Setting Up an FTP Server on Raspberry Pi

Why Run an FTP Server on a Raspberry Pi

A Raspberry Pi makes an excellent low-power FTP server for home labs, local networks, and small-scale file sharing. Whether you need a central place to drop photos from a digital camera, host firmware updates for IoT devices, or back up project files, the Pi can handle the job quietly and cheaply. This guide walks through the core setup using vsftpd, covers the more secure SFTP alternative, and addresses basic hardening and remote access.

Installing vsftpd on Raspberry Pi OS

Vsftpd (Very Secure FTP Daemon) is the most common FTP server for Raspberry Pi. It is lightweight, stable, and available in the standard Raspberry Pi OS repositories. Before installing, ensure your Pi is up to date:

• Run sudo apt update && sudo apt upgrade
• Install vsftpd with sudo apt install vsftpd
• Enable and start the service: sudo systemctl enable vsftpd && sudo systemctl start vsftpd

Basic Configuration

The main configuration file lives at /etc/vsftpd.conf. After opening it with a text editor, adjust these common settings:

• anonymous_enable=NO — disables unauthenticated access
• local_enable=YES — allows local system users to log in
• write_enable=YES — permits file uploads and deletions
• chroot_local_user=YES — locks users into their home directories

Save the file and restart vsftpd with sudo systemctl restart vsftpd. The default FTP port is 21, and the server will now listen on it.

Using SFTP Instead of Plain FTP

Plain FTP sends credentials and data in cleartext, which is risky on untrusted networks. SFTP, built into SSH, provides encryption and authentication without running a separate daemon. To use SFTP:

• Ensure the SSH server is installed (sudo apt install openssh-server)
• Start and enable SSH (sudo systemctl enable ssh && sudo systemctl start ssh)
• Connect with any SFTP client using the Pi's username, password, and IP address on port 22

SFTP is the recommended choice for most Raspberry Pi setups, especially when accessing the server from outside the local network.

Creating a Dedicated FTP User

For security, create a user specifically for file transfers rather than using your main login. This limits what the user can do if credentials are compromised.

• Add the user: sudo adduser ftpuser
• Set a strong password and fill in the prompts
• Optionally restrict shell access to prevent interactive logins: change the shell to /usr/sbin/nologin in /etc/passwd
• Set ownership of the target directory: sudo chown -R ftpuser:ftpuser /home/ftpuser

If you use vsftpd with chroot_local_user=YES, the user's home directory must not be writable by the user for the chroot to work. A common workaround is to create an FTP root inside the home folder (e.g., /home/ftpuser/ftp), make it owned by root, and let the user write to a subdirectory inside it.

Opening the Firewall

A Raspberry Pi running a firewall should allow the necessary ports. If you use ufw, the commands are straightforward:

• sudo ufw allow 21/tcp — for vsftpd
• sudo ufw allow 22/tcp — for SFTP
• sudo ufw enable — to activate the firewall

Check the status with sudo ufw status. For passive mode in vsftpd, you may also need to open a passive port range (for example, 40000–50000) in the configuration file and in the firewall.

Accessing the FTP Server Remotely

From the same local network, connect with any FTP or SFTP client using the Pi's local IP address. To reach the server from the internet, you have a few options:

• Port forwarding on your router — forward port 21 (or 22 for SFTP) to the Pi's local IP
• VPN — a WireGuard or Tailscale tunnel avoids exposing any ports to the public internet
• Reverse proxy or tunnel — services like Cloudflare Tunnel can provide secure remote access without firewall changes

Port forwarding is the simplest but least secure. If you must expose FTP directly, at minimum restrict access with strong passwords, keep vsftpd patched, and consider limiting source IPs on the router.

Comparing FTP and SFTP on Raspberry Pi

For most Raspberry Pi deployments, SFTP offers the best balance of simplicity and security. Reserve plain FTP for scenarios where you need compatibility with legacy clients or devices that do not support SSH.