contact@linuxtpoint.com
Linuxtpoint
Candid photograph of a Linux server terminal with a soft olive-green glow against a dark slate background, conveying a calm technical atmosphere.

Step-by-step guides for system administrators — covering command-line basics, web server setup, and preparation material for technical interviews.

Browse Tutorials

Configuring vsftpd with TLS Encryption on Fedora

File Transfer Protocol sends credentials and files in plain text unless encryption is added. On Fedora, vsftpd can provide FTPS, protecting both authentication and data transfers with TLS while retaining compatibility with many traditional FTP clients. Learn more about Getsystemdefaultlangidtogetuserdefaultlangidno Weii.html.

This guide configures explicit FTPS on port 21, where the client connects normally and then negotiates TLS with the server. It does not configure SFTP, which is an SSH-based protocol with different ports, authentication methods, and firewall rules. Administrators working through broader Linux and Unix resources can use the same security principles for other network services.

TLS is especially useful when files cross an office network, an NBN connection, a hosting provider, or public Wi-Fi. Australian organisations should also consider the Privacy Act 1988 and the Essential Eight when transferring personal, financial, or operational records.

Install Vsftpd And Prepare The Host

Update Fedora and install the FTP daemon, OpenSSL, and the SELinux management utilities:

sudo dnf install -y vsftpd openssl policycoreutils-python-utils
sudo systemctl enable --now vsftpd

Create a dedicated certificate directory and generate a self-signed certificate for internal use or testing:

sudo install -d -m 700 /etc/pki/tls/private
sudo openssl req -x509 -nodes -days 825 -newkey rsa:3072 \
  -keyout /etc/pki/tls/private/vsftpd.key \
  -out /etc/pki/tls/certs/vsftpd.crt \
  -subj "/C=AU/ST=New South Wales/L=Sydney/O=Example/CN=ftp.example.com"

sudo chmod 600 /etc/pki/tls/private/vsftpd.key
sudo chmod 644 /etc/pki/tls/certs/vsftpd.crt

Replace the subject values with the organisation’s details and the real DNS name. A certificate issued by a trusted public certificate authority avoids browser and client warnings. For a server in Melbourne, Brisbane, or Perth, the certificate’s hostname still matters more than its physical location.

Configure TLS And Local Accounts

Back up the default configuration before editing it:

sudo cp /etc/vsftpd/vsftpd.conf /etc/vsftpd/vsftpd.conf.orig
sudo nano /etc/vsftpd/vsftpd.conf

Add or adjust these directives:

listen=NO
listen_ipv6=YES

anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022

chroot_local_user=YES
allow_writeable_chroot=YES

ssl_enable=YES
allow_anon_ssl=NO
force_local_logins_ssl=YES
force_local_data_ssl=YES
rsa_cert_file=/etc/pki/tls/certs/vsftpd.crt
rsa_private_key_file=/etc/pki/tls/private/vsftpd.key
ssl_sslv2=NO
ssl_sslv3=NO
ssl_tlsv1=YES
ssl_ciphers=HIGH

xferlog_enable=YES

The force_local_* settings prevent local users from falling back to unencrypted authentication or file transfers. chroot_local_user confines each account to its home directory, although writable chroot configurations should be tested carefully. Fedora package behaviour can change between releases, so consult the web server guides when integrating FTP with a wider hosting environment.

Create a restricted account if one does not already exist:

sudo useradd -m -s /sbin/nologin filedrop
sudo passwd filedrop
sudo systemctl restart vsftpd

Some FTP clients reject /sbin/nologin accounts unless the shell appears in /etc/shells. Adding it can weaken local login policy, so use a purpose-built account and test the client before changing that file.

Set Passive Mode And Fedora Firewall Rules

FTP uses a control connection and separate data connections. Passive mode makes those data connections originate from the server, which works more reliably through routers and corporate firewalls. Add a narrow port range to vsftpd.conf:

pasv_enable=YES
pasv_min_port=30000
pasv_max_port=31000

Open only the required services and passive ports in firewalld:

sudo firewall-cmd --permanent --add-service=ftp
sudo firewall-cmd --permanent --add-port=30000-31000/tcp
sudo firewall-cmd --reload

If the Fedora host sits behind NAT, add pasv_address=ftp.example.com or the public address used by clients. Australian ISPs may place residential connections behind carrier-grade NAT, and many small offices use changing public addresses; either situation can make an inbound FTP service unreliable. A static business connection or a VPN is generally safer for routine transfers.

Apply SELinux And Verify The Service

SELinux can block access even when Unix permissions look correct. Label a dedicated upload directory if the service needs to write outside normal home directories:

sudo mkdir -p /srv/ftp/incoming
sudo chown filedrop:filedrop /srv/ftp/incoming
sudo semanage fcontext -a -t public_content_rw_t "/srv/ftp/incoming(/.*)?"
sudo restorecon -Rv /srv/ftp/incoming
sudo setsebool -P ftpd_full_access 1

The ftpd_full_access boolean is broad, so enable it only when the service design requires it. Prefer standard home directories and narrower SELinux labels wherever possible. Check denials rather than disabling SELinux:

sudo ausearch -m AVC -ts recent
sudo journalctl -u vsftpd

Confirm that the daemon is listening and that its configuration loaded successfully:

sudo systemctl status vsftpd
sudo ss -lntp | grep ':21'

Keep logs protected because usernames, connection times, filenames, and IP addresses can constitute sensitive operational information under Australian privacy obligations.

Test Explicit FTPS From A Client

In an FTP client, choose FTP with explicit TLS, connect to ftp.example.com on port 21, and authenticate with the restricted account. Do not select SFTP or implicit FTPS unless the server has been configured for those protocols. The client should show a certificate exchange before sending credentials.

Command-line testing can confirm the TLS handshake:

openssl s_client -connect ftp.example.com:21 -starttls ftp

A successful result displays the certificate chain and negotiated TLS details. Test directory listing, upload, download, and logout from a network outside the server’s LAN. This is important for staff working from home in regional Queensland or Western Australia, where NAT and latency can reveal passive-mode errors that are invisible on the office network.

If a client connects but cannot list directories, review the passive port range and firewall. If authentication fails, inspect the account shell, PAM configuration, and journalctl output. For certificate warnings, verify that the hostname used by the client matches the certificate’s subject alternative name.

After testing, schedule certificate renewal and review account access. As a practical final check, run openssl s_client -connect ftp.example.com:21 -starttls ftp from an external machine and confirm that the certificate hostname, expiry date, and TLS protocol meet the organisation’s policy.