How to install an Debian FTP Server

If you want to regularly store and retrieve larger files from a server, then you need suitable transmission technology. Among the possible solutions, file transfer via the File Transfer Protocol (FTP) is still one of the most sought-after today. In addition to transporting data via TCP ports 20 and 21, the transmission protocol for IP networks acting on the application layer also offers the options to create directories and structure them as required. Since you only need to access the FTP server with a client software this way, and a networking of both components via the internet is sufficient, the transfer technology is often used for uploading and downloading files to and from web spaces.

As a tenant of such website resources, you usually receive specific log-in data that can be used to connect to the hosting provider’s FTP server. Of course, as a self-host you can also use the file transfer technology by installing and configuring your own server. This guide explains how you can set up such an FTP server using Debian (including TLS encryption).

In this base configuration, users are given access to a specific directory. This makes sense, for example, if they’re involved in the maintenance of a website and therefore require extensive access rights. If the function of the Linux FTP server is to provide users with only one save location for their files, you should set up ProFTPD to restrict access to the home directory:

Create FTP user

If you create a new ProFTPD user, you should always define /bin/false as the login shell. This way, you make sure that the user only has access to the FTP server and not to the entire system. With the following terminal command, first enter /bin/false in the file of authorised shells:

Now you can create your first user:

In this example, you create a user account with the name “user1” and create their home directory in the same step. Finally, you assign a password for the new user account and confirm the profile. So that this newly created user can now actually connect to the Debian FTP server and upload files to (and later download them from) their exclusive directory, specify the home directory in proftpd.conf:

This code example limits the directory in different ways to make it a private storage location for user1’s files: With the umask command (022), the directory owner is equipped with all rights first. Other users may only read the files and then are only allowed to execute them if the owner grants the necessary authorisation. The disabled directive AllowOverwrite prevents the uploading of files that could overwrite previously saved data. Finally, with the FTP login (Limit LOGIN) and Run FTP (Limit ALL) commands are blocked for all users other than user1.

The owner of the directory also has complete rights (7 = Read, Write, and Run) while the group users and all other users can only read and run (5). Once the rights are defined, anonymous access is configured in the proftpd.conf file:

To be able to log on to the Debian FTP server with the ftp profile, you have to add it to the ftpuser group:

Step 1: Generate certificate and key

Once OpenSSL is open, use it to create a certificate. Since you need to store it somewhere, first create the corresponding folder in the ProFTPD directory:

Now generate a certificate (proftpd.cert.pem) and key (proftpd.key.pem) with a lifetime of one year for your Linux FTP server by specifying this location with the following command:

Entering your own information is also necessary to register the certificate properly:

• Country name (2 letter code): i.e. “UK” for the United Kingdom
• State or Province Name (full name): i.e. “Cambridgeshire”
• Locality Name (e.g. city): i.e. “Cambridge”
• Organisation Name (e.g. company): Name of the company or your name
• Organisational Unit Name (e.g. company): Name of the department (if applicable), i.e. “IT”
• Common Name (e.g. YOUR name): Specification of the domain to be protected, i.e. “ftp.example.co.uk”
• Email address: Contact email address

Step 2: Enable SSL/TLS in ProFTPD                                               

After you’ve created your own certificate along with a private key, you have to enable the encryption technology for the ProFTPD server. The Debian FTP server software provides the mod_tls module for this, which is installed by default but disabled. For activation, adjustments are once again necessary in proftpd.conf. Open the configuration file and search for the following entry:

This way, you’ve only activated the SSL/TLS encryption for your Debian FTP server, but also made the most important settings in the same step. Now the log file for the FTP connection records (TLSLog) is defined as well as the path to the certificate (TLSRSACertificateFile) and key (TLSRSACertificateKeyFile). The possible protocol versions (TLSProtocol) are also given. The last two lines ensure that the module doesn’t verify the certificates presented by the client (TLSVerifyClient) and that the basic encryption requirements are in place for setting up a connection (TLSRequired). After restarting the ProFTPD server, the new settings go into effect:

Step 3: Register on the ProFTPD server via SSL/TLS

If you’ve activated SSL/TLS for ProFTPD (as recommended in this Debian FTP server tutorial), users need an FTP client to support the encrypted connection. One of the most prominent agents is FileZilla, which is not only available for Debian and other Linux distributions, but also for macOS and Windows. The open source program presents the optimal solution for you and other users to access various platforms on the FTP server.

In FileZilla’s server manager, specify the saved variant FTPS (“FTP through explicit TSL/SSL”) instead of FTP when selecting the server type. When first forming a connection with the server, it’s also necessary to accept the certificate.

ProFTPD configuration – tips and tricks

The pre-set configuration options presented here are only a small selection of possibilities. The multi-faceted FTP software allows for even more specific and complex scenarios when configuring your own server. The official website of ProFTPD offers lots of useful information on this topic. The freely available online documentation contains, among other things, some example setups, detailed how-tos, as well as FAQs and explanations on individual directives. There is also information on the various standard and additional modules.

In some cases, restarting the ProFTPD server may result in the following error message:

In this case, the problem is that the cache module mod_tls_memcache was automatically enabled as an SSL/TLS component when compiling ProFTPD. If you’ve already established SSL/TLS encryption, then in theory (and if desired) the module will cache the encrypted FTP sessions. Since the session caching isn’t required by default, though, you don’t have the necessary settings in place for the module to function – which leads to an error message from ProFTPD. The solution for this problem is simple: Comment out the module as well as the loading process of the module in the configuration file:

In addition to the caching module problem, a faulty connection setup is one of the other complications that can occur after setting up the Debian FTP server. To get to the bottom of this problem, you can try out various analysis options:

1. Test if the ProFTPD server is running:

2. Test if the ProFTPD server listens on port 21 to register incoming FTP requests:

3. Check error messages in the ProFTPD log:

4. Check error messages in the TLS log:

5. Connection tests on port 21 with telnet:

6. Connection tests on port 21 with TLS: