# How to configure your own Debian FTP server with ProFTPD The File Transfer Protocol (FTP) is a popular method for transferring files, commonly used for uploading and downloading content to and from web servers. This guide explains how to set up an FTP server with TLS encryption on Debian. ## How to install a Debian FTP server Before configuring your server, you must first find and install suitable server software. For Linux, there are various [FTP](https://www.ionos.com/digitalguide/server/know-how/file-transfer-protocol/) servers available, most of which are **[open source](https://www.ionos.com/digitalguide/server/know-how/what-is-open-source/)** and typically included in the package repositories of your respective [Linux distribution](https://www.ionos.com/digitalguide/server/configuration/linux-distributions/). One of the most well-known applications is the GPL-licensed [ProFTPD](http://www.proftpd.org/ "ProFTPD Project website"), which is highly modular and extendable. The main configuration file operates using directives and directive groups that will be familiar to administrators with experience using [Apache web servers](https://www.ionos.com/digitalguide/server/know-how/what-is-apache/). [Debian](https://www.ionos.com/digitalguide/server/know-how/debian-the-universal-system-software/) includes **ProFTPD in its software repository** by default. Installation can be done via the terminal using the following commands: ```bash sudo apt update sudo apt install proftpd sudo apt install proftpd-mod-crypto ``` To ensure the FTP server starts automatically on system reboot, use this additional command: ```bash sudo systemctl enable proftpd ``` Tip Looking to store or transfer data? [Rent a secure FTP server](https://www.ionos.com/hosting/ftp-hosting "FTP server") from IONOS now. Enjoy secure transmission with [SSH](https://www.ionos.com/help/hosting/setting-up-and-managing-ssh-accounts/what-is-ssh/ "What is SSH?") and [SSL/TLS](https://www.ionos.com/digitalguide/server/security/tls-transport-layer-security/), as well as daily backups included. To complete the installation, you must decide whether to use ProFTPD **in standalone mode** or as a **service managed by inetd**. In standalone mode, the FTP server independently handles incoming requests. With the second option, the “superserver” **inetd/xinetd** receives requests and forwards them to the FTP server. This second option is generally only relevant if you expect minimal FTP traffic. ## 5 scenarios and the right IONOS FTP server plan on Debian Unsure what hardware and network configuration you need for your Debian FTP server? The table below outlines three possible FTP server use cases and suggests the most suitable IONOS server plan for each.
FTP server scenario Recommended IONOS plan
Small web server VPS Linux M
Larger web server VPS Linux XL
Enterprise FTP server Dedicated Server AMD Ryzen XXL-128 NVMe
## Debian FTP server tutorial and the key configuration steps After installation, you can begin setting up ProFTPD. The configuration file **proftpd.conf** is located in the */etc/proftpd/* directory. To edit it, open it with the text editor of your choice. For example, using Debian’s default editor *nano*, you would use the following terminal command: ```bash sudo nano /etc/proftpd/proftpd.conf ``` The configuration file contains various settings and features for the Debian FTP server. **Each component is assigned its own line and requires specific values.** For example, functions can be toggled on or off by setting their values to *on* or *off* respectively. Lines can also be prefixed with a **hashtag (#)** to “comment them out,” causing the ProFTPD server to ignore them entirely. This is another way to **disable features**. Tip Instead of modifying the proftpd.conf file directly, you can create a **custom configuration file** and place it in the /etc/proftpd/conf.d/ directory. This directory is preserved during FTP software updates, reducing the risk of losing your settings. Use the **Include directive** to incorporate server specifications from the conf.d folder into the main configuration file (this is done automatically with the default settings). ### Server name, FTP directory, and other basic settings Before diving into detailed configurations, you must first adjust the basic setup. This includes specifying the **[server hostname](https://www.ionos.com/digitalguide/hosting/technical-matters/hostname/)** and the directory for **file uploads and downloads**. You also have several configuration options related to potential FTP users, as shown in this example configuration: ```none # Specify hostname and welcome message ServerName "hostname/IP-address" DisplayLogin "Your login to the Debian FTP server was successful!" # General login policies # Allow access only with shells defined in /etc/shells RequireValidShell on # Deny root login RootLogin off # Specify FTP directory accessible to users DefaultRoot directory-path # Define authorized users/user groups for FTP login # Only users in the example group ftpuser are allowed to log in # Instead of listing all allowed users, simply negate the unauthorized group (!) DenyGroup !ftpuser ``` This basic configuration grants users access to a specific directory. This is particularly useful if, for instance, users are involved in maintaining a website and thus require **broad access permissions**. If the Linux FTP server’s primary function is to provide users with storage space for their files, you should configure ProFTPD to restrict access to the **home directory**: ```none # Restrict users to their home directory DefaultRoot ~ ``` ### Creating FTP users When adding new ProFTPD users, it is advisable to set their login shell to */bin/false*. This ensures users can only access the FTP server and not the entire system. First, add */bin/false* to the list of allowed shells using the following terminal command: ```bash sudo sh -c 'echo "/bin/false" >> /etc/shells' ``` Then, create a new user account: ```bash sudo adduser user1 --shell /bin/false --home /home/user1 ``` In this example, an account named “user1” is created, and its home directory is set up simultaneously. Finally, assign a **password** to the account and confirm the profile. To enable this account to connect to the Debian FTP server and upload/download files to its exclusive directory, specify the **home directory in proftpd.conf**: ```none Umask 022 AllowOverwrite off AllowUser user1 DenyAll AllowUser user1 DenyAll ``` This code example restricts the directory in multiple ways, making it a private storage space for user1’s files. The **Umask directive (022)** grants the owning account full permissions, while others can only read and execute files if permitted. The deactivated *AllowOverwrite* directive prevents overwriting existing data during uploads. Finally, both **FTP login** (Limit LOGIN) and **FTP command execution** (Limit ALL) are blocked for all accounts except user1. Tip Instead of disallowing all FTP commands, you can disable specific operations. For instance, you can create a directory where users can only upload files. Detailed information about these settings can be found in the [online manuals](http://www.proftpd.org/docs/howto/Limit.html "ProFTPD How-tos: Configuring Limits"). ### Enabling anonymous access If you want your Debian FTP server to serve as a public download server, you might also want to allow users to **access files anonymously**. First, define the necessary permissions for the **download directory** (e.g., */home/ftpdownload*) using *chmod*: ```bash sudo chmod 755 -R /home/ftpdownload ``` The **account owning the directory** has **full permissions (7 = read, write, and execute)**, while group users and others can **only read and execute (5)**. Once permissions are set, configure anonymous access in the *proftpd.conf* file: ```none User ftp Group ftpgroup # Define possible login profiles for clients UserAlias anonymous ftp # Mask user and group identities; set max client count DirFakeUser on ftp DirFakeGroup on ftp RequireValidShell off MaxClients 10 DenyAll ``` For the **ftp** account to log in successfully, add it to the *ftpgroup* group: ```bash sudo adduser ftp ftpgroup ``` ### Configuring SSL/TLS encryption The FTP protocol transmits both login credentials and data in **plain text**. If you want to set up a private ProFTPD server that is not accessible to everyone, it is highly recommended to **encrypt the login process**. You can achieve this using **the free software OpenSSL**. The cryptographic toolkit is included in Debian’s package management system and may already be installed. Otherwise, you can install it using the following command: ```bash sudo apt install openssl ``` #### Step 1: Generate certificate and key Next, use OpenSSL to create a certificate. Since you need a location to store this, first create an appropriate **directory in the ProFTPD folder**: ```bash sudo mkdir /etc/proftpd/ssl ``` Generate a **certificate** (*proftpd.cert.pem*) and **key** (*proftpd.key.pem*) valid for one year for your Linux FTP server by specifying this location using the following command: ```bash openssl req -new -x509 -days 365 -nodes -out /etc/proftpd/ssl/proftpd.cert.pem -keyout /etc/proftpd/ssl/proftpd.key.pem ``` Additionally, you will be required to provide some information to properly register the certificate: - **Country Name (2 letter code)**: e.g., “US” for the United States - **State or Province Name (full name)**: e.g., “California” - **Locality Name (eg, city)**: e.g., “San Francisco” - **Organization Name (eg, company)**: Your company’s name or your name - **Organizational Unit Name (eg, company)**: Department name, if applicable, e.g., “IT” - **Common Name (eg, YOUR name)**: The domain to be secured, e.g., “ftp.example.com” - **Email Address**: Your email address #### Step 2: Enabling SSL/TLS in ProFTPD After creating your own certificate and private key, you need to activate the **encryption technology** for the ProFTPD server. The Debian FTP server software provides the **mod\_tls module** for this purpose. To activate it, you must edit the *tls.conf* configuration file. Open the file and locate the following entry: ```none TLSEngine off ``` Set the TLSEngine directive to “on” and further expand the section as shown below (e.g., by removing comment hashes): ```none TLSEngine on TLSLog /var/log/proftpd/tls.log TLSProtocol TLSv1 TLSv1.1 TLSv1.2 TLSRSACertificateFile /etc/proftpd/ssl/proftpd.cert.pem TLSRSACertificateKeyFile /etc/proftpd/ssl/proftpd.key.pem TLSVerifyClient off TLSRequired on ``` This process not only activates SSL/TLS encryption for your Debian FTP server but also sets up essential configurations. For example, the **log file for recording FTP connections** (*TLSLog*) is defined, along with the paths to the certificate (*TLSRSACertificateFile*) and key (*TLSRSACertificateKeyFile*). The supported protocol versions (*TLSProtocol*) are also specified. The final two lines ensure that the module does not verify client-presented certificates (*TLSVerifyClient*) and that **encryption is mandatory** for establishing a connection (*TLSRequired*). Restart the ProFTPD server to apply the changes: ```bash sudo /etc/init.d/proftpd restart ``` #### Step 3: Connecting to the ProFTPD server via SSL/TLS If you have enabled SSL/TLS for ProFTPD as recommended in this Debian FTP server tutorial, users will need an **FTP client that supports encrypted connections**. One of the most popular options is [FileZilla](https://www.ionos.com/digitalguide/server/configuration/filezilla-tutorial-for-the-ftp-client-program/), which is available not only for Debian and other Linux distributions but also for macOS and Windows. This open-source program is an excellent solution for **accessing the FTP server from various platforms**. In FileZilla’s server manager, select the secured **FTPS** option (*FTP over explicit TLS/SSL*) instead of regular FTP. During the initial connection to the server, the certificate will have to be accepted. If the TLS connection cannot be established in FileZilla, it might be necessary to manually load the mod\_tls module. Add the following line at the beginning of *proftpd.conf*: ```none LoadModule mod_tls.c ``` Restart the server to make the changes effective: ```bash sudo systemctl restart proftpd ``` Tip The [SSH File Transfer Protocol](https://www.ionos.com/digitalguide/server/know-how/sftp-ssh-file-transfer-protocol/) uses SSH instead of TLS/SSL and offers a streamlined, user-friendly alternative to FTPS. ### Tips and tricks for configuring ProFTPD The configurations presented here are just a small selection. The versatile FTP software allows for much **more specific and complex scenarios** for configuring your server. The official ProFTPD website provides many useful resources on this topic. The freely available [online documentation](http://proftpd.org/docs/ "proftpd.org: Online Manuals") includes **example setups, detailed how-tos, FAQs, and explanations** of individual directives. Additionally, information about various standard and additional modules is provided. ## Common errors during server configuration In some cases, restarting the ProFTPD server may result in the following error message: ```none mod_tls_memcache/0.1: notice: unable to register 'memcache' SSL session cache: Memcache support not enabled ``` This issue occurs because the *mod\_tls\_memcache* caching module is automatically enabled as part of SSL/TLS during ProFTPD’s compilation. While this module theoretically allows for **caching encrypted FTP sessions**, the default configuration does not include the required settings, leading to the **ProFTPD error message**. The solution is simple: **comment out the module** or its loading process in the configuration file: ```none # LoadModule mod_tls_memcache.c ``` Another common issue is a **failed connection**, which may arise during Debian FTP server setup. Use the following analysis options to troubleshoot: **1. Check if the ProFTPD server is running:** ```bash sudo service proftpd status ``` **2. Verify that the ProFTPD server is listening on [TCP port](https://www.ionos.com/digitalguide/server/know-how/tcp-ports-and-udp-ports/) 21 to register incoming FTP requests:** ```bash sudo netstat -tlp|grep proftpd ``` **3. Check ProFTPD log errors:** ```bash sudo tail -20 /var/log/proftpd/proftpd.log ``` **4. Check TLS log errors:** ```bash sudo tail -20 /var/log/proftpd/tls.log ``` **5. Test connection on port 21 using telnet:** ```bash sudo telnet [IP Address] 21 ``` **6. Test connection on port 21 using TLS:** ```bash sudo openssl s_client -connect [IP Address]:21 -starttls ftp ``` This is a markdown version of: [https://www.ionos.com/digitalguide/server/configuration/set-up-your-own-debian-ftp-server-with-proftpd/](https://www.ionos.com/digitalguide/server/configuration/set-up-your-own-debian-ftp-server-with-proftpd/) for AI/LLM consumption.