Pure-FTPd is a FTP server designed with security in mind.
The server can be started using
systemctl start pure-ftpd (as the root user).
To start the server automatically, use
systemctl enable pure-ftpd (as the root user).
For more information on how to manage the service, refer to using units.
Pure-FTPd configuration is completely done with its startup arguments.
There is a wrapper script, which reads
/etc/pure-ftpd/pure-ftpd.conf. It then starts Pure-FTPd with the corresponding arguments.
Set up virtual users
With Pure-FTPd, it's possible to use virtual users instead of real system users.
The available users need to be provided by one ore more backends. See backends.
For simplicity and demonstration purposes, the PureDB backend will be used. Uncomment the following two lines:
# We disable the anonymous account. NoAnonymous yes # We use PureDB as backend and specify its path. PureDB /etc/pureftpd.pdb
Now only authenticated users can connect. To add users to the PureDB we need to create a
/etc/passwd-like file which is then used to create the PureDB.
To create, view, or modify the
/etc/pureftpd.passwd file, we use the
# pure-pw useradd someuser -u ftp -d /srv/ftp
This creates the user someuser which runs as the FTP system user. By default, the user is chrooted to
/srv/ftp. In the event that that's undesirable, replace
The virtual users running as the FTP system users can not log in by default. To change that behavior, set the option MinUID in
/etc/pure-ftpd.conf to 14 (UID of the ftp user).
We also need to list the shell of the FTP system user in
# echo "/bin/false" >> /etc/shells
--with-virtualchroot. You can use
mount --bind source targetas a workaround.
Before this account is usable, we need to commit our changes:
# pure-pw mkdb
The virtual user can now access everything in
pure-pw mkdb creates the file mentioned earlier called
/etc/pureftpd.pdb, which houses all information related to your virtual users. There is no need to restart your service when issuing this command as it is updated on the fly and changes take effect immediately.
Changing user password
For example, to change a user's password, type the command:
# pure-pw passwd someuser
Afterwards, commit your changes by updating
# pure-pw mkdb
To remove a user, type the command:
# pure-pw userdel someuser
The user's home directory is not removed via this command; therefore, it must be removed manually.
Checking user settings
To check a user's current account settings, type the command:
# pure-pw show someuser
You need to specify one or more backends. If you specify more than one, Pure-FTPd will respect the order in which they are specified. It will use the first backend which contains the requested user.
Available backends are:
Set up TLS
Create a certificate
Refer to the documentation for more information. The short version is this:
Create a Self-Signed Certificate:
# mkdir -p /etc/ssl/private # openssl req -x509 -nodes -days 7300 -newkey rsa:2048 -sha256 -keyout /etc/ssl/private/pure-ftpd.pem -out /etc/ssl/private/pure-ftpd.pem
Make it private:
# chmod 600 /etc/ssl/private/*.pem
Towards the bottom of
/etc/pure-ftpd.conf you should find a section for TLS. Uncomment and change the TLS setting to
1 to enable both FTP and FTPS:
Now restart the
pure-ftpd.service daemon and you should be able to log in with FTPS-enabled clients, e.g. or SmartFTP.