Install vsftpd with Homebrew, apk, apt, dnf, MacPorts, Nix, pacman, zypper

Project links

• Homepage
• Package manager page

Commands and aliases

• vsftpd

Project history

The project is associated with Chris Evans and the security-oriented 'scary beasts' site. Its upstream documentation frames vsftpd as a reaction against older FTP daemons whose feature breadth and root-heavy designs made them risky, highlighting capabilities, chroot, privilege separation, and secure coding as design choices.

The 3.x series made security mechanisms more explicit. Version 3.0.0, released in April 2012, added a highly restrictive seccomp filter sandbox on supported 64-bit Linux systems. Later upstream news records SSL and seccomp fixes in 2012 and 2015, and a 2021 modernization release after a six-year gap.

Adoption history

vsftpd became widely deployed because it fit the conservative Unix server niche: small, stable, and aimed at doing FTP service with fewer privileges. The official site listed prominent FTP mirrors using it as of June 2004, including Red Hat, SUSE, Debian, FreeBSD, GNU, GNOME, KDE, and kernel.org mirrors, while also citing Red Hat's performance use case.

Distribution documentation helped normalize it as a default or preferred FTP daemon. Red Hat Enterprise Linux 6 documented vsftpd as the only standalone FTP server distributed with RHEL because of its ability to handle many connections efficiently and securely.

How it is used

Administrators use vsftpd to provide anonymous or authenticated FTP service, often with per-user controls, virtual users, virtual IP configurations, bandwidth throttling, per-source limits, IPv6, and SSL/TLS. The upstream man page says the default configuration path is `/etc/vsftpd.conf`, with alternate config files supplied as command-line arguments for virtual-host or inetd/xinetd-style setups.

Its package-nerd appeal is that it is deliberately unflashy infrastructure. FTP itself is old and declining, but when a package archive, appliance, lab, or compatibility environment still needs an FTP daemon, vsftpd is the boring security-conscious answer that many Unix distributions have kept around.

Why package nerds care

vsftpd is historically important because it represents the post-wu-ftpd era of FTP packaging: the same protocol surface, but with a smaller daemon, explicit privilege boundaries, and distribution-friendly configuration. It is a classic example of a package whose continued relevance is maintenance of legacy protocol infrastructure rather than new feature growth.

Timeline

• 2004-06: The official site listed major public FTP mirrors using vsftpd, including Red Hat, SUSE, Debian, FreeBSD, GNU, GNOME, KDE, and kernel.org.
• 2012-04: vsftpd 3.0.0 was released with a seccomp filter sandbox.
• 2012-09: vsftpd 3.0.2 fixed seccomp sandbox policy issues.
• 2015-07: vsftpd 3.0.3 focused on SSL fixes and security improvements.
• 2021-08: vsftpd 3.0.4 and 3.0.5 modernized build, seccomp, and SSL behavior; 3.0.5 fixed ALPN selection for current FileZilla clients.
• 2026-06: Debian unstable carried vsftpd 3.0.5 packaging changes and bug-fix patches, showing continued distribution maintenance.

Related projects

• The official site explicitly contrasts vsftpd with older or broader FTP daemons such as wu-ftpd, ProFTPD, and BSD ftpd.
• OpenSSH/SFTP is the modern neighboring ecosystem for many use cases, while vsftpd remains focused on the FTP/FTPS protocol family.

Sources

• Debian changelog: https://metadata.ftp-master.debian.org/changelogs/main/v/vsftpd/unstable_changelog
• Official configuration manual: https://security.appspot.com/vsftpd/vsftpd_conf.html
• Official site and release notes: https://security.appspot.com/vsftpd.html
• Red Hat Enterprise Linux deployment guide: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/6/html/deployment_guide/s2-ftp-servers-vsftpd