Configure vsftpd to use SSL/TLS on Ubuntu VPS, dedi or physical machine. This how-to assumes vsftpd is already configured and running without encryption support.

Generate SSL certificate

Let’s create some SSL certificates to use with vsftpd. Change -nodes-days to desired number of days, example bellow assumes  one year (365 days).

openssl req -x509 -nodes -days 365 -newkey rsa:1024 -keyout /etc/ssl/private/vsftpd.pem -out /etc/ssl/private/vsftpd.pem

Edit /etc/vsftpd.conf

Add the following lines to vsftpd config file:

# Uncomment or add the path to cert
# we generated in previous step
rsa_cert_file=/etc/ssl/private/vsftpd.pem

# Enable SSL support
ssl_enable=YES

# Force local users to use SSL
allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES

# allow only TLS, not SSL
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO

# Some additional security and compatibility settings
# Filezilla reports GnuTLS error without strong ciphers
require_ssl_reuse=NO
ssl_ciphers=HIGH

# Optional: enable passive connection if not already configured
# (add appropriate rules to your firewall - iptables/UFW etc.)
pasv_enable=YES
pasv_min_port=63000
pasv_max_port=63100

Restart service

sudo service vsftpd restart

Connect with client

Now connect with your favourite client (like Filezilla), don’t forget to set Require explicit FTP over TLS. Port stays default 21, if you didn’t specify otherwise in the config file of course.