# vSFTPd

`vsftpd` (Very Secure FTP Daemon) is a popular FTP server for Linux systems. To use vSFTPd, you'll need to install the `vsftpd `package.

\------------------------------------------------------------------------------------------------------------------------------------------------

#### vSFTPd Config Options

<table border="1" id="bkmrk-pasv_enable%3Dyespasv_" style="border-collapse: collapse; width: 100%; height: 491.938px;"><colgroup><col style="width: 50%;"></col><col style="width: 50%;"></col></colgroup><tbody><tr style="height: 63.3906px;"><td style="height: 63.3906px;">pasv\_enable=YES  
pasv\_min\_port=40000  
pasv\_max\_port=40100</td><td style="height: 63.3906px;">Enable passive mode and set port range</td></tr><tr><td>pasv\_address=your.external.ip.address  
</td><td>Specify FTP listening IP.</td></tr><tr style="height: 29.7969px;"><td style="height: 29.7969px;">anonymous\_enable=NO  
</td><td style="height: 29.7969px;">Disable anonymous access</td></tr><tr style="height: 29.7969px;"><td style="height: 29.7969px;">write\_enable=YES  
</td><td style="height: 29.7969px;">Enable file uploads</td></tr><tr style="height: 29.7969px;"><td style="height: 29.7969px;">local\_enable=YES  
</td><td style="height: 29.7969px;">Enable local users</td></tr><tr style="height: 29.7969px;"><td style="height: 29.7969px;">chroot\_local\_user=YES  
</td><td style="height: 29.7969px;">Enable user chroot</td></tr><tr style="height: 46.5938px;"><td style="height: 46.5938px;">chroot\_list\_enable=YES  
chroot\_list\_file=/etc/vsftpd.chroot\_list</td><td style="height: 46.5938px;">Configure chroot bypass for users.</td></tr><tr style="height: 29.7969px;"><td style="height: 29.7969px;">ssl\_enable=YES  
</td><td style="height: 29.7969px;">Enable SSL</td></tr><tr style="height: 46.5938px;"><td style="height: 46.5938px;">rsa\_cert\_file=/etc/ssl/certs/vsftpd.pem  
rsa\_private\_key\_file=/etc/ssl/private/vsftpd.pem  
</td><td style="height: 46.5938px;">Specify SSL certificate files for FTPS/ES</td></tr><tr style="height: 46.5938px;"><td style="height: 46.5938px;">force\_local\_data\_ssl=YES  
force\_local\_logins\_ssl=YES</td><td style="height: 46.5938px;">Force SSL usage</td></tr><tr style="height: 63.3906px;"><td style="height: 63.3906px;">ssl\_tlsv1=YES  
ssl\_sslv2=NO  
ssl\_sslv3=NO</td><td style="height: 63.3906px;">SSL Protocol options</td></tr><tr style="height: 29.7969px;"><td style="height: 29.7969px;">ssl\_ciphers=HIGH  
</td><td style="height: 29.7969px;">SSL cipher</td></tr><tr style="height: 46.5938px;"><td style="height: 46.5938px;">force\_local\_data\_ssl=NO  
force\_local\_logins\_ssl=NO</td><td style="height: 46.5938px;">Enable FTPES</td></tr></tbody></table>

\------------------------------------------------------------------------------------------------------------------------------------------------

#### Adding users for FTP usage

1\. In order to create an account that can use VSFTPd, you will first need to set up a user on the server that you want to transfer files to and from.

```
useradd guest
```

2\. Once created, you'll want to set a password for that user

```
passwd guest
```

3\. Also disable shell access for the user

```
usermod -s /sbin/nologin guest
```

\------------------------------------------------------------------------------------------------------------------------------------------------

#### Chrooting users

Chrooting a user in `vsftpd` ensures that the user is restricted to their home directory and cannot navigate to other parts of the file system.

1. Add the user

Either alter the existing user's home directory, or add a new user to be used for FTP

```
sudo adduser --home /var/ftp/ftpuser ftpuser
```

2\. Set a password

```
passwd ftpuser
```

3\. Set home directory permissions

```
sudo chown ftpuser:ftpuser /var/ftp/ftpuser
sudo chmod 755 /var/ftp/ftpuser
```

4\. Configure vsftpd

Ensure that the following is present within /etc/vsftpd.conf

```
chroot_local_user=YES
```

\------------------------------------------------------------------------------------------------------------------------------------------------

#### FTPS &amp; FTPES

```
# Enable SSL
ssl_enable=YES

# Paths to the SSL certificate and key
rsa_cert_file=/etc/ssl/certs/vsftpd.pem
rsa_private_key_file=/etc/ssl/private/vsftpd.pem

# Require SSL for both data and login
force_local_data_ssl=YES
force_local_logins_ssl=YES

# Allow anonymous users to use SSL
allow_anon_ssl=YES

# SSL protocol options
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO

# Strong ciphers
ssl_ciphers=HIGH

# Optional: Require SSL reuse for data connections
require_ssl_reuse=NO

# Enable Explicit SSL (FTPES)
# By default, vsftpd will use implicit FTPS (default port 990)
# If you prefer explicit FTPS (FTPES), enable the following:
force_local_data_ssl=NO
force_local_logins_ssl=NO

# Explicitly request SSL for login
ssl_request_cert=YES
```

====================================================================================