Beginners Guide to vsftpd: Key Settings Explained

Updated: 28 September 2026 · Applies to: vsftpd 3.0.5 on AlmaLinux and Rocky Linux 9 and 10, RHEL 9 and 10, Ubuntu 24.04 and 26.04, Debian 13

vsftpd is configured in a single file: /etc/vsftpd/vsftpd.conf on AlmaLinux, Rocky Linux and RHEL, /etc/vsftpd.conf on Ubuntu and Debian. This guide explains the settings you will use most, grouped by task, and shows a complete anonymous download server. For a secure setup for local users with encryption, see how to set up vsftpd with TLS.

Install and start

dnf install vsftpd && systemctl enable --now vsftpd     # AlmaLinux, Rocky Linux, RHEL
apt install vsftpd                                     # Ubuntu, Debian

After every change: systemctl restart vsftpd.

Who may log in

• anonymous_enable=YES|NO: allow logins as "anonymous" or "ftp" without a password.
• local_enable=YES|NO: allow the system's user accounts to log in.
• userlist_enable=YES with userlist_deny=YES (default): the users listed in /etc/vsftpd/user_list (Red Hat family) are refused. With userlist_deny=NO, only the listed users may log in, which is the safer allow-list approach.
• Accounts listed in /etc/vsftpd/ftpusers (Red Hat family) or /etc/ftpusers (Debian family), such as root, are always refused.

What users may do

• write_enable=YES|NO: allow uploads, deleting and renaming for local users.
• local_umask=022: permissions of uploaded files (022 gives rw-r--r--).
• chroot_local_user=YES: lock local users in their home folder; add allow_writeable_chroot=YES if that folder is writable.

Network and firewall

• pasv_enable=YES, pasv_min_port=40000, pasv_max_port=40100: the passive data ports; open the same range in the firewall.
• pasv_address=203.0.113.10: the public IP to announce when the server sits behind NAT.
• listen=YES (IPv4) or listen_ipv6=YES (IPv6, which usually also accepts IPv4): set only one of them to YES.

Logging

• xferlog_enable=YES: log every upload and download, in /var/log/xferlog.
• log_ftp_protocol=YES with xferlog_std_format=NO: log every FTP command to /var/log/vsftpd.log, useful when troubleshooting logins.

Example: a public, read-only download server

We tested this configuration on AlmaLinux 9: anonymous users could list and download files, and uploads were refused.

listen=YES
listen_ipv6=NO
anonymous_enable=YES
local_enable=NO
write_enable=NO
anon_root=/srv/ftp/pub
no_anon_password=YES
hide_ids=YES
pasv_min_port=40000
pasv_max_port=40100
xferlog_enable=YES
pam_service_name=vsftpd

Create the folder and make it readable: mkdir -p /srv/ftp/pub && chmod 755 /srv/ftp/pub. On AlmaLinux, Rocky Linux and RHEL, label it for SELinux: semanage fcontext -a -t public_content_t "/srv/ftp(/.*)?" and restorecon -Rv /srv/ftp. hide_ids=YES shows all files as owned by "ftp", so user names on the server are not revealed.

Official documentation: vsftpd.conf manual.