How to Configure an FTP Server on Debian 12: A Thorough Guide for Beginners and Professionals

In today’s digital era, transferring files securely and efficiently is a common requirement for many professionals and businesses. The File Transfer Protocol (FTP) server remains one of the most popular methods for transferring files between local and remote systems. Whether you’re a beginner looking to set up your first FTP server on Debian 12, or a professional refining your system configurations, this guide will walk you through the process step-by-step.

What is FTP, and Why Use It?

FTP (File Transfer Protocol) is a standard network protocol used to transfer files between a client and server over a TCP/IP network. It’s an essential tool for webmasters, developers, system administrators, and businesses needing to share large files across different systems.

Some benefits of using FTP include:

• Ease of use: FTP clients are widely available, making it easy to connect to FTP servers.
• Security: With proper configuration, FTP servers can be secured using SSL/TLS encryption (FTPS).
• Efficiency: FTP allows for large file transfers without losing data integrity.

Prerequisites

• A fresh Debian 12 installation: This guide assumes that Debian 12 is already installed and updated.
• Root or sudo privileges: You need superuser privileges to install software and configure the server.
• A basic understanding of the Linux command line: Though beginners can follow along, familiarity with terminal commands will make the process smoother.

Step 1: Update Your System

apt update

Step 2: Install the FTP Server Software (vsftpd)

apt search vsftpd 
apt install vsftpd -y

Step 3: Start and Enable the FTP Service

systemctl start vsftpd.service
systemctl enable vsftpd.service

Step 4: Allow the ftp service or port in the firewall

ufw allow ftp
    or

ufw allow 20/tcp
ufw allow 21/tcp

Step 5: Configure the FTP Server (vsftpd)

The configuration file of vsftpd is located at /etc/vsftpd.conf.

vim /etc/vsftpd.conf

# ADD PASSIVE MODE FOR ALL THE CONFIGURATION

pasv_enabl=YES
pasv_min_port=55000
pasv_min_port=55999

1. Allow Anonymous Access :

By default, vsftpd disallows the anonymous access for the security reasons if you want to allow the anonymous users to log in without credentials ( for public sharing ) set:

anonymous_enable=YES

systemctl restart vsftpd.service

the default sharing direct is /srv/ftp. place the public data here and can access through the client. you can use file explorer , any software or ftp client in linux to access. Just provoide the username from above and any password.

allowed usernames:- ftp / anonymous / anon

ftp ip_address

Note:- The anonymous user are given the power of get ( read ) only. They can not place write or place content on server.

To Allow the Anonymous users to be able to write then. Create a folder at /srv/ftp/sharedFolder, and provide 777 permission to the folder only.

mkdir -p /srv/ftp/sharedFolder
chmod 777 /srv/ftp/sharedFolder

Add some configurations to the config file.

anon_root=/srv/ftp/sharedFolder    #root directory for the anonymous users
write_enable=YES                   #Permission to be able to write
anon_upload_enable=YES             #Permission to upload the folder

systemctl restart vsftpd.service

NOTE:- It is better to avoid the using and enabling the anonymous user because anonymous user with write permission can lead to security breach.

2. Local User Access:

To allow the users of the server to be able to login with, we need to add some configuration to the file.

The default directory for the local users will be the /home/user but need to be set first, you can set any directory as after login dir.

mkdir -p /backup/ftpfolder
chmod 777 /backup/ftpfolder

local_enable=YES                   # allow the local users
write_enable=YES                   # allow the write access
local_root=/backup/folder          # same directory for all users
allow_writeable_user               # to be able to login the user in chroot ( this can be risky to enable )
chroot_local_user=YES              # user will not be able to change the directory

You can secify the home directory as well but need to provide a folder available
in all the user directories with 777 permission to able to write.

user_sub_token=$USER
local_root=/home/$USER/folder-name

systemctl restart vsftpd.service

3. Enable the root login:

Ftp server does not allow the root to login, to enable the root login we need to check out the file /etc/ftpusers. This file contains the list of users whose login access is restricted.

vim /etc/ftpusers

comment the root user to enable the ftp login through root as well.

systemctl restart vsftpd.service

4. Deny And Allow List

• Deny List: This can be done with a file /etc/ftpusers, this file is used for deny ftp login. just create an entry of the user whom to block or deny.

vim /etc/ftpusers

user-name

systemctl restart vsftpd.service

• Allow List: To create the allow, there are some configurations need to be added. We need to create a file at /etc/file-name

vim /etc/allow_list

make the entry of the user in the file

local_root=/backup/ftpfolder
chroot_local_user=YES
allow_writeable_chroot=YES
userlist_enable=YES
userlist_file=/etc/allow_list
userlist_deny=NO              #allow the users from the list

systemctl restart vsftpd.service

Step 5: Test the service through ftp client

ftp client provides various commands to handle the operations

ftp ip_address

• check out the commands available in the ftp client

after login use ? to check the commands available

?

• to get the data from the server

get file-name

# TO GET MULTIPLE FILES AT ONES

mget file1 file2 file3

• to put the data onto the server

put file-name

# TO PUT MULTIPLE FILES AT ONES

mput file1 file2 file3

Conclusion

By following these steps, you’ve successfully configured vsftpd on Debian 12 to allow local users to read and write files over FTP. You also learned how to restrict users to their home directories (chroot), adjust file permissions, and enable FTPS for secure file transfers.

Remember that FTP (especially without SSL/TLS) is not the most secure protocol for transmitting sensitive data. If security is a concern, consider using SFTP (SSH File Transfer Protocol), which encrypts data by default.