Free tools Windows power users keep installed
One-click scans. No signup required.
To publish files for anonymous FTP downloads on Ubuntu, install vsftpd, point its anonymous root at a dedicated directory such as /srv/ftp, disable every write capability, and open TCP 21 plus a small passive-port range. Set file and parent-directory permissions deliberately, then test listing, downloading, and rejected write operations from a separate client.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Ubuntu’s documentation describes vsftpd as “an FTP daemon available in Ubuntu.” Anonymous FTP is appropriate only for files you intentionally make public: FTP sends commands and data without encryption, so it is not a suitable channel for passwords, private documents, or confidential game builds.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What this configuration does
The setup below creates a read-only FTP service. A visitor can connect with the conventional anonymous username anonymous (or ftp), list the publication directory, and download files that you have made world-readable. The visitor cannot upload, delete, rename, overwrite, or create directories.
The anonymous root is a dedicated tree, not the server’s filesystem root and not a user’s home directory. Only files placed in that tree are candidates for publication. This separation reduces the chance of exposing unrelated names, metadata, configuration files, or private home-directory content.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Prerequisites and design decisions
- An Ubuntu server with administrative access through
sudo. - A recorded Ubuntu release and package version. Distribution defaults and included configuration files can change between releases.
- A publication path, for example
/srv/ftp, with enough storage for the files you intend to distribute. - Permission to change the host firewall and, if applicable, a cloud security group, router, or NAT gateway.
- A separate FTP client for testing. Do not rely only on a test from the server itself; passive-mode and NAT errors often appear only to external clients.
Decide whether clients will reach the server directly or through NAT before editing the configuration. A NAT deployment needs a reachable public address advertised in passive responses and matching port forwarding. On a directly reachable host, omit the NAT-specific address.
Install and enable vsftpd
- Refresh Ubuntu’s package index and install the daemon:
sudo apt update sudo apt install vsftpd - Enable the service at boot and start it immediately:
sudo systemctl enable --now vsftpd - Confirm that systemd considers it running:
sudo systemctl status vsftpdLook for an active service. If it failed, read the unit log before changing settings:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.sudo journalctl -u vsftpd --no-pager -n 100
Ubuntu may ship a sample configuration or a distribution-specific default file. Save a copy before editing so you can identify your changes and restore the previous state:
sudo cp -a /etc/vsftpd.conf /etc/vsftpd.conf.backupCreate a dedicated anonymous publication tree
Create a directory outside users’ private homes and put only intentionally public files inside it:
sudo install -d -o root -g root -m 0755 /srv/ftp
sudo install -d -o root -g root -m 0755 /srv/ftp/releases
sudo cp ./example-file.zip /srv/ftp/releases/
sudo chown root:root /srv/ftp/releases/example-file.zip
sudo chmod 0644 /srv/ftp/releases/example-file.zipThe exact owner can differ when a controlled publishing workflow is required, but the FTP process must be able to traverse every directory and read each file. A common public tree uses mode 0755 for directories and 0644 for regular files. Do not apply a blanket permission change to the entire server; limit changes to the publication tree.
For an existing tree, inspect every parent directory, not just the final file:
namei -l /srv/ftp/releases/example-file.zip
ls -ld /srv /srv/ftp /srv/ftp/releases
ls -l /srv/ftp/releases/example-file.zipEach directory in the path needs execute permission for the account or group through which vsftpd accesses it. With the default anonymous restriction described below, the file itself must also be readable by everyone.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Configure a download-only anonymous profile
Edit /etc/vsftpd.conf and add or adjust the following directives. If the file already contains a setting, keep one authoritative value rather than leaving contradictory duplicates in different included files.
| Directive | Value | Purpose |
|---|---|---|
listen |
YES |
Listen on an IPv4 socket when using standalone mode. |
anonymous_enable |
YES |
Recognize the anonymous and ftp login names. |
local_enable |
NO |
Prevent ordinary local Unix accounts from logging in through this profile. |
write_enable |
NO |
Global gate for commands that can change the filesystem. |
anon_root |
/srv/ftp |
Directory presented as the anonymous user’s root. |
anon_world_readable_only |
YES |
Allow anonymous downloads only of files readable by everyone. |
anon_upload_enable |
NO |
Reject anonymous uploads. |
anon_mkdir_write_enable |
NO |
Reject anonymous directory creation. |
anon_other_write_enable |
NO |
Reject other anonymous write operations such as deletion or renaming. |
dirlist_enable |
YES |
Permit directory listings. |
download_enable |
YES |
Permit downloads. |
xferlog_enable |
YES |
Record transfer activity. |
pasv_min_port |
40000 |
Start of the passive-data port range. |
pasv_max_port |
40100 |
End of the passive-data port range. |
A minimal profile is:
listen=YES
anonymous_enable=YES
local_enable=NO
write_enable=NO
anon_root=/srv/ftp
anon_world_readable_only=YES
anon_upload_enable=NO
anon_mkdir_write_enable=NO
anon_other_write_enable=NO
dirlist_enable=YES
download_enable=YES
xferlog_enable=YES
pasv_min_port=40000
pasv_max_port=40100listen and listen_ipv6 are mutually exclusive. Use the setting that matches the host’s network stack and leave the other disabled or commented. If the service is behind NAT, add the address that outside clients can actually reach:
pasv_address=203.0.113.10Replace that example with the server’s reachable public address. An internal address advertised to Internet clients sends them to an unroutable destination and produces a login followed by a listing or transfer timeout.
Recommended Free Tools
Some Ubuntu configurations use an include= directive or additional files. Search those files when a runtime behavior contradicts the profile. A setting that enables writes in an included file can undermine an otherwise read-only main file.
Open the control and passive-data ports
FTP uses TCP 21 for the control connection. In passive mode, the client opens a second connection to one port selected from the configured passive range. Both paths must be allowed; opening only TCP 21 commonly permits login while listings and downloads hang.
For a host using UFW, open the same narrow range shown in the configuration:
sudo ufw allow 21/tcp
sudo ufw allow 40000:40100/tcp
sudo ufw status verboseApply equivalent rules in any cloud security group and router. If NAT is present, forward TCP 21 and every port from 40000 through 40100 to the Ubuntu host. Keep the range deliberately narrow, document it, and avoid exposing an unnecessarily large block of ports. A corporate firewall may also need an FTP-aware policy, but passive mode with explicit ports is generally easier to reason about than an unconstrained range.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesRank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Restart, validate, and inspect logs
After saving the configuration, restart the daemon and check for syntax or startup errors:
sudo systemctl restart vsftpd
sudo systemctl status vsftpd --no-pager
sudo ss -ltnp | grep ':21'Transfer logging is enabled by xferlog_enable=YES. Inspect /var/log/vsftpd.log when it exists, or the log path selected by the installed configuration. Systemd’s journal is useful for startup and permission failures:
sudo tail -f /var/log/vsftpd.log
sudo journalctl -u vsftpd -fDo not treat a successful TCP connection as proof that the service works. A complete check must include authentication, a directory listing, a download, and rejected write operations.
Test from a separate client
- Connect to the server using an FTP client and the server’s DNS name or reachable address. With the command-line client, use:
ftp ftp.example.org - When prompted for a name, enter
anonymous(orftp). Many clients accept any password-looking value, often an email address, but anonymous authentication does not make the connection encrypted. - List the root and a known subdirectory:
ls cd releases ls - Download a known file and verify its size or checksum on the client:
get example-file.zip - Confirm that all write paths are rejected. These commands should fail with a permission or policy response:
put test-upload.txt delete example-file.zip rename example-file.zip renamed.zip mkdir unwanted-directory - While testing, watch the server log. A successful login followed by no data-channel entry points toward passive ports, NAT, or a client-mode mismatch rather than credentials.
Use a client that explicitly supports passive mode when testing Internet access. Active mode asks the server to open a connection back to the client and is frequently blocked by client-side firewalls; passive mode keeps both data connections initiated by the client.
How permissions and anonymous restrictions interact
anon_world_readable_only=YES is documented as the default restriction for anonymous downloads. It means a file must be world-readable before vsftpd will offer it to an anonymous user. A mode such as 0640 can therefore be denied even when its owner can read it. Use chmod 0644 only for files intended to be public; do not broaden permissions on private data to make an FTP error disappear.
World-readable status is not enough by itself. The FTP process must have execute permission on every parent directory. A readable file below a directory with mode 0700 remains unreachable. Check the complete path with namei -l, and check symbolic links carefully so that a published link does not lead outside the intended content tree.
Keep the anonymous root separate from a home directory. Home directories often contain dotfiles, project names, backups, or other metadata that were never meant for public disclosure. Publish a copy or a deliberately curated release tree instead.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Maintenance and release hygiene
Treat the publication tree as a public website directory: review every file before copying it, remove obsolete releases deliberately, and check that filenames do not reveal information you meant to keep private. A successful permission check does not tell you whether the content itself is appropriate for public access.
When adding a release, copy it into a staging location, set its owner and mode, inspect the complete path, and then move it into the visible tree. This makes it less likely that a partially copied file will be presented to clients. After changing permissions, firewall rules, the public address, or the vsftpd configuration, repeat the external listing and download test rather than assuming an earlier test still applies.
Keep a written record of the selected passive range and every place it is permitted: UFW, a cloud security group, and any router forwarding rule. If the server’s public address changes, update pasv_address and the corresponding network rules together. A stale advertised address can look like a permissions failure even though authentication still succeeds.
Troubleshoot by symptom
| Symptom | Checks and corrective action |
|---|---|
| Login succeeds but the directory is empty | Verify that anon_root points to the directory containing the files, confirm execute permission on every parent directory, and ensure dirlist_enable=YES. Check that the client has not changed into a different path. |
| Listing works but a download is denied | Inspect the file mode and make sure it is world-readable as required by anon_world_readable_only=YES. Check parent-directory execute permissions and confirm that the requested path is inside anon_root. |
| Login works but listing or download hangs | Check that TCP 21 and the complete passive range are allowed in the host firewall, cloud security group, and router. Verify NAT forwarding and set pasv_address to the externally reachable address when needed. |
| Anonymous upload unexpectedly works | Review the main file and every file referenced with include=. Set write_enable=NO, anon_upload_enable=NO, anon_mkdir_write_enable=NO, and anon_other_write_enable=NO, then restart vsftpd. Also verify that you are testing the intended server and configuration. |
| The service will not start after editing | Read systemctl status vsftpd and journalctl -u vsftpd for the offending directive, check for duplicate or misspelled keys, and restore the saved configuration if necessary. Confirm that only one of listen and listen_ipv6 is active. |
| You need evidence of access | Keep xferlog_enable=YES enabled and inspect /var/log/vsftpd.log or the configured transfer-log destination. Rotate and protect logs according to your normal Ubuntu administration policy. |
Security limits and safer alternatives
Plain FTP provides no encryption for commands or file data. Anyone able to observe the network can read the session, and anonymous access intentionally removes an identity check. Restrict this service to content that is already public or to a controlled network segment. Do not use it for credentials, personal information, private source code, or files whose integrity must be protected in transit.
When users need authenticated, encrypted transfer, Ubuntu’s OpenSSH-based SFTP is the more appropriate default. SFTP uses the SSH service and user authentication rather than anonymous FTP, and it avoids FTP’s separate passive-data channel. If compatibility requirements specifically call for FTPS, vsftpd can use TLS, but you must provision a certificate, configure the TLS directives, decide whether anonymous sessions must use SSL with the relevant force_anon_*_ssl controls, and test the chosen client configuration. Enabling a few TLS lines without validating certificates and client behavior is not a complete secure-transfer plan.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11| Characteristic | Anonymous FTP with vsftpd | SFTP through OpenSSH | HTTPS download |
|---|---|---|---|
| Encryption in transit | None with plain FTP. | Provided by SSH. | Provided when HTTPS is correctly configured. |
| Access model | Public, shared anonymous identity. | Named users or keys; anonymous access is not the normal model. | Public or authenticated URLs, depending on the web server. |
| Firewall and NAT | TCP 21 plus a passive range and possible NAT address/forwarding. | Normally one SSH port. | Normally one HTTPS port. |
| Least-privilege control | Dedicated anon_root, read-only flags, and filesystem modes. |
SSH accounts, keys, chroots, and filesystem permissions. | Web-server document roots and HTTP authorization rules. |
| Client compatibility | Supported by traditional FTP clients, but passive-mode behavior varies. | Supported by SSH/SFTP clients. | Available in browsers and standard download tools. |
Choose anonymous FTP only when its public, legacy-compatible access model outweighs the encryption and firewall disadvantages. Otherwise, publish through HTTPS or provide SFTP access with OpenSSH.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Operational checklist
- Record the Ubuntu release and installed vsftpd package version.
- Keep
/srv/ftp(or your chosen path) dedicated to public content. - Review new files for accidental secrets before copying them into the tree.
- Check directory execute permissions and file world-readability whenever a release is added.
- Keep
write_enableand all anonymous write directives disabled. - Allow only TCP 21 and the documented passive range in every firewall layer.
- Update
pasv_addressif the externally reachable address changes. - Review transfer logs and remove content that should no longer be public.
- Retest listing, download, and rejected upload/delete/rename/mkdir operations after configuration or firewall changes.
This arrangement gives Ubuntu clients a predictable anonymous download endpoint while limiting the daemon to a curated, read-only directory. Its safety depends on maintaining that boundary, keeping passive networking explicit, and never treating unencrypted FTP as a private transport.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Frequently Asked Questions
Where do I put files for anonymous FTP on Ubuntu?
Put only intentionally public files below the directory named by anon_root, such as /srv/ftp. A separate publication tree is safer than a user’s home directory because it avoids exposing unrelated names and metadata.
Why can I log in but not list the directory?
Check that anon_root is correct, dirlist_enable=YES is set, and the FTP process has execute permission on every parent directory. If the client is outside the network, also verify the passive range, NAT forwarding, and pasv_address.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Why is a file visible but its download is denied?
With anon_world_readable_only=YES, the file must be world-readable, commonly mode 0644, and every parent directory must be searchable. Do not make private files world-readable merely to bypass an error.
Which passive FTP ports must I open?
Open TCP 21 plus every TCP port in the configured pasv_min_port through pasv_max_port range. The example uses 40000–40100. Permit and forward that same range in UFW, cloud rules, and any router.
Can anonymous users upload or delete files?
They should not with this profile. Keep write_enable, anon_upload_enable, anon_mkdir_write_enable, and anon_other_write_enable set to NO, inspect included configuration files, restart vsftpd, and test upload, delete, rename, and mkdir commands.
Do I need pasv_address?
Only when the server is behind NAT or otherwise advertises an address different from the one external clients can reach. Set it to the reachable public address and forward TCP 21 and the complete passive range to the Ubuntu host.
How do I confirm that anonymous transfers occurred?
Enable xferlog_enable=YES and inspect /var/log/vsftpd.log or the transfer-log path selected by the installed configuration. Use the systemd journal for startup and permission errors.
Is anonymous FTP encrypted?
No. Plain FTP exposes commands and data in transit. Use it only for intentionally public content or a controlled network. For private or authenticated transfers, use Ubuntu’s OpenSSH SFTP guidance; use FTPS only after deliberately configuring and testing TLS certificates and anonymous-SSL controls.
The Bottom Line
Install vsftpd, publish from a dedicated directory, disable every anonymous write operation, allow TCP 21 and a documented passive range, and verify permissions from an external client. If the files are not intentionally public, choose SFTP or HTTPS instead of anonymous FTP.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
