.. blogpost::
    :title: Install FTP server on debian
    :keywords: debian, FTP
    :date: 2019-01-13
    :categories: FTP
    :lid: blog-ftp-vsftpd

    Server FTP,
    look into `How to Configure VSFTPD FTPS with SSL/TLS on Ubuntu 18.04 <https://linoxide.com/linux-how-to/configure-vsftpd-sftp-ubuntu/>`_.

    Installation::

        apt-get install vsftpd
        mv /etc/vsftpd.conf /etc/vsftpd.conf.bak

    Let's modify the configuration file::

        nano /etc/vsftpd.conf

    With the following content:

    ::

        listen=NO
        listen_ipv6=YES
        anonymous_enable=NO
        local_enable=YES
        write_enable=YES
        local_umask=022
        dirmessage_enable=YES
        use_localtime=YES
        xferlog_enable=YES
        connect_from_port_20=YES
        chroot_local_user=YES
        secure_chroot_dir=/var/run/vsftpd/empty
        pam_service_name=vsftpd
        pasv_enable=Yes
        pasv_min_port=10000
        pasv_max_port=11000
        user_sub_token=$USER
        local_root=/home/$USER/ftp
        userlist_enable=YES
        userlist_file=/etc/vsftpd.userlist
        userlist_deny=NO

    Firewall::

        ufw allow from any to any port 20,21,10000:11000 proto tcp

    Start the service::

        service vsftpd restart

    Add a user::

        useradd -m ftpuser
        passwd ftpuser
        mkdir /home/ftpuser/ftp
        chown nobody:nogroup /home/ftpuser/ftp
        chmod a-w /home/ftpuser/ftp
        mkdir /home/ftpuser/ftp/files
        chown ftpuser:ftpuser /home/ftpuser/ftp/files

    Add to ``nano /etc/vsftpd.conf``::

        user_sub_token=$USER
        local_root=/home/$USER/ftp

    Then test::

        echo "test file for vsftpd" | sudo tee /home/ftpuser/ftp/files/test.txt
        echo "ftpuser" | sudo tee -a /etc/vsftpd.userlist

    Add to ``nano /etc/vsftpd.conf``::

        userlist_enable=YES
        userlist_file=/etc/vsftpd.userlist
        userlist_deny=NO

    SSL::

        openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/vsftpd.pem -out /etc/ssl/private/vsftpd.pem

    Add to ``nano /etc/vsftpd.conf``::

        rsa_cert_file=/etc/ssl/private/vsftpd.pem
        rsa_private_key_file=/etc/ssl/private/vsftpd.pem
        ssl_enable=YES
        allow_anon_ssl=NO
        force_local_data_ssl=YES
        force_local_logins_ssl=YES
        ssl_tlsv1=YES
        ssl_sslv2=NO
        ssl_sslv3=NO