{"id":500,"date":"2020-10-17T17:06:01","date_gmt":"2020-10-17T17:06:01","guid":{"rendered":"https:\/\/dft.wiki\/?p=500"},"modified":"2026-06-09T13:32:42","modified_gmt":"2026-06-09T17:32:42","slug":"vsftpd-tls-on-ubuntu-20-04","status":"publish","type":"post","link":"https:\/\/dft.wiki\/?p=500","title":{"rendered":"VSFTPD + TLS + Fail2Ban on Ubuntu"},"content":{"rendered":"

Assuming you already have an SSL\/TLS key that you may have created for your HTTP server [Read It<\/a>], we will use it for VSFTPD.<\/p>\n

sudo apt update\r\nsudo apt install vsftpd\r\nsudo service vsftpd status\r\nsudo ufw allow from 200.200.200.200<\/strong> to any<\/pre>\n
For now, allow your public IP (replace 200.200.200.200<\/strong> with yours) to have full access to your server to avoid any issues with open ports on your firewall. We will remove this rule later and apply more precise port settings.<\/p>\n
Test connecting to your FTP server with FileZilla (for example). Now edit the configuration file:<\/p>\n
sudo cp \/etc\/vsftpd.{conf,bkp}\r\nsudo nano \/etc\/vsftpd.conf<\/pre>\n
Find all of these settings and make them match the following:<\/p>\n
listen=NO\r\nlisten_ipv6=YES\r\nanonymous_enable=NO\r\nlocal_enable=YES\r\nwrite_enable=YES\r\nlocal_umask=022\r\ndirmessage_enable=YES\r\nuse_localtime=YES\r\nxferlog_enable=YES\r\nconnect_from_port_20=YES\r\nsecure_chroot_dir=\/var\/run\/vsftpd\/empty\r\npam_service_name=vsftpd\r\nutf8_filesystem=YES<\/pre>\n
For SSL\/TLS, add the following at the end of the file:<\/p>\n
rsa_cert_file=\/etc\/apache2\/md\/domains\/domain.com<\/strong>\/pubcert.pem\r\nrsa_private_key_file=\/etc\/apache2\/md\/domains\/domain.com<\/strong>\/privkey.pem\r\nssl_enable=YES\r\nallow_anon_ssl=NO\r\nforce_local_data_ssl=YES\r\nforce_local_logins_ssl=YES\r\nssl_tlsv1=YES\r\nssl_sslv2=NO\r\nssl_sslv3=NO\r\nrequire_ssl_reuse=NO\r\nssl_ciphers=HIGH<\/pre>\n
Note:<\/strong> This tutorial assumes the server already has a certificate issued by Let’s Encrypt using Apache’s MD module. If your certificate was generated differently, locate those files on your system. In most cases, only the domain name in the paths above will need to change.<\/p>\n
You should also enable Passive Mode (recommended):<\/p>\n
pasv_enable=Yes\r\npasv_min_port=40000\r\npasv_max_port=50000<\/pre>\n
Restart the service, confirm it is running, and test the connection from FileZilla:<\/p>\n
sudo systemctl restart vsftpd\r\nsudo systemctl status vsftpd<\/pre>\n
Now remove the broad firewall rule and replace it with precise ones. First, find the rule number:<\/p>\n
sudo ufw status numbered | grep 200.200.200.200<\/strong><\/pre>\n
Remember that 200.200.200.200<\/strong> is your client’s public IP, not the server’s IP.<\/p>\n
[ 7]<\/strong> Anywhere    ALLOW IN    200.200.200.200<\/pre>\n
The number in brackets is the rule to delete. In this example it is 7. Delete it (confirm when prompted):<\/p>\n
sudo ufw delete 7<\/strong><\/pre>\n
Add the new rules:<\/p>\n
sudo ufw allow 20:21\/tcp comment \"FTP\"\r\nsudo ufw allow 40000:50000<\/strong>\/tcp comment \"FTP Passive Mode\"<\/pre>\n
The second rule applies only if you enabled Passive Mode. The port range (40000:50000<\/strong>) must match exactly between the VSFTPD configuration file and the firewall.<\/p>\n
How wide should the range be? That is up to you. A smaller range like 50 ports is fine if you do not expect many simultaneous transfers.<\/p>\n
Now configure Fail2Ban to monitor and protect the FTP server. Assuming you already have Fail2Ban running [Read It<\/a>], you just need to add VSFTPD to the configuration:<\/p>\n
sudo nano \/etc\/fail2ban\/jail.local<\/pre>\n
Search for vsftpd<\/strong> (Ctrl+W) and make sure it looks like this:<\/p>\n
[vsftpd<\/strong>]\r\nenabled = true\r\nport = ftp,ftp-data,ftps,ftps-data\r\nlogpath = %(vsftpd_log)s<\/pre>\n
Then open the filter file:<\/p>\n
sudo nano \/etc\/fail2ban\/filter.d\/vsftpd.conf<\/pre>\n
It should look like the following. If it differs, replace its contents with this:<\/p>\n
[INCLUDES]\r\nbefore = common.conf\r\n[Definition]\r\n__pam_re=\\(?%(__pam_auth)s(?:\\(\\S+\\))?\\)?:?\r\n_daemon = vsftpd\r\nfailregex = ^%(__prefix_line)s%(__pam_re)s\\s+authentication failure; logname=\\S* uid=\\S* euid=\\S* tty=(ftp)? ruser=\\S* rhost=<HOST>(?:\\s+user=.*)?\\s*$\r\n^ \\[pid \\d+\\] \\[[^\\]]+\\] FAIL LOGIN: Client \"<HOST>\"(?:\\s*$|,)\r\n^ \\[pid \\d+\\] \\[root\\] FAIL LOGIN: Client \"<HOST>\"(?:\\s*$|,)\r\nignoreregex =<\/pre>\n
Restart Fail2Ban, check the status of the new jail, and attempt a failed login to confirm it is being captured:<\/p>\n
sudo systemctl restart fail2ban\r\nsudo fail2ban-client status vsftpd<\/pre>\n
\"\"<\/p>\n
After a failed login attempt, “Total failed<\/strong>” will start counting.<\/p>\n
If you accidentally ban yourself, run the following command with your IP address<\/strong>:<\/p>\n
sudo fail2ban-client unban 200.200.200.200<\/strong><\/pre>\n","protected":false},"excerpt":{"rendered":"
Assuming you already have an SSL\/TLS key that you may have created for your HTTP […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-500","post","type-post","status-publish","format-standard","hentry","category-linux"],"_links":{"self":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/500","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=500"}],"version-history":[{"count":12,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/500\/revisions"}],"predecessor-version":[{"id":5818,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/500\/revisions\/5818"}],"wp:attachment":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=500"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=500"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=500"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}