The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →The practical way to run FTP on an Ubuntu VPS is to install vsftpd, create a dedicated unprivileged account, confine it to a specific directory, configure a small passive-port range, and protect the session with TLS. Plain FTP exposes usernames, passwords, and file contents, so use SFTP whenever your client supports it. Keep FTP only for applications that require FTP semantics, and then use FTPS with a certificate issued for the VPS hostname.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Choose the protocol before opening a port
FTP is a file-transfer protocol built around a control connection and separate data connections. That design affects both security and firewall configuration. Ubuntu Server documentation describes FTP as a TCP protocol for downloading files and directs users who need secure transfers toward OpenSSH. The three practical choices are:
As an Amazon Associate I earn from qualifying purchases.
| Protocol | Encryption | Server software | Firewall shape | Account model | Client compatibility |
|---|---|---|---|---|---|
| Plain FTP | None by default; credentials and data are clear text | vsftpd |
Control port plus negotiated data ports | FTP/PAM users or anonymous mode | Broad legacy support |
| FTPS | FTP protected by SSL/TLS | vsftpd with TLS enabled |
Control port plus negotiated encrypted data ports | The same FTP account model, protected by TLS | FTP clients that support explicit or implicit TLS |
| SFTP | SSH-encrypted file-transfer subsystem | OpenSSH server | Usually the SSH port only | SSH accounts, which can be restricted to SFTP | Clients with SFTP support |
For a new deployment, SFTP is usually the least complicated secure option because it uses the existing SSH service and normally needs only the SSH firewall rule. If a game launcher, backup tool, or legacy integration specifically expects FTP commands, use FTPS rather than exposing plain FTP to the Internet.
Prerequisites for an Ubuntu VPS FTP service
Prepare these items before changing the server:
- A supported Ubuntu Server release with enough disk space for the files you will transfer.
- A public IP address or DNS name that clients can reach. A DNS name is preferable when you will validate a TLS certificate.
- Administrative SSH access and a separate way to recover the VPS, such as a provider console or a tested snapshot.
- A defined directory for the transfer account. Do not give an FTP account access to the whole filesystem.
- Access to both firewall layers: Ubuntu’s UFW rules and any network firewall in your VPS provider’s control panel.
- A client on a different network for final testing. A connection from the VPS itself can hide routing and passive-mode errors.
Decide whether users need downloads only or uploads as well. Upload permission is a separate choice and should be enabled only for accounts that require it.
Install and verify vsftpd
- Connect over SSH using an administrative account.
- Refresh package metadata:
sudo apt update- Install the Ubuntu package:
sudo apt install vsftpd- Check that the daemon is running:
sudo systemctl status vsftpdUbuntu packages the daemon as vsftpd, and its primary configuration file is /etc/vsftpd.conf. Keep a copy before editing so you can roll back a change:
sudo cp /etc/vsftpd.conf /etc/vsftpd.conf.backupAfter every configuration change, restart the service and inspect its status:
Free tools Windows power users keep installed
One-click scans. No signup required.
sudo systemctl restart vsftpd
sudo systemctl status vsftpdA clean status output confirms that the file parsed successfully. If the service fails, the status output and the system journal identify the invalid directive or permission problem.
Create a dedicated, least-privilege account
Do not use root, an administrative login, or a service account that owns unrelated game or system files. Create one account for the transfer job and give it access only to the directory it needs.
sudo adduser gameftpChoose a strong, unique password. The account does not need sudo membership. If your organization manages users centrally, apply the same principle there: the FTP identity should be separate from the SSH administrator identity.
Ubuntu documents /etc/ftpusers as a deny list. Before testing, confirm that the new account is not listed there:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
grep -x gameftp /etc/ftpusersNo output is expected. Never remove root or other protected system names from that deny list merely to make a login work.
Give the account a dedicated home or transfer directory. The following layout keeps the chroot directory owned by root while making only an upload subdirectory writable:
sudo mkdir -p /srv/ftp/gamefiles/upload
sudo chown root:root /srv/ftp/gamefiles
sudo chmod 755 /srv/ftp/gamefiles
sudo chown gameftp:gameftp /srv/ftp/gamefiles/upload
sudo chmod 755 /srv/ftp/gamefiles/upload
sudo usermod --home /srv/ftp/gamefiles gameftpIf existing files must be downloaded, place them beneath /srv/ftp/gamefiles and assign read permission deliberately. Avoid making the entire chroot writable; a root-owned top level with a writable subdirectory makes the boundary easier to audit.
Set a safe baseline in /etc/vsftpd.conf
Edit the configuration as root:
sudo nano /etc/vsftpd.confRetain useful distribution defaults, then ensure these settings are present and not contradicted by a later line:
Recommended Free Tools
anonymous_enable=NO
local_enable=YES
write_enable=YES
chroot_local_user=YES
pasv_enable=YES
xferlog_enable=YESWhat each setting does
anonymous_enable=NOdisables anonymous sessions. Ubuntu warns that anonymous upload on an Internet-accessible VPS can be an extreme security risk.local_enable=YESpermits authenticated local accounts such asgameftp.write_enable=YESenables write operations for authenticated users. It does not override Unix ownership and mode bits, so a user still cannot write to a directory it cannot modify.chroot_local_user=YESconfines local users to their configured home directory. They cannot browse the parent filesystem through FTP.pasv_enable=YESenables passive data connections, which are normally the most practical mode for clients behind routers and firewalls.xferlog_enable=YESrecords transfers so you can investigate unexpected activity and failed operations.
Do not add anonymous write access as a shortcut for a game community or build pipeline. Create named accounts and assign each account only the directories it needs.
Configure passive FTP and both firewalls
FTP’s control connection does not carry the file data itself. In passive mode, the client connects back to a server-selected high-numbered data port. If that port is not allowed, users may authenticate successfully but receive a timeout or a “cannot open data connection” error when listing a directory or transferring a file.
Choose a small, documented range. This example uses ports 40000 through 40100; select another unused range if it conflicts with a service on your VPS:
pasv_min_port=40000
pasv_max_port=40100If the VPS has a directly reachable public address, clients can usually discover it. When the server sits behind NAT or the daemon advertises a private interface address, set the reachable public address explicitly:
pasv_address=203.0.113.10Replace the example address with the VPS address that clients actually use. Do not advertise an internal address. If your public address changes, update this setting or use a stable DNS and a network design that keeps the advertised address valid.
Open the control port and exactly the chosen passive range in UFW:
sudo ufw allow 21/tcp
sudo ufw allow 40000:40100/tcp
sudo ufw statusApply equivalent rules in the VPS provider’s network firewall. A rule in UFW cannot compensate for a provider-level deny, and a provider rule cannot compensate for a local deny. Keep the range narrow: a larger range increases the number of exposed listening ports without improving a correctly configured transfer.
Restart after changing the range:
sudo systemctl restart vsftpdAdd TLS when FTP semantics are mandatory
Plain FTP sends usernames, passwords, commands, and file contents without encryption. Anyone able to observe the path can read credentials or alter transferred files. If you must retain FTP compatibility, configure FTPS and require encryption for both authentication and data.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesObtain a certificate whose name matches the DNS hostname clients will use. Replace the package’s example certificate and private key with that host-specific pair, and protect the private key so only root and the service’s required account can read it. Then add settings similar to these:
ssl_enable=YES
rsa_cert_file=/etc/ssl/certs/ftp.example.com.crt
rsa_private_key_file=/etc/ssl/private/ftp.example.com.key
force_local_logins_ssl=YES
force_local_data_ssl=YESThe paths are examples; use the actual certificate and key locations on your VPS. Do not leave a distribution example certificate in production when clients are expected to validate the server identity.
Restart and check the service:
sudo systemctl restart vsftpd
sudo systemctl status vsftpdIn the client, choose FTP with explicit TLS (often labelled FTPES) when using the normal FTP control port. Confirm that the client validates the certificate name and chain. An implicit-TLS client mode is a different connection profile; use it only when the integration explicitly requires it and its port and firewall rules are documented.
Understand the directory and upload model
There are three independent controls to check when an upload fails:
- The account must be allowed to log in: it must exist, have the correct password, and not be denied by
/etc/ftpusersor another system policy. - vsftpd must permit authenticated writes with
write_enable=YES. - The destination directory must be writable by the Unix user. Use
namei -l /srv/ftp/gamefiles/uploadorls -ldon each path component to inspect ownership and mode bits.
For a download-only account, leave its directories owned and writable by an administrator while granting the account read and traversal permission. For an upload account, make only the specific intake directory writable and process or move files from an administrative job. This limits the damage from an accidentally uploaded executable or oversized archive.
Chroot confinement is not a substitute for Unix permissions. A user confined to the correct directory can still overwrite every file that directory permits, so review ownership after deploying a game build, mod pack, or save-backup workflow.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Test from outside the VPS
Test the complete path from a separate network, such as a home connection or mobile hotspot. Perform the checks in this order:
- Resolve the VPS hostname and confirm it points to the current public address.
- Connect with the intended protocol: SFTP, plain FTP only on an isolated network, or explicit-TLS FTPS.
- Authenticate as the dedicated account and verify that the initial directory is the expected chroot location.
- Attempt to move above that directory. The client should not expose the VPS filesystem outside the jail.
- List a directory. This tests the passive data connection even before a file is transferred.
- Upload a small test file if the account needs uploads, then download it and compare its name and size.
- Try an operation that should be denied, such as writing to a read-only directory, to confirm permissions are intentional.
- Restart the VPS or service and repeat a login to verify that the configuration survives a restart.
- Review the service journal and transfer log for the test session, then remove test files that are no longer needed.
Do not treat a successful local connection as proof that Internet clients will work. Passive FTP depends on the public address, both firewalls, and the client’s network path.
Troubleshoot common failures
The service will not start
Run sudo systemctl status vsftpd and sudo journalctl -u vsftpd. A misspelled directive, duplicate setting with an invalid value, unreadable certificate key, or malformed path is usually visible there. Restore /etc/vsftpd.conf.backup if necessary, then reapply changes one at a time.
Authentication is rejected
Confirm that the username exists, the password was entered correctly, and the account is not in /etc/ftpusers. Check that local_enable=YES is active. If the account was created with a restricted login shell, verify that the server’s authentication policy permits that shell; do not weaken the protected-account deny list simply to bypass a policy error.
Login works but directory listing or transfers time out
This is the classic passive-mode symptom. Confirm that pasv_enable=YES, pasv_min_port, and pasv_max_port match the documented range. Open the control port and every port in that range in both UFW and the provider firewall. Check pasv_address when the VPS has NAT or multiple interfaces, and test again from outside the server.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchUploads return permission denied
Check all three controls: write_enable=YES, the account’s Unix ownership, and the destination directory mode. A root-owned chroot top level is expected; the account should write only to a deliberately created child directory such as /upload.
TLS negotiation fails
Verify that ssl_enable=YES is loaded, the certificate and private-key paths exist, and the key is readable by the daemon. Make sure the client is set to explicit TLS rather than plain FTP, and that the hostname used by the client matches the certificate. A certificate for one name will not validate when the client connects to an unrelated address.
Operational safeguards for a game-file VPS
- Keep SSH administration separate from FTP identities. Never share an administrator password with a transfer account.
- Back up
/etc/vsftpd.conf, account information, and the transferred data before major changes. - Document the passive range, advertised address, firewall rules, and certificate expiry date so another administrator can restore service.
- Review transfer logs for unexpected accounts, destinations, or volumes.
- Use quotas, filesystem monitoring, or an external cleanup process when users can upload large game archives; the FTP daemon does not decide how much disk space an account may consume.
- Patch Ubuntu and the
vsftpdpackage through the normal update process, then restart and test after maintenance. - Disable the service and remove its firewall rules when the integration is retired. An unused Internet-facing FTP endpoint is unnecessary attack surface.
When SFTP is the better answer
Choose SFTP instead of configuring vsftpd when your clients support it and you do not need FTP-specific behavior. SFTP runs as a subsystem of OpenSSH, uses SSH authentication, and normally requires only the existing SSH firewall rule rather than a control port plus a passive range. It is a separate protocol, not “FTP with a different encryption switch,” so an FTP-only client cannot be made compatible by changing a port number. Conversely, an integration that requires FTP commands, FTP account semantics, or an FTP-specific plugin may need FTPS.
The decision is therefore operational rather than cosmetic: use SFTP for a new secure transfer workflow; use FTPS when FTP compatibility is a hard requirement; expose plain FTP only in a controlled, non-sensitive network where clear-text credentials are acceptable.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
