FTP Protocol: File Transfer 2026 — Complete Guide with Python, vsftpd, and Security

Client: EPSV
Server: 229 Entering Extended Passive Mode (|||32800|)

220 — Service ready for new user
221 — Service closing control connection
226 — Transfer complete (data connection closed)
227 — Entering Passive Mode (h1,h2,h3,h4,p1,p2)
229 — Entering Extended Passive Mode (|||port|)
230 — User logged in, proceed
331 — User name OK, need password
425 — Can't open data connection
450 — Requested file action not taken (file unavailable)
500 — Syntax error, command unrecognized
530 — Not logged in
550 — Requested action not taken (file not found)

Client: AUTH TLS
Server: 234 AUTH TLS OK
[TLS handshake occurs]
Client: USER john
Server: 331 Password required
[All subsequent communication encrypted]

sudo apt update
sudo apt install vsftpd

# Backup default config
sudo cp /etc/vsftpd.conf /etc/vsftpd.conf.backup

# /etc/vsftpd.conf — secure anonymous-only read-only FTP

# Disable anonymous access (enable only if needed)
anonymous_enable=NO
local_enable=YES
write_enable=YES

# Restrict users to their home directories
chroot_local_user=YES
allow_writeable_chroot=YES

# Passive mode port range (open these in firewall)
pasv_min_port=50000
pasv_max_port=50100

# Logging
xferlog_enable=YES
xferlog_std_format=YES
log_ftp_protocol=YES

# Rate limiting (1000 KB/s max)
local_max_rate=1000000

# /etc/vsftpd.conf — add TLS support
ssl_enable=YES
allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES

# TLS certificates (generate or use Let's Encrypt)
rsa_cert_file=/etc/ssl/certs/vsftpd.pem
rsa_private_key_file=/etc/ssl/private/vsftpd.pem

# Require TLS 1.2+ (disable obsolete protocols)
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO

# vsftpd 3.0.5+ supports explicit TLS 1.2/1.3 directives
ssl_tlsv1_2=YES
ssl_tlsv1_3=YES

# Restrict cipher suites
ssl_ciphers=HIGH

sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
    -keyout /etc/ssl/private/vsftpd.pem \
    -out /etc/ssl/certs/vsftpd.pem \
    -subj "/CN=ftp.example.com"

sudo chmod 600 /etc/ssl/private/vsftpd.pem
sudo systemctl restart vsftpd

# Open FTP control and passive data ports
sudo ufw allow 21/tcp
sudo ufw allow 50000:50100/tcp
sudo ufw reload

# Create a local user to map virtual users to
sudo useradd --home /home/vsftpd --gid nogroup -m --shell /bin/false vsftpd

# /etc/vsftpd.conf — virtual user settings
anonymous_enable=NO
local_enable=YES
write_enable=YES

# Virtual user mapping
guest_enable=YES
guest_username=vsftpd
virtual_use_local_privs=YES

# Per-user config directory
user_config_dir=/etc/vsftpd/user_conf

# Chroot all virtual users
chroot_local_user=YES
allow_writeable_chroot=YES

# Passive port range
pasv_min_port=50000
pasv_max_port=50100

# TLS
ssl_enable=YES
force_local_data_ssl=YES
force_local_logins_ssl=YES
rsa_cert_file=/etc/ssl/certs/vsftpd.pem
rsa_private_key_file=/etc/ssl/private/vsftpd.pem

# Create password file (username on odd lines, password on even)
sudo tee /etc/vsftpd/virtual_users.txt <<EOF
alice
strong-password-1
bob
strong-password-2
EOF

# Generate the database
sudo db_load -T -t hash -f /etc/vsftpd/virtual_users.txt \
    /etc/vsftpd/virtual_users.db
sudo chmod 600 /etc/vsftpd/virtual_users.db

# /etc/pam.d/vsftpd
sudo tee /etc/pam.d/vsftpd <<EOF
auth required pam_userdb.so db=/etc/vsftpd/virtual_users
account required pam_userdb.so db=/etc/vsftpd/virtual_users
EOF

# Create per-user config
sudo mkdir -p /etc/vsftpd/user_conf

# Each user gets a config file
echo "local_root=/srv/ftp/alice" | sudo tee /etc/vsftpd/user_conf/alice
echo "local_root=/srv/ftp/bob"   | sudo tee /etc/vsftpd/user_conf/bob

sudo mkdir -p /srv/ftp/alice /srv/ftp/bob
sudo chown vsftpd:nogroup /srv/ftp/alice /srv/ftp/bob

from ftplib import FTP

def ftp_upload(filename, host, username, password):
    with FTP(host) as ftp:
        ftp.login(user=username, passwd=password)
        ftp.voidcmd('TYPE I')          # Binary mode (TYPE I = Image)
        with open(filename, 'rb') as f:
            ftp.storbinary(f'STOR {filename}', f)
        print(f'Uploaded {filename}')

def ftp_download(filename, host, username, password):
    with FTP(host) as ftp:
        ftp.login(user=username, passwd=password)
        ftp.voidcmd('TYPE I')
        with open(filename, 'wb') as f:
            ftp.retrbinary(f'RETR {filename}', f.write)
        print(f'Downloaded {filename}')

def ftp_list_files(host, username, password):
    with FTP(host) as ftp:
        ftp.login(user=username, passwd=password)
        files = []
        ftp.retrlines('LIST', files.append)
        for f in files:
            print(f)

from ftplib import FTP

with FTP('ftp.example.com') as ftp:
    ftp.login()
    ftp.cwd('/pub')                    # Change directory
    ftp.mkd('newdir')                   # Create directory
    ftp.delete('oldfile.txt')           # Delete file
    ftp.rename('old.txt', 'new.txt')    # Rename
    size = ftp.size('largefile.zip')    # Get file size in bytes
    print(f'Size: {size} bytes')

from ftplib import FTP, error_perm, error_temp, error_reply

def safe_download(host, username, password, remote_file, local_file):
    try:
        with FTP(host, timeout=30) as ftp:
            ftp.login(username, password)
            ftp.voidcmd('TYPE I')
            with open(local_file, 'wb') as f:
                ftp.retrbinary(f'RETR {remote_file}', f.write)
        return True
    except error_perm as e:
        # Permanent error: file not found, permission denied
        print(f"Permission error: {e}")
    except error_temp as e:
        # Temporary error: retry later
        print(f"Temporary error, retry: {e}")
    except error_reply as e:
        # Unexpected reply code
        print(f"Unexpected reply: {e}")
    except TimeoutError:
        print("Connection timed out")
    return False

from ftplib import FTP
import os

def download_with_resume(host, username, password, remote_file, local_file):
    offset = os.path.getsize(local_file) if os.path.exists(local_file) else 0

    with FTP(host) as ftp:
        ftp.login(username, password)
        ftp.voidcmd('TYPE I')

        if offset > 0:
            ftp.rest(offset)           # RESTART at byte offset

        with open(local_file, 'ab') as f:
            ftp.retrbinary(f'RETR {remote_file}', f.write, rest=offset)
        print(f'Downloaded {remote_file} (resumed at byte {offset})')

from ftplib import FTP
import os

def download_tree(host, username, password, remote_root, local_root):
    with FTP(host) as ftp:
        ftp.login(username, password)

        def recurse(remote_dir, local_dir):
            os.makedirs(local_dir, exist_ok=True)
            ftp.cwd(remote_dir)

            for entry in ftp.mlsd():
                name, attrs = entry
                if name in ('.', '..'):
                    continue
                if attrs['type'] == 'dir':
                    recurse(f'{remote_dir}/{name}',
                            os.path.join(local_dir, name))
                else:
                    local_path = os.path.join(local_dir, name)
                    with open(local_path, 'wb') as f:
                        ftp.retrbinary(f'RETR {name}', f.write)

        recurse(remote_root, local_root)

# Download entire /pub/docs tree to ./docs
download_tree('ftp.example.com', 'user', 'pass', '/pub/docs', './docs')

from ftplib import FTP_TLS

class SecureFTP:
    def __init__(self, host, username, password):
        self.ftp = FTP_TLS(host)
        self.ftp.login(username, password)
        self.ftp.prot_p()  # Enable data channel encryption (PROT P)

    def upload(self, filename):
        with open(filename, 'rb') as f:
            self.ftp.storbinary(f'STOR {filename}', f)

    def download(self, filename):
        with open(filename, 'wb') as f:
            self.ftp.retrbinary(f'RETR {filename}', f.write)

import ssl
from ftplib import FTP_TLS

context = ssl.create_default_context()
context.check_hostname = False
context.verify_mode = ssl.CERT_NONE

ftp = FTP_TLS('ftp.example.com', context=context)

import paramiko

class SFTPClient:
    def __init__(self, host, port, username, password=None, key_file=None):
        transport = paramiko.Transport((host, port))
        if key_file:
            key = paramiko.RSAKey.from_private_key_file(key_file)
            transport.connect(username=username, pkey=key)
        else:
            transport.connect(username=username, password=password)
        self.sftp = paramiko.SFTPClient.from_transport(transport)

    def upload(self, local_path, remote_path):
        self.sftp.put(local_path, remote_path)

    def download(self, remote_path, local_path):
        self.sftp.get(remote_path, local_path)

    def list_files(self, path):
        return self.sftp.listdir(path)

    def close(self):
        self.sftp.close()

client = SFTPClient('server.example.com', 22, 'user', password='secret')
client.upload('/local/file.txt', '/remote/file.txt')
client.close()

# List directory over FTP
curl ftp://ftp.example.com --user username:password

# FTP download
curl -O ftp://ftp.example.com/file.zip --user username:password

# FTP upload
curl -T file.zip ftp://ftp.example.com/ --user username:password

# FTPS (explicit) upload
curl --ftp-ssl -T file.zip ftp://ftp.example.com/ --user username:password

# FTPS (implicit) upload
curl --ftp-ssl-reqd -T file.zip ftps://ftp.example.com/ --user username:password

# SFTP upload via SSH
curl -T file.zip sftp://server.example.com/ --user username:password

import logging
from ftplib import FTP, error_perm
from datetime import datetime
from pathlib import Path

logging.basicConfig(
    level=logging.INFO,
    format='%(asctime)s [%(levelname)s] %(message)s',
    handlers=[
        logging.FileHandler('/var/log/ftp-sync.log'),
        logging.StreamHandler()
    ]
)

def sync_files(host, username, password, remote_dir, local_dir):
    local_dir = Path(local_dir)
    local_dir.mkdir(parents=True, exist_ok=True)

    try:
        with FTP(host, timeout=60) as ftp:
            ftp.login(username, password)
            ftp.cwd(remote_dir)
            ftp.voidcmd('TYPE I')

            files = []
            ftp.retrlines('NLST', files.append)

            for filename in files:
                local_path = local_dir / filename
                with open(local_path, 'wb') as f:
                    ftp.retrbinary(f'RETR {filename}', f.write)
                logging.info(f"Downloaded {filename}")

        logging.info(f"Sync completed: {len(files)} files")
        return True

    except error_perm as e:
        logging.error(f"Permanent error during sync: {e}")
    except Exception as e:
        logging.error(f"Sync failed: {e}")

    return False

import time
from ftplib import FTP

def check_ftp_health(host, port=21, timeout=10):
    """Check FTP server availability and response time."""
    start = time.monotonic()
    try:
        with FTP() as ftp:
            ftp.connect(host, port, timeout=timeout)
            ftp.voidcmd('NOOP')  # No-operation command tests connectivity
        elapsed = (time.monotonic() - start) * 1000
        return {"status": "ok", "latency_ms": round(elapsed, 1)}
    except Exception as e:
        return {"status": "error", "message": str(e)}

# /etc/vsftpd.conf — production security settings

# Disable anonymous access
anonymous_enable=NO

# Chroot local users to their home directory
chroot_local_user=YES
allow_writeable_chroot=YES

# Require TLS for all logins and data
ssl_enable=YES
force_local_logins_ssl=YES
force_local_data_ssl=YES

# Restrict TLS versions (disable obsolete)
ssl_tlsv1=YES
ssl_tlsv1_2=YES
ssl_tlsv1_3=YES
ssl_sslv2=NO
ssl_sslv3=NO

# Restrict ciphers to strong suites
ssl_ciphers=HIGH

# Limit max clients and rate
max_clients=50
max_per_ip=5
local_max_rate=1000000    # 1000 KB/s

# Log all commands and responses
log_ftp_protocol=YES
vsftpd_log_file=/var/log/vsftpd.log

# Failed login attempts
Tue May 20 08:15:30 2026 [pid 1234] [root] FAIL LOGIN: Client "203.0.113.50"

# Anonymous access attempts
Tue May 20 08:20:00 2026 [pid 1235] ANONYMOUS LOGIN (Client "198.51.100.20")

# File access outside chroot (security violation)
Tue May 20 08:25:00 2026 [pid 1236] [user1] FAIL CHROOT: "/etc/passwd"

# /etc/fail2ban/jail.d/vsftpd.conf
[vsftpd]
enabled = true
port = ftp,ftp-data
filter = vsftpd
logpath = /var/log/vsftpd.log
maxretry = 3
bantime = 3600