ufw allow 40000:40100/tcpUse your chosen range instead of the example if it differs.
- Reload or enable the firewall according to your provider’s procedure, then verify that the rules are present.
A mismatch causes the classic symptom “TLS connects, but directory listing hangs” or “file transfer fails.” Opening only port 21 is insufficient because the data channel uses the passive ports.
Do not open a broad, arbitrary block merely because it is convenient. A narrow range is easier to audit and reduces the number of exposed listening destinations. Ensure no other service claims the same ports, and coordinate the range with both the provider firewall and UFW so a packet is not accepted by one layer and dropped by another.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Restart vsftpd and verify the complete path
- Restart the service after configuration changes:
sudo systemctl restart vsftpd.service - Check its state and recent log messages:
sudo systemctl status vsftpd.service sudo journalctl -u vsftpd.service -n 50 --no-pager - In an FTP client, select FTP over explicit TLS/SSL (often labelled FTPES), not plain FTP and not SFTP.
- Enter the certificate hostname as the server name, the local username and password, and passive transfer mode if the client offers a choice.
- Confirm that the client validates the certificate name and chain without a warning.
- Authenticate, list the home directory, download a small file, upload a small file, and delete the test upload if appropriate.
- Repeat a listing and transfer from a network outside the VPS provider’s internal network. This verifies the public firewall path rather than only local reachability.
These checks exercise TLS negotiation, account authentication, chroot and Unix permissions, the control channel, and the separate passive data channel.
Using common clients
In FileZilla, create a site with the protocol set to FTP and encryption set to FTPES – FTP over explicit TLS/SSL. Use the DNS name on the certificate, port 21, the local credentials, and passive transfer mode. Ubuntu’s documentation also notes that lftp supports FTPS, making it useful for scripted or repeatable checks. Regardless of client, inspect the negotiated certificate and verify that the data connection is encrypted rather than testing only the initial login.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Client choices: explicit FTPS, implicit FTPS and SFTP
| Protocol or mode | Connection behavior | Use it when |
|---|---|---|
| Explicit FTPS | Starts as FTP, then upgrades the control and data connections to TLS. | It is the default for this guide and generally the easiest mode to deploy with existing FTP clients. |
| Implicit FTPS | Expects TLS immediately instead of negotiating an upgrade. | A legacy or managed client specifically requires it; coordinate its distinct listener and firewall policy before switching. |
| SFTP | Runs an FTP-like file-transfer session through SSH, not through vsftpd. | Use it when SSH account management is already in place or when clients support SFTP and do not need the FTP protocol. |
Ubuntu’s documentation emphasizes that FTPS and SFTP are different protocols. An account permitted to use SFTP may have SSH-related access that you did not intend for an FTP-only account, while FTPS can serve users whose shell remains disabled.
Changing a client from explicit to implicit mode is not a harmless checkbox change. The server-side listener and firewall policy must match the selected mode, and a client configured for one mode will commonly fail against a server expecting the other. Keep the mode documented for each external partner.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshoot by symptom
The service fails to start
Run systemctl status and inspect the journal for a misspelled directive, duplicate setting, unreadable certificate path or malformed configuration. Verify that both certificate files exist and that the private-key path is correct. Restore the saved configuration copy only as a rollback, then reapply changes one at a time.
The client reports an untrusted or wrong certificate
Make sure the client connects using the DNS name present in the certificate, that rsa_cert_file points to the full chain, and that the certificate has not expired. A self-signed certificate will remain untrusted until the client explicitly trusts it.
Login is rejected before a password prompt completes
Confirm local_enable=YES, that the Unix account exists and has a valid password, and that its shell is accepted by PAM. For /usr/sbin/nologin accounts, check /etc/shells as described above. Also check whether force_local_logins_ssl=YES is correctly sending the client into explicit TLS mode.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsLogin works but directory listing or transfers time out
Check that the client is using passive mode, then compare the client’s negotiated port with the configured pasv_min_port–pasv_max_port range. Permit that complete range in both the provider firewall and UFW. A control connection on port 21 alone cannot carry the passive data channel.
Listing works but uploads fail
Inspect ownership and mode bits on the target directory, confirm write_enable=YES, and test whether the chrooted user has write permission in that specific path. TLS protects the transfer; it does not override Unix authorization.
A renewed certificate is not visible
Check the Certbot renewal timer and the modification time under /etc/letsencrypt/live/<domain>/. If the files changed but clients still receive the old certificate, add or correct a deploy hook that reloads or restarts vsftpd after successful renewal.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Plain FTP still appears to work
Test with a client that explicitly requests TLS and confirm that an unencrypted login is rejected. The force_local_logins_ssl and force_local_data_ssl settings apply to local accounts; verify that anonymous access is disabled and that your client is not silently falling back to plain FTP.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Operational checklist
- Use a certificate issued for the exact DNS name clients enter.
- Keep SSLv2 and SSLv3 disabled and allow the current TLS versions supported by the installed OpenSSL.
- Require TLS for both local authentication and local data channels.
- Disable anonymous TLS unless it is explicitly needed.
- Use a narrow, documented passive range and mirror it in provider and host firewalls.
- Confine local users where appropriate and verify PAM behavior for nologin shells.
- Test a listing, download and upload from an external network after every firewall or certificate change.
- Monitor 90-day certificate renewal and reload vsftpd through a successful-renewal deploy hook.
With those pieces aligned, explicit FTPS provides encrypted FTP control and data traffic on an Ubuntu VPS while preserving FTP-compatible clients and allowing account isolation without granting shell access.
Frequently Asked Questions
What certificate does vsftpd need?
Use a certificate issued for the DNS name clients enter, with the matching private key. For a public VPS, Ubuntu recommends a trusted CA such as Let’s Encrypt; configure fullchain.pem and privkey.pem in vsftpd.conf.
Which ports must be open for passive FTPS?
Allow TCP port 21 for explicit FTPS control traffic and every port in the configured pasv_min_port through pasv_max_port range. The provider firewall and Ubuntu firewall must contain matching rules.
Why does FTPS connect but directory listing fail?
The TLS control connection succeeded, but the separate passive data connection is blocked or outside the permitted range. Enable passive mode in the client and compare the negotiated port with both firewall configurations.
Should I use FTPS or SFTP?
FTPS preserves the FTP protocol and can work with accounts that have no interactive shell. SFTP runs through SSH and may be simpler when SSH account management is already established. They are separate protocols.
Can I use a self-signed certificate?
Yes for an isolated test environment where every client can be configured to trust it. Ubuntu does not recommend self-signed certificates for production because ordinary clients will show trust warnings.
How do I force encrypted logins and transfers?
Set ssl_enable=YES, force_local_logins_ssl=YES, and force_local_data_ssl=YES. Disable anonymous TLS unless it is explicitly required, then restart vsftpd.
Why is a user with /usr/sbin/nologin rejected?
PAM’s pam_shells.so may reject shells not listed in /etc/shells. Add the exact /usr/sbin/nologin path when appropriate, without granting the account an interactive shell.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallHow often must the certificate be renewed?
Let’s Encrypt certificates are valid for 90 days. Certbot installs a systemd renewal timer, and a deploy hook should reload or restart vsftpd after a successful renewal so the daemon serves the new certificate.
The Bottom Line
Install vsftpd, use a hostname-matching CA certificate, require TLS for local logins and data, bound and open the passive range in both firewalls, and test explicit FTPS from outside the VPS network. Keep renewals hooked to a vsftpd reload and treat FTPS and SFTP as different protocols.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
