How to switch FTP service in HestiaCP: VSFTPD vs proftpd

Within the hosting ecosystem of websites and servers powered by the HestiaCP control panel, file transfer via File Transfer Protocol (FTP) remains a common operational setup. However, it requires extreme caution from systems engineers.

By default, the HestiaCP installer allows selecting or configuring a specific FTP daemon during system provisioning. The two daemons supported out of the box are VSFTPD (Very Secure FTP Daemon) and ProFTPD.

Although both perform the same transport function at the application layer (TCP Ports 20/21 and passive port ranges), their internal architectures diverge drastically. VSFTPD prioritizes absolute security through strict process isolation and low shared memory consumption. On the other hand, ProFTPD adopts a modular layout similar to the Apache web server, enabling extensibility, advanced directory virtualization via modules like mod_vroot, and rich configuration directives.

In this detailed infrastructure engineering guide, I show how to switch the default FTP service of the HestiaCP system in a controlled manner, covering preventive backups, passive port settings, TLS (FTPS) configuration, and emergency rollback procedures, under both migration paths.

1. Technical engineering comparison: VSFTPD vs proftpd#

Before running any configuration adjustments on a live production Linux server, it is highly important to analyze the internal characteristics of each daemon:

2. Migration flow 1: switch FTP service from VSFTPD to proftpd#

This migration is recommended when users encounter issues with chroot permissions in specific FTP clients, or when there is a need to apply complex access control rules at the sub-directory level (using .ftpaccess files).

Follow these steps carefully from your server shell with root user privileges:

Step 1: Performing preventive configuration backups#

Before making changes to hestia.conf or system daemons, create dated backups of critical configuration files:

# Backup Hestia configuration file
sudo cp /usr/local/hestia/conf/hestia.conf /usr/local/hestia/conf/hestia.conf.backup.$(date +%Y%m%d)

# Backup active FTP configuration files (if applicable)
sudo cp /etc/vsftpd.conf /etc/vsftpd.conf.backup.$(date +%Y%m%d) 2>/dev/null || true
sudo cp /etc/proftpd/proftpd.conf /etc/proftpd/proftpd.conf.backup.$(date +%Y%m%d) 2>/dev/null || true

Step 2: Audit and terminate active FTP sessions#

Stopping the service with active file transfers will corrupt uploads/downloads and break automated scripts. Audit active FTP connections on ports 20/21 before continuing:

# Check active FTP listening sockets
sudo ss -tnp | grep -E ':21|:20'

# If needed, terminate connections gracefully (SIGTERM) and fallback to SIGKILL:
sudo killall vsftpd 2>/dev/null || true
sleep 2
sudo killall -9 vsftpd 2>/dev/null || true

Step 3: Stopping and disabling the VSFTPD daemon#

Use systemctl to stop vsftpd and release TCP port 21:

# Stop active service
sudo systemctl stop vsftpd

# Disable system startup service
sudo systemctl disable vsftpd

Step 4: Installing proftpd packages#

Install the ProFTPD package along with the virtual root module (mod_vroot) to handle user directories properly in HestiaCP:

sudo apt-get update && sudo apt-get install proftpd-basic proftpd-mod-vroot -y

Step 5: Syncing HestiaCP templates#

HestiaCP stores custom config templates for ProFTPD. Overwrite the generic system configuration file with the Hestia template:

sudo cp /usr/local/hestia/install/deb/proftpd/proftpd.conf /etc/proftpd/proftpd.conf

Step 6: Hardening proftpd (passive ports & TLS)#

To ensure connections function properly behind NAT firewalls and secure sensitive credentials, edit proftpd.conf and adjust passive ports and TLS directives:

# 1. Define passive ports range (add outside specific blocks)
PassivePorts 30000 31000

# 2. Configure TLS/FTPS directives
<IfModule mod_tls.c>
  TLSEngine on
  TLSLog /var/log/proftpd/tls.log
  TLSRSACertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem
  TLSRSACertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key
  TLSRequired on
</IfModule>

Step 7: Updating HestiaCP internal settings#

Update the FTP_SYSTEM variable inside HestiaCP configurations:

sudo sed -i "s/FTP_SYSTEM='vsftpd'/FTP_SYSTEM='proftpd'/g" /usr/local/hestia/conf/hestia.conf

(Or for simple key-value definitions without quotes):

sudo sed -i "s/vsftpd/proftpd/" /usr/local/hestia/conf/hestia.conf

Step 8: Starting and enabling the proftpd service#

Enable boot-time startup and launch the ProFTPD service:

sudo systemctl enable proftpd
sudo systemctl restart proftpd

After performing these steps, ProFTPD will take over FTP connection management on your server.

3. Migration flow 2: switch FTP service from proftpd to VSFTPD (reversion)#

If you need to optimize RAM usage on the server and are looking for absolute security and operational efficiency with low disk I/O, execute the reverse flow to reinstall and enable VSFTPD.

Step 1: Performing preventive configuration backups#

Before making changes to hestia.conf or configurations, create dated backups of critical files:

# Backup Hestia configuration file
sudo cp /usr/local/hestia/conf/hestia.conf /usr/local/hestia/conf/hestia.conf.backup.$(date +%Y%m%d)

# Backup active FTP configuration files
sudo cp /etc/proftpd/proftpd.conf /etc/proftpd/proftpd.conf.backup.$(date +%Y%m%d) 2>/dev/null || true
sudo cp /etc/vsftpd.conf /etc/vsftpd.conf.backup.$(date +%Y%m%d) 2>/dev/null || true

Step 2: Audit and terminate active FTP sessions#

Inspecione se há sessões ativas nas portas FTP padrão (TCP 20/21) antes de parar o ProFTPD:

# Check active FTP connections
sudo ss -tnp | grep -E ':21|:20'

# If needed, terminate connections gracefully (SIGTERM) and fallback to SIGKILL:
sudo killall proftpd 2>/dev/null || true
sleep 2
sudo killall -9 proftpd 2>/dev/null || true

Step 3: Stopping and disabling the proftpd service#

Stop ProFTPD and remove it from system startup:

# Stop active service
sudo systemctl stop proftpd

# Disable service in boot configuration
sudo systemctl disable proftpd

Step 4: Installing VSFTPD package#

If VSFTPD is no longer installed on the machine, install it using the apt package manager:

sudo apt-get update && sudo apt-get install vsftpd -y

Step 5: Syncing HestiaCP templates#

Copy the Hestia template configurations into vsftpd config:

sudo cp /usr/local/hestia/install/deb/vsftpd/vsftpd.conf /etc/vsftpd.conf

Step 6: Hardening VSFTPD (passive ports & TLS)#

Edit vsftpd.conf to enable passive ports ranges and force SSL/TLS (FTPS) encryption for secure logins and transfers:

# 1. Define passive ports range and public IP
pasv_enable=YES
pasv_min_port=30000
pasv_max_port=31000
pasv_address=SERVER_PUBLIC_IP

# 2. Enforce TLS/FTPS settings
ssl_enable=YES
rsa_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
rsa_private_key=/etc/ssl/private/ssl-cert-snakeoil.key
force_local_logins_ssl=YES
force_local_data_ssl=YES

Step 7: Updating HestiaCP configurations#

Set Hestia settings to recognize vsftpd:

sudo sed -i "s/FTP_SYSTEM='proftpd'/FTP_SYSTEM='vsftpd'/g" /usr/local/hestia/conf/hestia.conf

(Or generic replacement for simplified keys):

sudo sed -i "s/proftpd/vsftpd/" /usr/local/hestia/conf/hestia.conf

Step 8: Starting and enabling VSFTPD service#

Start VSFTPD and enable boot startup:

sudo systemctl enable vsftpd
sudo systemctl restart vsftpd

4. SRE and forensic audit tasks#

After performing the switch, execute these audit steps to verify network firewall configurations, security mechanisms, and user access:

A. Firewall verification (UFW / iptables / nftables)#

FTP lookups require opening controls (TCP 20, 21) as well as the passive ports range configured above:

# Option 1: View and allow ports with UFW (Ubuntu/Debian)
sudo ufw status
sudo ufw allow 21/tcp
sudo ufw allow 20/tcp
sudo ufw allow 30000:31000/tcp

# Option 2: Check standard Iptables rules
sudo iptables -L -n | grep -E '21|20|3000'

# Option 3: List modern Nftables rules
sudo nft list ruleset | grep -E '21|20|3000'

B. Mandatory access control auditing (SELinux / AppArmor)#

MAC systems might block FTP daemons from reading user home directory boundaries or writing log outputs:

# 1. Check SELinux status
getenforce

# If active, allow FTP full home directory reads and writes:
sudo setsebool -P ftpd_full_access on

# 2. Check active AppArmor profiles for vsftpd or proftpd
sudo aa-status | grep -E 'vsftpd|proftpd'

C. Emergency migration rollback procedures#

If the migration fails or users face severe validation locks, quickly reverse to vsftpd using:

# 1. Stop and disable ProFTPD
sudo systemctl stop proftpd
sudo systemctl disable proftpd

# 2. Restore previous backup configuration
sudo cp /etc/vsftpd.conf.backup.* /etc/vsftpd.conf 2>/dev/null || true

# 3. Restore hestia.conf settings
sudo sed -i "s/FTP_SYSTEM='proftpd'/FTP_SYSTEM='vsftpd'/g" /usr/local/hestia/conf/hestia.conf

# 4. Start and enable vsftpd
sudo systemctl enable vsftpd
sudo systemctl start vsftpd

D. Post-migration verification checklist#

Run these SRE tests to validate structural success:

1. Verify service status: sudo systemctl status proftpd (or vsftpd)
2. Inspect listening sockets: sudo ss -tulpn | grep :21
3. Inspect error logs: sudo tail -n 50 /var/log/proftpd/proftpd.log (or /var/log/vsftpd.log)
4. Verify panel integration: v-list-sys-services

E. Secure client connection verification#

⚠️ WARNING: The traditional command-line ftp utility is not recommended as it transmits credentials in cleartext. Do not use it on live systems. Use the secure CLI methods below:

# Option 1: Native encrypted SFTP transfer (Recommended)
sftp [email protected]

# Option 2: Force FTPS with SSL/TLS using lftp
# Install lftp utility
sudo apt-get install lftp -y
# Run connection with enforced SSL
lftp -u [email protected] -e "set ftp:ssl-force true; ls; bye" domain.com

# Option 3: Secure FTPS query with curl
curl --ftp-ssl -u [email protected] ftps://domain.com/

See also

Infrastructure Best Linux control panels in 2026: cPanel vs DirectAdmin vs CyberPanel

WordPress How to Detect and Clean Compromised WordPress Sites: Complete Forensic & Sanitization Guide

Cybersecurity cPanel security in production: Imunify360, csf/lfd, and wordfence CLI

This post is licensed under CC BY-NC.