How to Configure the vsftpd FTP Server for Secure Connections on Ubuntu

While SSH (SFTP) is generally the preferred method for secure file transfers on Linux, many legacy applications and automated systems still rely on the standard FTP protocol. Unfortunately, traditional FTP transmits passwords and data in plain text, making it highly vulnerable to packet sniffing. If you must run an FTP server on Ubuntu, using vsftpd (Very Secure FTP Daemon) configured with SSL/TLS encryption (FTPS) is absolutely mandatory.

Step 1: Install vsftpd

First, update your package lists and install the vsftpd package:

sudo apt update
sudo apt install vsftpd

Once installed, the service should start automatically. You can verify this by running sudo systemctl status vsftpd.

Step 2: Generate an SSL Certificate

To encrypt the FTP traffic, we need an SSL certificate. For internal servers, a self-signed certificate is usually sufficient.

sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/vsftpd.pem -out /etc/ssl/private/vsftpd.pem

You will be prompted to answer several questions (Country, State, Organization). You can simply press Enter to accept the defaults for internal testing.

Step 3: Configure vsftpd for SSL/TLS

Now, we need to edit the main configuration file to enforce encryption.

1. Open the configuration file in a text editor:

   sudo nano /etc/vsftpd.conf

2. Find the following lines and modify them to point to your new certificate:

   rsa_cert_file=/etc/ssl/private/vsftpd.pem
   rsa_private_key_file=/etc/ssl/private/vsftpd.pem
   ssl_enable=YES

3. Add or modify the following directives to force encryption for both logins and data transfers, and disable older, insecure protocols:

   allow_anon_ssl=NO
   force_local_data_ssl=YES
   force_local_logins_ssl=YES
   ssl_tlsv1=YES
   ssl_sslv2=NO
   ssl_sslv3=NO
   require_ssl_reuse=NO
   ssl_ciphers=HIGH

4. Save the file and exit the editor.

Step 4: Restart the Service

For the new configuration to take effect, restart the vsftpd daemon:

sudo systemctl restart vsftpd

Your Ubuntu server is now running a secure FTPS server. When clients connect using software like FileZilla, they will be required to negotiate an encrypted TLS session before any credentials or files are transmitted.